Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Material Requirments.pif.exe

Overview

General Information

Sample name:Material Requirments.pif.exe
Analysis ID:1586795
MD5:3a9da3edc40736cc832eded3c389a661
SHA1:f32f61fb4458696dae4f15d82377163521e4f8b5
SHA256:f2418ca6e602c9470a8b6e32172432726e50b00d6e7a0ee5bd70d0172017d6c3
Tags:exeuser-lowmal3
Infos:

Detection

Remcos, PureLog Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected PureLog Stealer
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Creates autostart registry keys with suspicious names
Delayed program exit found
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evaded block containing many API calls
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic
Yara signature match

Classification

Process Tree

  • System is w10x64
  • Material Requirments.pif.exe (PID: 1492 cmdline: "C:\Users\user\Desktop\Material Requirments.pif.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)
    • Material Requirments.pif.exe (PID: 7016 cmdline: "C:\Users\user\Desktop\Material Requirments.pif.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)
      • remcos.exe (PID: 5676 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)
        • remcos.exe (PID: 5536 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)
        • remcos.exe (PID: 5660 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)
  • remcos.exe (PID: 6032 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)
    • remcos.exe (PID: 5196 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)
  • remcos.exe (PID: 7264 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)
    • remcos.exe (PID: 7312 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)
  • remcos.exe (PID: 7360 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)
    • remcos.exe (PID: 7404 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)
    • remcos.exe (PID: 7412 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)
    • remcos.exe (PID: 7420 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: 3A9DA3EDC40736CC832EDED3C389A661)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["87.120.116.245:2400:1"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-24L73B", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000D.00000002.2352100171.0000000000A87000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
    00000011.00000002.2431550511.0000000000A07000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      00000000.00000002.2166318463.00000000074D0000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
        00000006.00000002.4608458310.00000000014D7000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
          00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
            Click to see the 31 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.Material Requirments.pif.exe.74d0000.5.raw.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
              0.2.Material Requirments.pif.exe.3f888d8.3.raw.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                3.2.Material Requirments.pif.exe.400000.0.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
                  3.2.Material Requirments.pif.exe.400000.0.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
                    3.2.Material Requirments.pif.exe.400000.0.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
                      Click to see the 40 entries

                      Sigma Signatures

                      System Summary

                      barindex
                      Sigma detected: CurrentVersion Autorun Keys Modification
                      Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Remcos\remcos.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Material Requirments.pif.exe, ProcessId: 7016, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-24L73B
                      Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
                      Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Remcos\remcos.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Material Requirments.pif.exe, ProcessId: 7016, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-24L73B

                      Stealing of Sensitive Information

                      barindex
                      Sigma detected: Remcos
                      Source: Registry Key setAuthor: Joe Security: Data: Details: 66 57 27 95 79 E4 43 60 A3 C1 CC 09 A2 F2 B0 DC C9 0C 47 50 1A D8 96 5A E5 39 C8 E5 77 FA BB 03 2E 29 40 1B B4 6E C5 35 05 56 FF 36 06 0F 9B D4 CE 11 07 FB BA C6 2D C8 B6 8A 17 DB 53 B8 CE 8E EE 46 , EventID: 13, EventType: SetValue, Image: C:\ProgramData\Remcos\remcos.exe, ProcessId: 5660, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Rmc-24L73B\exepath

                      Suricata Signatures

                      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                      2025-01-09T16:33:01.774219+010020365941Malware Command and Control Activity Detected192.168.2.64971587.120.116.2452400TCP
                      2025-01-09T16:33:05.492950+010020365941Malware Command and Control Activity Detected192.168.2.64973087.120.116.2452400TCP
                      2025-01-09T16:33:05.680455+010020365941Malware Command and Control Activity Detected192.168.2.64973187.120.116.2452400TCP
                      2025-01-09T16:33:11.196071+010020365941Malware Command and Control Activity Detected192.168.2.64976487.120.116.2452400TCP
                      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                      2025-01-09T16:33:03.736828+010028033043Unknown Traffic192.168.2.649718178.237.33.5080TCP

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Found malware configuration
                      Source: 0000000D.00000002.2352100171.0000000000A87000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": ["87.120.116.245:2400:1"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-24L73B", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}
                      Multi AV Scanner detection for dropped file
                      Source: C:\ProgramData\Remcos\remcos.exeReversingLabs: Detection: 58%
                      Multi AV Scanner detection for submitted file
                      Source: Material Requirments.pif.exeReversingLabs: Detection: 58%
                      Yara detected Remcos RAT
                      Source: Yara matchFile source: 3.2.Material Requirments.pif.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.4ac9838.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.Material Requirments.pif.exe.400000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.40875f8.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.4ac9838.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.40875f8.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.3fa88f8.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0000000D.00000002.2352100171.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000011.00000002.2431550511.0000000000A07000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.4608458310.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.2161658344.000000000134A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000A.00000002.2270181874.000000000148A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2162615893.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Material Requirments.pif.exe PID: 1492, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: Material Requirments.pif.exe PID: 7016, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 5660, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 5196, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 7312, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 7420, type: MEMORYSTR
                      AI detected suspicious sample
                      Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                      Machine Learning detection for dropped file
                      Source: C:\ProgramData\Remcos\remcos.exeJoe Sandbox ML: detected
                      Machine Learning detection for sample
                      Source: Material Requirments.pif.exeJoe Sandbox ML: detected
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00432B45 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,3_2_00432B45
                      Source: Material Requirments.pif.exe, 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_6cf11cdf-f

                      Exploits

                      barindex
                      Yara detected UAC Bypass using CMSTP
                      Source: Yara matchFile source: 3.2.Material Requirments.pif.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.4ac9838.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.Material Requirments.pif.exe.400000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.40875f8.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.4ac9838.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.40875f8.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.3fa88f8.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2162615893.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Material Requirments.pif.exe PID: 1492, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: Material Requirments.pif.exe PID: 7016, type: MEMORYSTR

                      Privilege Escalation

                      barindex
                      Contains functionality to bypass UAC (CMSTPLUA)
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00406764 _wcslen,CoGetObject,3_2_00406764
                      Source: Material Requirments.pif.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                      Source: Material Requirments.pif.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,3_2_0040B335
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,3_2_0040B53A
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0041B63A FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,3_2_0041B63A
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0044D7F9 FindFirstFileExA,3_2_0044D7F9
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,3_2_004089A9
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00406AC2 FindFirstFileW,FindNextFileW,3_2_00406AC2
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,3_2_00407A8C
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,3_2_00408DA7
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00418E5F FindFirstFileW,FindNextFileW,FindNextFileW,3_2_00418E5F
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,3_2_00406F06
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 4x nop then jmp 07371A4Ch0_2_07371EAC
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 4x nop then jmp 07371A4Ch0_2_0737222D
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4x nop then jmp 06A51A4Ch4_2_06A51EAC
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4x nop then jmp 06A51A4Ch4_2_06A5222D
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4x nop then jmp 073E1A4Ch9_2_073E1EAC
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4x nop then jmp 073E1A4Ch9_2_073E222D
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4x nop then jmp 06AA1A4Ch12_2_06AA1EAC
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4x nop then jmp 06AA1A4Ch12_2_06AA222D
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4x nop then jmp 06BA1A4Ch14_2_06BA1EAC
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4x nop then jmp 06BA1A4Ch14_2_06BA222D

                      Networking

                      barindex
                      Suricata IDS alerts for network traffic
                      Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49715 -> 87.120.116.245:2400
                      Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49731 -> 87.120.116.245:2400
                      Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49764 -> 87.120.116.245:2400
                      Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49730 -> 87.120.116.245:2400
                      C2 URLs / IPs found in malware configuration
                      Source: Malware configuration extractorIPs: 87.120.116.245
                      Source: global trafficTCP traffic: 192.168.2.6:49715 -> 87.120.116.245:2400
                      Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                      Source: Joe Sandbox ViewIP Address: 178.237.33.50 178.237.33.50
                      Source: Joe Sandbox ViewASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG
                      Source: Network trafficSuricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49718 -> 178.237.33.50:80
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: unknownTCP traffic detected without corresponding DNS query: 87.120.116.245
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00406128 ShellExecuteW,URLDownloadToFileW,3_2_00406128
                      Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                      Source: global trafficDNS traffic detected: DNS query: geoplugin.net
                      Source: remcos.exe, 00000006.00000002.4608458310.0000000001510000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp
                      Source: Material Requirments.pif.exe, 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, Material Requirments.pif.exe, 00000000.00000002.2162615893.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp, Material Requirments.pif.exe, 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C

                      Key, Mouse, Clipboard, Microphone and Screen Capturing

                      barindex
                      Contains functionality to register a low level keyboard hook
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_004099E4 SetWindowsHookExA 0000000D,004099D0,000000003_2_004099E4
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,3_2_00415B5E
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,3_2_00415B5E
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,3_2_00415B5E
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00409B10 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,3_2_00409B10
                      Source: Yara matchFile source: 3.2.Material Requirments.pif.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.4ac9838.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.Material Requirments.pif.exe.400000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.40875f8.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.4ac9838.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.40875f8.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.3fa88f8.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2162615893.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Material Requirments.pif.exe PID: 1492, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: Material Requirments.pif.exe PID: 7016, type: MEMORYSTR

                      E-Banking Fraud

                      barindex
                      Yara detected Remcos RAT
                      Source: Yara matchFile source: 3.2.Material Requirments.pif.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.4ac9838.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.Material Requirments.pif.exe.400000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.40875f8.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.4ac9838.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.40875f8.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.3fa88f8.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0000000D.00000002.2352100171.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000011.00000002.2431550511.0000000000A07000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.4608458310.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.2161658344.000000000134A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000A.00000002.2270181874.000000000148A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2162615893.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Material Requirments.pif.exe PID: 1492, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: Material Requirments.pif.exe PID: 7016, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 5660, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 5196, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 7312, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 7420, type: MEMORYSTR

                      Spam, unwanted Advertisements and Ransom Demands

                      barindex
                      Contains functionalty to change the wallpaper
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0041BD82 SystemParametersInfoW,3_2_0041BD82

                      System Summary

                      barindex
                      Malicious sample detected (through community Yara rule)
                      Source: 3.2.Material Requirments.pif.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 3.2.Material Requirments.pif.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                      Source: 3.2.Material Requirments.pif.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 0.2.Material Requirments.pif.exe.4ac9838.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 0.2.Material Requirments.pif.exe.4ac9838.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                      Source: 0.2.Material Requirments.pif.exe.4ac9838.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 3.2.Material Requirments.pif.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 3.2.Material Requirments.pif.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                      Source: 3.2.Material Requirments.pif.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 0.2.Material Requirments.pif.exe.40875f8.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 0.2.Material Requirments.pif.exe.40875f8.2.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                      Source: 0.2.Material Requirments.pif.exe.40875f8.2.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 0.2.Material Requirments.pif.exe.4ac9838.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 0.2.Material Requirments.pif.exe.4ac9838.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 0.2.Material Requirments.pif.exe.40875f8.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 0.2.Material Requirments.pif.exe.40875f8.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 0.2.Material Requirments.pif.exe.3fa88f8.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 0.2.Material Requirments.pif.exe.3fa88f8.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                      Source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                      Source: 00000000.00000002.2162615893.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: Process Memory Space: Material Requirments.pif.exe PID: 1492, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: Process Memory Space: Material Requirments.pif.exe PID: 7016, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00415A51 ExitWindowsEx,LoadLibraryA,GetProcAddress,3_2_00415A51
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_07315E600_2_07315E60
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_07312D700_2_07312D70
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_0731D7A80_2_0731D7A8
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_0731D7930_2_0731D793
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_0731F6F00_2_0731F6F0
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_0731F6E00_2_0731F6E0
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_0731F2B80_2_0731F2B8
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_0731F2A70_2_0731F2A7
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_073152A80_2_073152A8
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_0731E0180_2_0731E018
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_0731A0600_2_0731A060
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_07315E500_2_07315E50
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_07312D630_2_07312D63
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_0731DBE00_2_0731DBE0
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_07312A780_2_07312A78
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_07312A880_2_07312A88
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_07373F300_2_07373F30
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0043D04B3_2_0043D04B
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0042707E3_2_0042707E
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0041301D3_2_0041301D
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_004410303_2_00441030
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_004531103_2_00453110
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_004271B83_2_004271B8
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0041D27C3_2_0041D27C
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_004522E23_2_004522E2
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0043D2A83_2_0043D2A8
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_004373603_2_00437360
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_004363BA3_2_004363BA
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0042645F3_2_0042645F
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_004315823_2_00431582
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0041E7EA3_2_0041E7EA
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0044C9493_2_0044C949
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_004269D63_2_004269D6
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0043CBED3_2_0043CBED
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00432C543_2_00432C54
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0043CE1C3_2_0043CE1C
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00434F323_2_00434F32
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4_2_06975E604_2_06975E60
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4_2_06972D704_2_06972D70
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4_2_0697F6F04_2_0697F6F0
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4_2_0697F6E04_2_0697F6E0
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4_2_0697D7924_2_0697D792
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4_2_0697D7A84_2_0697D7A8
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4_2_0697F2B84_2_0697F2B8
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4_2_0697F2A74_2_0697F2A7
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4_2_069752A84_2_069752A8
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4_2_0697E0184_2_0697E018
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4_2_06975E504_2_06975E50
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4_2_06972D614_2_06972D61
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4_2_06972A884_2_06972A88
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4_2_06972A784_2_06972A78
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4_2_0697DBE04_2_0697DBE0
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 4_2_06A540E84_2_06A540E8
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_07085E609_2_07085E60
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_07082D709_2_07082D70
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_0708D7939_2_0708D793
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_0708D7A89_2_0708D7A8
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_0708F6E09_2_0708F6E0
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_0708F6F09_2_0708F6F0
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_070852A89_2_070852A8
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_0708F2A79_2_0708F2A7
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_0708F2B89_2_0708F2B8
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_0708E0189_2_0708E018
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_07085E509_2_07085E50
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_07082D629_2_07082D62
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_0708DBE09_2_0708DBE0
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_07082A789_2_07082A78
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_07082A889_2_07082A88
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_073E3F309_2_073E3F30
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 12_2_057B2D7012_2_057B2D70
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 12_2_057B5E6012_2_057B5E60
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 12_2_057BD7A812_2_057BD7A8
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 12_2_057BF6F012_2_057BF6F0
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 12_2_057BF6E012_2_057BF6E0
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 12_2_057BE01812_2_057BE018
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 12_2_057BF2B812_2_057BF2B8
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 12_2_057B52A812_2_057B52A8
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 12_2_057BF2A712_2_057BF2A7
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 12_2_057B2D6212_2_057B2D62
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 12_2_057B5E5012_2_057B5E50
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 12_2_057BDBE012_2_057BDBE0
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 12_2_057B2A7812_2_057B2A78
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 12_2_057B2A8812_2_057B2A88
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 12_2_06AA3F3012_2_06AA3F30
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 14_2_06AC5E6014_2_06AC5E60
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 14_2_06AC2D7014_2_06AC2D70
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 14_2_06ACF6E014_2_06ACF6E0
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 14_2_06ACF6F014_2_06ACF6F0
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 14_2_06ACD7A814_2_06ACD7A8
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 14_2_06AC52A814_2_06AC52A8
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 14_2_06ACF2B814_2_06ACF2B8
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 14_2_06ACE01814_2_06ACE018
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 14_2_06AC5E5014_2_06AC5E50
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 14_2_06AC2D6314_2_06AC2D63
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 14_2_06AC2A8814_2_06AC2A88
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 14_2_06AC2A7814_2_06AC2A78
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 14_2_06ACDBE014_2_06ACDBE0
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 14_2_06BA40E814_2_06BA40E8
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: String function: 00401F66 appears 50 times
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: String function: 004020E7 appears 39 times
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: String function: 00433AB0 appears 41 times
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: String function: 004341C0 appears 55 times
                      Source: Material Requirments.pif.exe, 00000000.00000002.2151553852.000000000121E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs Material Requirments.pif.exe
                      Source: Material Requirments.pif.exe, 00000000.00000002.2166318463.00000000074D0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCaptive.dll" vs Material Requirments.pif.exe
                      Source: Material Requirments.pif.exe, 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCaptive.dll" vs Material Requirments.pif.exe
                      Source: Material Requirments.pif.exe, 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs Material Requirments.pif.exe
                      Source: Material Requirments.pif.exe, 00000000.00000000.2137937496.0000000000CA6000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamebEab.exe@ vs Material Requirments.pif.exe
                      Source: Material Requirments.pif.exe, 00000000.00000002.2162615893.0000000003F69000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCaptive.dll" vs Material Requirments.pif.exe
                      Source: Material Requirments.pif.exe, 00000000.00000002.2166721781.0000000007DD0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs Material Requirments.pif.exe
                      Source: Material Requirments.pif.exe, 00000003.00000002.2161658344.0000000001377000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamebEab.exe@ vs Material Requirments.pif.exe
                      Source: Material Requirments.pif.exeBinary or memory string: OriginalFilenamebEab.exe@ vs Material Requirments.pif.exe
                      Source: Material Requirments.pif.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                      Source: 3.2.Material Requirments.pif.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 3.2.Material Requirments.pif.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 3.2.Material Requirments.pif.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 0.2.Material Requirments.pif.exe.4ac9838.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 0.2.Material Requirments.pif.exe.4ac9838.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 0.2.Material Requirments.pif.exe.4ac9838.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 3.2.Material Requirments.pif.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 3.2.Material Requirments.pif.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 3.2.Material Requirments.pif.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 0.2.Material Requirments.pif.exe.40875f8.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 0.2.Material Requirments.pif.exe.40875f8.2.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 0.2.Material Requirments.pif.exe.40875f8.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 0.2.Material Requirments.pif.exe.4ac9838.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 0.2.Material Requirments.pif.exe.4ac9838.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 0.2.Material Requirments.pif.exe.40875f8.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 0.2.Material Requirments.pif.exe.40875f8.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 0.2.Material Requirments.pif.exe.3fa88f8.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 0.2.Material Requirments.pif.exe.3fa88f8.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                      Source: 00000000.00000002.2162615893.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: Process Memory Space: Material Requirments.pif.exe PID: 1492, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: Process Memory Space: Material Requirments.pif.exe PID: 7016, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                      Source: Material Requirments.pif.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      Source: remcos.exe.3.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      Source: classification engineClassification label: mal100.rans.troj.spyw.expl.evad.winEXE@22/5@1/2
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00416C9D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,3_2_00416C9D
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0040E2F1 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,3_2_0040E2F1
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0041A84A FindResourceA,LoadResource,LockResource,SizeofResource,3_2_0041A84A
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00419DBA OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,3_2_00419DBA
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Material Requirments.pif.exe.logJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMutant created: NULL
                      Source: C:\ProgramData\Remcos\remcos.exeMutant created: \Sessions\1\BaseNamedObjects\Rmc-24L73B
                      Source: Material Requirments.pif.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      Source: Material Requirments.pif.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: Material Requirments.pif.exeReversingLabs: Detection: 58%
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeFile read: C:\Users\user\Desktop\Material Requirments.pif.exeJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\Material Requirments.pif.exe "C:\Users\user\Desktop\Material Requirments.pif.exe"
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess created: C:\Users\user\Desktop\Material Requirments.pif.exe "C:\Users\user\Desktop\Material Requirments.pif.exe"
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
                      Source: unknownProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
                      Source: unknownProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
                      Source: unknownProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess created: C:\Users\user\Desktop\Material Requirments.pif.exe "C:\Users\user\Desktop\Material Requirments.pif.exe"Jump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe" Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"Jump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: apphelp.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: version.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: dwrite.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: windowscodecs.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: iconcodecservice.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: winmm.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: ntmarta.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: propsys.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: edputil.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: wintypes.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: appresolver.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: bcp47langs.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: slc.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: sppc.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeSection loaded: apphelp.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: apphelp.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: version.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: dwrite.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: windowscodecs.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: iconcodecservice.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: winmm.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: mswsock.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: winhttp.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: winnsi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: dnsapi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: rasadhlp.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: fwpuclnt.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: windowscodecs.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: version.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: dwrite.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: windowscodecs.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: iconcodecservice.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: winmm.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: version.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: dwrite.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: windowscodecs.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: iconcodecservice.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: winmm.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: version.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: dwrite.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: windowscodecs.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: gpapi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: iconcodecservice.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: winmm.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                      Source: Window RecorderWindow detected: More than 3 window changes detected
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: Material Requirments.pif.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: Material Requirments.pif.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0041BEEE LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,3_2_0041BEEE
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 0_2_073163A9 push 7407305Eh; ret 0_2_073163B5
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_004560BF push ecx; ret 3_2_004560D2
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00434206 push ecx; ret 3_2_00434219
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0045E669 push ecx; ret 3_2_0045E67B
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0045C9DD push esi; ret 3_2_0045C9E6
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_004569F0 push eax; ret 3_2_00456A0E
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 9_2_070863A9 push 7407075Eh; ret 9_2_070863B5
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 12_2_057B63A9 push 74050B5Eh; ret 12_2_057B63B5
                      Source: C:\ProgramData\Remcos\remcos.exeCode function: 14_2_06AC63A9 push 7406AB5Eh; ret 14_2_06AC63B5
                      Source: Material Requirments.pif.exeStatic PE information: section name: .text entropy: 7.831221418025935
                      Source: remcos.exe.3.drStatic PE information: section name: .text entropy: 7.831221418025935
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00406128 ShellExecuteW,URLDownloadToFileW,3_2_00406128
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeFile created: C:\ProgramData\Remcos\remcos.exeJump to dropped file
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeFile created: C:\ProgramData\Remcos\remcos.exeJump to dropped file

                      Boot Survival

                      barindex
                      Creates autostart registry keys with suspicious names
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-24L73BJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00419DBA OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,3_2_00419DBA
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-24L73BJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-24L73BJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Rmc-24L73BJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Rmc-24L73BJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0041BEEE LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,3_2_0041BEEE
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion

                      barindex
                      Yara detected AntiVM3
                      Source: Yara matchFile source: Process Memory Space: Material Requirments.pif.exe PID: 1492, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 5676, type: MEMORYSTR
                      Delayed program exit found
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0040E627 Sleep,ExitProcess,3_2_0040E627
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeMemory allocated: 1610000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeMemory allocated: 2F60000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeMemory allocated: 4F60000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeMemory allocated: 7F90000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeMemory allocated: 8F90000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeMemory allocated: 9150000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeMemory allocated: A150000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 9E0000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 2390000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 4390000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 7050000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 8050000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 8200000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 9200000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 1200000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 2D10000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 4D10000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 7800000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 8800000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 89A0000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 99A0000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 2580000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 2620000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 4620000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 7200000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 8200000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 83A0000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 93A0000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: B10000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 2580000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 23A0000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 7000000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 8000000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 81A0000 memory reserve | memory write watchJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory allocated: 91A0000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,3_2_00419AB8
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeWindow / User API: threadDelayed 5802Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeWindow / User API: threadDelayed 4170Jump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeEvaded block: after key decisiongraph_3-48652
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeEvaded block: after key decisiongraph_3-48626
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeAPI coverage: 5.5 %
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exe TID: 4876Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exe TID: 3108Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exe TID: 5692Thread sleep time: -17406000s >= -30000sJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exe TID: 5692Thread sleep time: -12510000s >= -30000sJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exe TID: 3004Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exe TID: 7288Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exe TID: 7380Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,3_2_0040B335
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,3_2_0040B53A
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0041B63A FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,3_2_0041B63A
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0044D7F9 FindFirstFileExA,3_2_0044D7F9
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,3_2_004089A9
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00406AC2 FindFirstFileW,FindNextFileW,3_2_00406AC2
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,3_2_00407A8C
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,3_2_00408DA7
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00418E5F FindFirstFileW,FindNextFileW,FindNextFileW,3_2_00418E5F
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,3_2_00406F06
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: remcos.exe, 00000006.00000002.4608458310.00000000014D7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW(/U
                      Source: Material Requirments.pif.exe, 00000003.00000002.2161658344.0000000001360000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                      Source: remcos.exe, 00000006.00000002.4608458310.000000000154D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                      Source: remcos.exe, 00000006.00000002.4608458310.000000000154D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWC
                      Source: C:\ProgramData\Remcos\remcos.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0043A86D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_0043A86D
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0041BEEE LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,3_2_0041BEEE
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00442764 mov eax, dword ptr fs:[00000030h]3_2_00442764
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0044EB3E GetProcessHeap,3_2_0044EB3E
                      Source: C:\ProgramData\Remcos\remcos.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00434378 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00434378
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0043A86D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_0043A86D
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00433D4F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00433D4F
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00433EE2 SetUnhandledExceptionFilter,3_2_00433EE2
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeMemory allocated: page read and write | page guardJump to behavior

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      Injects a PE file into a foreign processes
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeMemory written: C:\Users\user\Desktop\Material Requirments.pif.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory written: C:\ProgramData\Remcos\remcos.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory written: C:\ProgramData\Remcos\remcos.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory written: C:\ProgramData\Remcos\remcos.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMemory written: C:\ProgramData\Remcos\remcos.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe3_2_0041100E
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0041894A mouse_event,3_2_0041894A
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess created: C:\Users\user\Desktop\Material Requirments.pif.exe "C:\Users\user\Desktop\Material Requirments.pif.exe"Jump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe" Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"Jump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeProcess created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"Jump to behavior
                      Source: remcos.exe, 00000006.00000002.4608458310.0000000001510000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'Program Managerf*
                      Source: remcos.exe, 00000006.00000002.4608458310.0000000001510000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
                      Source: remcos.exe, 00000006.00000002.4608458310.0000000001510000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HProgram Manager
                      Source: remcos.exe, 00000006.00000002.4608458310.0000000001510000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager65
                      Source: remcos.exe, 00000006.00000002.4608458310.0000000001510000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00434015 cpuid 3_2_00434015
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,3_2_0045107A
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: GetLocaleInfoW,3_2_004512CA
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: EnumSystemLocalesW,3_2_004472BE
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,3_2_004513F3
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: GetLocaleInfoW,3_2_004514FA
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,3_2_004515C7
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: GetLocaleInfoA,3_2_0040E751
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: GetLocaleInfoW,3_2_004477A7
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,3_2_00450C8F
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: EnumSystemLocalesW,3_2_00450F52
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: EnumSystemLocalesW,3_2_00450F07
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: EnumSystemLocalesW,3_2_00450FED
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeQueries volume information: C:\Users\user\Desktop\Material Requirments.pif.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\ProgramData\Remcos\remcos.exe VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\ProgramData\Remcos\remcos.exe VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\ProgramData\Remcos\remcos.exe VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\ProgramData\Remcos\remcos.exe VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_00434220 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,3_2_00434220
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0041A9AD GetUserNameW,3_2_0041A9AD
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: 3_2_0044804A _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,3_2_0044804A
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                      Stealing of Sensitive Information

                      barindex
                      Yara detected PureLog Stealer
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.74d0000.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.3f888d8.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.74d0000.5.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.3f888d8.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.3fa88f8.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.3fa88f8.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000000.00000002.2166318463.00000000074D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2162615893.0000000003F69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Yara detected Remcos RAT
                      Source: Yara matchFile source: 3.2.Material Requirments.pif.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.4ac9838.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.Material Requirments.pif.exe.400000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.40875f8.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.4ac9838.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.40875f8.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.3fa88f8.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0000000D.00000002.2352100171.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000011.00000002.2431550511.0000000000A07000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.4608458310.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.2161658344.000000000134A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000A.00000002.2270181874.000000000148A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2162615893.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Material Requirments.pif.exe PID: 1492, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: Material Requirments.pif.exe PID: 7016, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 5660, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 5196, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 7312, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 7420, type: MEMORYSTR
                      Contains functionality to steal Chrome passwords or cookies
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data3_2_0040B21B
                      Contains functionality to steal Firefox passwords or cookies
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\3_2_0040B335
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: \key3.db3_2_0040B335

                      Remote Access Functionality

                      barindex
                      Detected Remcos RAT
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-24L73BJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-24L73BJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-24L73BJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-24L73BJump to behavior
                      Source: C:\ProgramData\Remcos\remcos.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-24L73BJump to behavior
                      Yara detected PureLog Stealer
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.74d0000.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.3f888d8.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.74d0000.5.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.3f888d8.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.3fa88f8.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.3fa88f8.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000000.00000002.2166318463.00000000074D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2162615893.0000000003F69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Yara detected Remcos RAT
                      Source: Yara matchFile source: 3.2.Material Requirments.pif.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.4ac9838.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.Material Requirments.pif.exe.400000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.40875f8.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.4ac9838.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.40875f8.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Material Requirments.pif.exe.3fa88f8.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0000000D.00000002.2352100171.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000011.00000002.2431550511.0000000000A07000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.4608458310.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.2161658344.000000000134A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000A.00000002.2270181874.000000000148A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2162615893.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Material Requirments.pif.exe PID: 1492, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: Material Requirments.pif.exe PID: 7016, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 5660, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 5196, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 7312, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: remcos.exe PID: 7420, type: MEMORYSTR
                      Source: C:\Users\user\Desktop\Material Requirments.pif.exeCode function: cmd.exe3_2_00405042

                      Mitre Att&ck Matrix

                      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                      Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
                      Native API                      		1
                      DLL Side-Loading                      		1
                      DLL Side-Loading                      		1
                      Disable or Modify Tools                      		1
                      OS Credential Dumping                      		2
                      System Time Discovery                      		Remote Services11
                      Archive Collected Data                      		12
                      Ingress Tool Transfer                      		Exfiltration Over Other Network Medium1
                      System Shutdown/Reboot
                      CredentialsDomainsDefault Accounts1
                      Command and Scripting Interpreter                      		1
                      Windows Service                      		1
                      Bypass User Account Control                      		1
                      Deobfuscate/Decode Files or Information                      		111
                      Input Capture                      		1
                      Account Discovery                      		Remote Desktop Protocol111
                      Input Capture                      		2
                      Encrypted Channel                      		Exfiltration Over Bluetooth1
                      Defacement
                      Email AddressesDNS ServerDomain Accounts2
                      Service Execution                      		11
                      Registry Run Keys / Startup Folder                      		1
                      Access Token Manipulation                      		4
                      Obfuscated Files or Information                      		2
                      Credentials In Files                      		1
                      System Service Discovery                      		SMB/Windows Admin Shares3
                      Clipboard Data                      		1
                      Non-Standard Port                      		Automated ExfiltrationData Encrypted for Impact
                      Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
                      Windows Service                      		2
                      Software Packing                      		NTDS3
                      File and Directory Discovery                      		Distributed Component Object ModelInput Capture1
                      Remote Access Software                      		Traffic DuplicationData Destruction
                      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script122
                      Process Injection                      		1
                      DLL Side-Loading                      		LSA Secrets33
                      System Information Discovery                      		SSHKeylogging2
                      Non-Application Layer Protocol                      		Scheduled TransferData Encrypted for Impact
                      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts11
                      Registry Run Keys / Startup Folder                      		1
                      Bypass User Account Control                      		Cached Domain Credentials121
                      Security Software Discovery                      		VNCGUI Input Capture12
                      Application Layer Protocol                      		Data Transfer Size LimitsService Stop
                      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                      Masquerading                      		DCSync31
                      Virtualization/Sandbox Evasion                      		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                      Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job31
                      Virtualization/Sandbox Evasion                      		Proc Filesystem3
                      Process Discovery                      		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                      Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                      Access Token Manipulation                      		/etc/passwd and /etc/shadow1
                      Application Window Discovery                      		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                      IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron122
                      Process Injection                      		Network Sniffing1
                      System Owner/User Discovery                      		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1586795 Sample: Material Requirments.pif.exe Startdate: 09/01/2025 Architecture: WINDOWS Score: 100 48 geoplugin.net 2->48 60 Suricata IDS alerts for network traffic 2->60 62 Found malware configuration 2->62 64 Malicious sample detected (through community Yara rule) 2->64 66 15 other signatures 2->66 9 Material Requirments.pif.exe 3 2->9         started        13 remcos.exe 2 2->13         started        15 remcos.exe 2 2->15         started        17 remcos.exe 2 2->17         started        signatures3 process4 file5 46 C:\Users\...\Material Requirments.pif.exe.log, ASCII 9->46 dropped 74 Injects a PE file into a foreign processes 9->74 19 Material Requirments.pif.exe 2 4 9->19         started        23 remcos.exe 13->23         started        25 remcos.exe 13->25         started        27 remcos.exe 13->27         started        29 remcos.exe 15->29         started        31 remcos.exe 17->31         started        signatures6 process7 file8 42 C:\ProgramData\Remcos\remcos.exe, PE32 19->42 dropped 44 C:\ProgramData\...\remcos.exe:Zone.Identifier, ASCII 19->44 dropped 68 Detected Remcos RAT 19->68 70 Creates autostart registry keys with suspicious names 19->70 33 remcos.exe 3 19->33         started        signatures9 process10 signatures11 54 Multi AV Scanner detection for dropped file 33->54 56 Machine Learning detection for dropped file 33->56 58 Injects a PE file into a foreign processes 33->58 36 remcos.exe 4 14 33->36         started        40 remcos.exe 33->40         started        process12 dnsIp13 50 87.120.116.245, 2400, 49715, 49730 UNACS-AS-BG8000BurgasBG Bulgaria 36->50 52 geoplugin.net 178.237.33.50, 49718, 80 ATOM86-ASATOM86NL Netherlands 36->52 72 Detected Remcos RAT 36->72 signatures14

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      Material Requirments.pif.exe58%ReversingLabsWin32.Backdoor.Remcos
                      Material Requirments.pif.exe100%Joe Sandbox ML

                      Dropped Files

                      SourceDetectionScannerLabelLink
                      C:\ProgramData\Remcos\remcos.exe100%Joe Sandbox ML
                      C:\ProgramData\Remcos\remcos.exe58%ReversingLabsWin32.Backdoor.Remcos

                      Unpacked PE Files

                      ⊘No Antivirus matches

                      Domains

                      ⊘No Antivirus matches

                      URLs

                      ⊘No Antivirus matches

                      Domains and IPs

                      Contacted Domains

                      NameIPActiveMaliciousAntivirus DetectionReputation
                      geoplugin.net
                      		178.237.33.50
                      		truefalse
                        		high

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        http://geoplugin.net/json.gpfalse
                          		high

                          URLs from Memory and Binaries

                          NameSourceMaliciousAntivirus DetectionReputation
                          http://geoplugin.net/json.gp/CMaterial Requirments.pif.exe, 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, Material Requirments.pif.exe, 00000000.00000002.2162615893.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp, Material Requirments.pif.exe, 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                            		high

                            World Map of Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public IPs

                            IPDomainCountryFlagASNASN NameMalicious
                            87.120.116.245
                            		unknownBulgaria
                            		25206UNACS-AS-BG8000BurgasBGtrue
                            178.237.33.50
                            		geoplugin.netNetherlands
                            		8455ATOM86-ASATOM86NLfalse

                            General Information

                            Joe Sandbox version:42.0.0 Malachite
                            Analysis ID:1586795
                            Start date and time:2025-01-09 16:32:04 +01:00
                            Joe Sandbox product:CloudBasic
                            Overall analysis duration:0h 9m 33s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                            Number of analysed new started processes analysed:19
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Sample name:Material Requirments.pif.exe
                            Detection:MAL
                            Classification:mal100.rans.troj.spyw.expl.evad.winEXE@22/5@1/2
                            EGA Information:
                            • Successful, ratio: 100%
                            HCA Information:
                            • Successful, ratio: 97%
                            • Number of executed functions: 156
                            • Number of non-executed functions: 198
                            Cookbook Comments:
                            • Found application associated with file extension: .exe
                            • Override analysis time to 240000 for current running targets taking high CPU consumption

                            Warnings

                            • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
                            • Excluded IPs from analysis (whitelisted): 13.107.246.45, 23.56.254.164, 4.245.163.56, 172.202.163.200
                            • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                            • Report size exceeded maximum capacity and may have missing behavior information.
                            • Report size getting too big, too many NtOpenKeyEx calls found.
                            • Report size getting too big, too many NtQueryValueKey calls found.
                            • VT rate limit hit for: Material Requirments.pif.exe

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            10:32:57API Interceptor1x Sleep call for process: Material Requirments.pif.exe modified
                            10:32:59API Interceptor4674433x Sleep call for process: remcos.exe modified
                            16:33:00AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Rmc-24L73B "C:\ProgramData\Remcos\remcos.exe"
                            16:33:08AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Rmc-24L73B "C:\ProgramData\Remcos\remcos.exe"
                            16:33:16AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Rmc-24L73B "C:\ProgramData\Remcos\remcos.exe"

                            Joe Sandbox View / Context

                            IPs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            87.120.116.245Material requirements_1.pif.exeGet hashmaliciousRemcosBrowse
                              178.237.33.50preliminary drawing.pif.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                              • geoplugin.net/json.gp
                              DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exeGet hashmaliciousRemcosBrowse
                              • geoplugin.net/json.gp
                              z58Swiftcopy_MT.bat.exeGet hashmaliciousRemcos, GuLoaderBrowse
                              • geoplugin.net/json.gp
                              173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • geoplugin.net/json.gp
                              1736348224ad77cf86e491faad27e4b5decf1eb0bb26f16b0527e5ef488389ba353aa3db79582.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • geoplugin.net/json.gp
                              17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • geoplugin.net/json.gp
                              1736348224f7603a5c535b2b2f6cc29730626d73a967c67551d2d14f73b547fe7b5fc10393994.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • geoplugin.net/json.gp
                              1736348224bd83df4c8d79407f8e7ac5cf8c08b59746ce37ff95772daa0a6283b50e2b0882115.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • geoplugin.net/json.gp
                              17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • geoplugin.net/json.gp
                              DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exeGet hashmaliciousRemcos, GuLoaderBrowse
                              • geoplugin.net/json.gp

                              Domains

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              geoplugin.netpreliminary drawing.pif.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                              • 178.237.33.50
                              DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exeGet hashmaliciousRemcosBrowse
                              • 178.237.33.50
                              z58Swiftcopy_MT.bat.exeGet hashmaliciousRemcos, GuLoaderBrowse
                              • 178.237.33.50
                              173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • 178.237.33.50
                              1736348224ad77cf86e491faad27e4b5decf1eb0bb26f16b0527e5ef488389ba353aa3db79582.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • 178.237.33.50
                              17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • 178.237.33.50
                              1736348224f7603a5c535b2b2f6cc29730626d73a967c67551d2d14f73b547fe7b5fc10393994.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • 178.237.33.50
                              1736348224bd83df4c8d79407f8e7ac5cf8c08b59746ce37ff95772daa0a6283b50e2b0882115.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • 178.237.33.50
                              17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • 178.237.33.50
                              DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exeGet hashmaliciousRemcos, GuLoaderBrowse
                              • 178.237.33.50

                              ASNs

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              UNACS-AS-BG8000BurgasBGMaterial requirements_1.pif.exeGet hashmaliciousRemcosBrowse
                              • 87.120.116.245
                              17363482243fcf48f1d103ef5a4702c871424ad69b9eb7d3f5e5957f5c4810f2a51fea8e76776.dat-decoded.exeGet hashmaliciousXWormBrowse
                              • 87.120.116.179
                              17363364631bc7418009f735fbf6670730f0df5be418dd7fb7bf7e79b36349f3b17d812142896.dat-decoded.exeGet hashmaliciousXWormBrowse
                              • 87.120.116.179
                              Inquiry List.docGet hashmaliciousDarkVision RatBrowse
                              • 87.120.113.91
                              3lhrJ4X.exeGet hashmaliciousLiteHTTP BotBrowse
                              • 87.120.126.5
                              XClient.exeGet hashmaliciousXWormBrowse
                              • 87.120.125.47
                              file.exeGet hashmaliciousDcRat, JasonRATBrowse
                              • 87.120.113.91
                              009274965.lnkGet hashmaliciousDarkVision RatBrowse
                              • 87.120.113.91
                              hoEtvOOrYH.exeGet hashmaliciousSmokeLoaderBrowse
                              • 87.120.115.216
                              rebirth.arm4t.elfGet hashmaliciousGafgytBrowse
                              • 87.120.113.63
                              ATOM86-ASATOM86NLpreliminary drawing.pif.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                              • 178.237.33.50
                              DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exeGet hashmaliciousRemcosBrowse
                              • 178.237.33.50
                              z58Swiftcopy_MT.bat.exeGet hashmaliciousRemcos, GuLoaderBrowse
                              • 178.237.33.50
                              173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • 178.237.33.50
                              1736348224ad77cf86e491faad27e4b5decf1eb0bb26f16b0527e5ef488389ba353aa3db79582.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • 178.237.33.50
                              17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • 178.237.33.50
                              1736348224f7603a5c535b2b2f6cc29730626d73a967c67551d2d14f73b547fe7b5fc10393994.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • 178.237.33.50
                              1736348224bd83df4c8d79407f8e7ac5cf8c08b59746ce37ff95772daa0a6283b50e2b0882115.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • 178.237.33.50
                              17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exeGet hashmaliciousRemcosBrowse
                              • 178.237.33.50
                              DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exeGet hashmaliciousRemcos, GuLoaderBrowse
                              • 178.237.33.50

                              JA3 Fingerprints

                              ⊘No context

                              Dropped Files

                              ⊘No context

                              Created / dropped Files

                              C:\ProgramData\Remcos\remcos.exe

                              Download File
                              Process:C:\Users\user\Desktop\Material Requirments.pif.exe
                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                              Category:dropped
                              Size (bytes):1005568
                              Entropy (8bit):7.827484845541161
                              Encrypted:false
                              SSDEEP:24576:rbT8S0ck7b8crshYjBSbIBDESo13E/WFRHVJmSr39RrE:rf8S0cXcrsWtDfoFRVJvNRrE
                              MD5:3A9DA3EDC40736CC832EDED3C389A661
                              SHA1:F32F61FB4458696DAE4F15D82377163521E4F8B5
                              SHA-256:F2418CA6E602C9470A8B6E32172432726E50B00D6E7A0EE5BD70D0172017D6C3
                              SHA-512:A1E2EFE247E78CFB0AD62125C69C44200F6FC094085A570A0AD9A4FF3D0F2025EB9F0AACBE7CD7DCE46A18121C02D46FEC471A3353733A93EC49B6A81D243E95
                              Malicious:true
                              Antivirus:
                              • Antivirus: Joe Sandbox ML, Detection: 100%
                              • Antivirus: ReversingLabs, Detection: 58%
                              Reputation:low
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^&.g..............0..,...*.......K... ...`....@.. ....................................`.................................4K..O....`..|'........................................................................... ............... ..H............text....+... ...,.................. ..`.rsrc...|'...`...(..................@..@.reloc...............V..............@..B................hK......H........C...:......%...D~.................................................}......}.....(........}......o.....*..0............{........+..*..0............{........+..*..0..9.........(.........,.r...ps....z.{....o ...o!....o"...t.....+..*....0..9.........(.........,.r...ps....z.{....o#...o!....o"...t.....+..*....0..C.........($...u...........,...+(.o%...u.............,...+..o$...u.....+..*..0..+.........(......,.r+..ps....z..}.....(!....o&....*..0..8.........{.........,...+$.{

                              C:\ProgramData\Remcos\remcos.exe:Zone.Identifier

                              Download File
                              Process:C:\Users\user\Desktop\Material Requirments.pif.exe
                              File Type:ASCII text, with CRLF line terminators
                              Category:modified
                              Size (bytes):26
                              Entropy (8bit):3.95006375643621
                              Encrypted:false
                              SSDEEP:3:ggPYV:rPYV
                              MD5:187F488E27DB4AF347237FE461A079AD
                              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                              Malicious:true
                              Reputation:high, very likely benign file
                              Preview:[ZoneTransfer]....ZoneId=0

                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Material Requirments.pif.exe.log

                              Download File
                              Process:C:\Users\user\Desktop\Material Requirments.pif.exe
                              File Type:ASCII text, with CRLF line terminators
                              Category:dropped
                              Size (bytes):1216
                              Entropy (8bit):5.34331486778365
                              Encrypted:false
                              SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                              MD5:1330C80CAAC9A0FB172F202485E9B1E8
                              SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                              SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                              SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                              Malicious:true
                              Reputation:high, very likely benign file
                              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\remcos.exe.log

                              Download File
                              Process:C:\ProgramData\Remcos\remcos.exe
                              File Type:ASCII text, with CRLF line terminators
                              Category:dropped
                              Size (bytes):1216
                              Entropy (8bit):5.34331486778365
                              Encrypted:false
                              SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                              MD5:1330C80CAAC9A0FB172F202485E9B1E8
                              SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                              SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                              SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                              Malicious:false
                              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

                              Download File
                              Process:C:\ProgramData\Remcos\remcos.exe
                              File Type:JSON data
                              Category:dropped
                              Size (bytes):963
                              Entropy (8bit):5.019205124979377
                              Encrypted:false
                              SSDEEP:12:tkluWJmnd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlupdVauKyGX85jvXhNlT3/7AcV9Wro
                              MD5:B62617530A8532F9AECAA939B6AB93BB
                              SHA1:E4DE9E9838052597EB2A5B363654C737BA1E6A66
                              SHA-256:508F952EF83C41861ECD44FB821F7BB73535BFF89F54D54C3549127DCA004E70
                              SHA-512:A0B385593B721313130CF14182F3B6EE5FF29D2A36FED99139FA2EE838002DFEEC83285DEDEAE437A53D053FCC631AEAD001D3E804386211BBA2F174134EA70D
                              Malicious:false
                              Preview:{. "geoplugin_request":"8.46.123.189",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                              Static File Info

                              General

                              File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                              Entropy (8bit):7.827484845541161
                              TrID:
                              • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                              • Win32 Executable (generic) a (10002005/4) 49.78%
                              • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                              • Generic Win/DOS Executable (2004/3) 0.01%
                              • DOS Executable Generic (2002/1) 0.01%
                              File name:Material Requirments.pif.exe
                              File size:1'005'568 bytes
                              MD5:3a9da3edc40736cc832eded3c389a661
                              SHA1:f32f61fb4458696dae4f15d82377163521e4f8b5
                              SHA256:f2418ca6e602c9470a8b6e32172432726e50b00d6e7a0ee5bd70d0172017d6c3
                              SHA512:a1e2efe247e78cfb0ad62125c69c44200f6fc094085a570a0ad9a4ff3d0f2025eb9f0aacbe7cd7dce46a18121c02d46fec471a3353733a93ec49b6a81d243e95
                              SSDEEP:24576:rbT8S0ck7b8crshYjBSbIBDESo13E/WFRHVJmSr39RrE:rf8S0cXcrsWtDfoFRVJvNRrE
                              TLSH:252512592749ED06C8D20BB098B0E3F826705FD9EA51C3039AFDBEFB7C265967418394
                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^&.g..............0..,...*.......K... ...`....@.. ....................................`................................

                              File Icon

                              Icon Hash:33362c2d36335470

                              Static PE Info

                              General

                              Entrypoint:0x4f4b86
                              Entrypoint Section:.text
                              Digitally signed:false
                              Imagebase:0x400000
                              Subsystem:windows gui
                              Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                              DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                              Time Stamp:0x677F265E [Thu Jan 9 01:29:02 2025 UTC]
                              TLS Callbacks:
                              CLR (.Net) Version:
                              OS Version Major:4
                              OS Version Minor:0
                              File Version Major:4
                              File Version Minor:0
                              Subsystem Version Major:4
                              Subsystem Version Minor:0
                              Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                              Entrypoint Preview

                              Instruction
                              jmp dword ptr [00402000h]
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al

                              Data Directories

                              NameVirtual AddressVirtual Size Is in Section
                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                              IMAGE_DIRECTORY_ENTRY_IMPORT0xf4b340x4f.text
                              IMAGE_DIRECTORY_ENTRY_RESOURCE0xf60000x277c.rsrc
                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                              IMAGE_DIRECTORY_ENTRY_BASERELOC0xfa0000xc.reloc
                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                              IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                              Sections

                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                              .text0x20000xf2b8c0xf2c000a8b8c4bd722d339244aaee111723f05False0.935753049369207data7.831221418025935IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                              .rsrc0xf60000x277c0x28004e9b0506103b0eab1b88df4722769ed0False0.87890625data7.595806949277348IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                              .reloc0xfa0000xc0x200f7cd7afbc98af4aee0e8ddfc076da2a5False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                              Resources

                              NameRVASizeTypeLanguageCountryZLIB Complexity
                              RT_ICON0xf60c80x2356PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9427371213796153
                              RT_GROUP_ICON0xf84300x14data1.05
                              RT_VERSION0xf84540x324data0.43283582089552236

                              Imports

                              DLLImport
                              mscoree.dll_CorExeMain

                              Network Behavior

                              Suricata IDS Alerts

                              TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                              2025-01-09T16:33:01.774219+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.64971587.120.116.2452400TCP
                              2025-01-09T16:33:03.736828+01002803304ETPRO MALWARE Common Downloader Header Pattern HCa3192.168.2.649718178.237.33.5080TCP
                              2025-01-09T16:33:05.492950+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.64973087.120.116.2452400TCP
                              2025-01-09T16:33:05.680455+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.64973187.120.116.2452400TCP
                              2025-01-09T16:33:11.196071+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.64976487.120.116.2452400TCP

                              Network Port Distribution

                              TCP Packets

                              TimestampSource PortDest PortSource IPDest IP
                              Jan 9, 2025 16:33:01.047780991 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:01.052867889 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:01.052957058 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:01.061938047 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:01.066818953 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:01.724065065 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:01.774219036 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:01.865987062 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:01.870893955 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:01.875816107 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:01.875946999 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:01.880861044 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:01.880932093 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:01.885767937 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:02.203545094 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:02.258642912 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:02.349957943 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:02.354873896 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:02.476556063 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:02.522232056 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:03.126774073 CET4971880192.168.2.6178.237.33.50
                              Jan 9, 2025 16:33:03.131562948 CET8049718178.237.33.50192.168.2.6
                              Jan 9, 2025 16:33:03.131655931 CET4971880192.168.2.6178.237.33.50
                              Jan 9, 2025 16:33:03.131808043 CET4971880192.168.2.6178.237.33.50
                              Jan 9, 2025 16:33:03.136552095 CET8049718178.237.33.50192.168.2.6
                              Jan 9, 2025 16:33:03.736411095 CET8049718178.237.33.50192.168.2.6
                              Jan 9, 2025 16:33:03.736828089 CET4971880192.168.2.6178.237.33.50
                              Jan 9, 2025 16:33:03.748481035 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:03.753664970 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:04.742336035 CET8049718178.237.33.50192.168.2.6
                              Jan 9, 2025 16:33:04.742415905 CET4971880192.168.2.6178.237.33.50
                              Jan 9, 2025 16:33:04.828963995 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:04.831044912 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:04.835880041 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:04.835966110 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:04.844746113 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:04.849517107 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:04.883644104 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:04.958987951 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:04.991420984 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:04.996315956 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:04.996395111 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:04.999897003 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:05.004821062 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.008601904 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:05.450206041 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.492949963 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:05.577871084 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.582880020 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:05.587724924 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.587784052 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:05.592603922 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.636981010 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.680454969 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:05.780607939 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.784938097 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:05.789726019 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.789777040 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:05.794518948 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.857320070 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:05.862157106 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.862169027 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.862204075 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.862214088 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.862216949 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:05.862257957 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.862272024 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.862273932 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:05.862298965 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.862306118 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:05.862308979 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.862317085 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:05.862359047 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.862412930 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.867033005 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.867094040 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.867104053 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.867115974 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.867176056 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.867218971 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.867291927 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:05.867348909 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.603655100 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:06.608525991 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.931266069 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.977317095 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:06.977849960 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:06.979259968 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:06.982680082 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.982700109 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.982749939 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.982758999 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.982812881 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.982821941 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.982933998 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.982947111 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.982991934 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.983000994 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.983051062 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.983059883 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.983107090 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.983154058 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.984066010 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.984076023 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.984118938 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.984213114 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:06.984225035 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:07.699724913 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:07.704478979 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:07.875037909 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:07.918898106 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:08.017216921 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:08.018486977 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:08.022115946 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.022130013 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.022188902 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.022255898 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.022267103 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.022288084 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.022370100 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.022428989 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.022438049 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.022516966 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.022528887 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.022538900 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.022547960 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.022559881 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.023367882 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.023380041 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.023391962 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.023401022 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.023422003 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.023432016 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.023442984 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.023566008 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.712269068 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:08.717149973 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.889822006 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.930452108 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:08.930996895 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:08.932362080 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:08.935797930 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.935900927 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.935909986 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.935959101 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.935966969 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.936045885 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.936054945 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.936095953 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.936105013 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.936156034 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.936163902 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.936306000 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.936315060 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.936322927 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.937262058 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.937272072 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.937300920 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.937314034 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.937325001 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.937341928 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.937397003 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:08.937405109 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:09.775964975 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:09.781203985 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:09.973615885 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.018243074 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:10.023241997 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.023267031 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.023294926 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.023308039 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.023329020 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.023355961 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.023369074 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.023384094 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.023406982 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.023463964 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.023478031 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.023526907 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.023540020 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.023551941 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.045202971 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:10.050209999 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.050225019 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.050250053 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.050260067 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.050268888 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.050280094 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.050303936 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.050314903 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.489911079 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.522723913 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:10.528158903 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.528281927 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:10.540865898 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:10.578171968 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:10.582978964 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.794436932 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:10.801297903 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:10.973426104 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.008110046 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.012510061 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.013299942 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.013315916 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.013343096 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.013356924 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.013396025 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.013408899 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.013448000 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.013461113 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.013515949 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.013530016 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.013559103 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.013572931 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.013587952 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.013602972 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.017390013 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.017419100 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.017488956 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.017503977 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.017617941 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.017632961 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.017730951 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.017745972 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.149504900 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.196070910 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.278264999 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.282794952 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.287853003 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.288043022 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.292882919 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.385185003 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.390227079 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.390248060 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.390260935 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.390268087 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.390284061 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.390295029 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.390310049 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.390322924 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.390332937 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.390332937 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.390338898 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.390352011 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.390404940 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.390554905 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.390568972 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.390610933 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.395220995 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.395239115 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.395277977 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.395297050 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.395365000 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.395379066 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.395406008 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.395427942 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.395451069 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.395478010 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.395503998 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.395518064 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.395539999 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.395560026 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.395699978 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.395715952 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.395730019 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.400372982 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.400392056 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.400405884 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.400423050 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.400571108 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.400583982 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.400595903 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.400609016 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.400620937 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.730891943 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.774405956 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.811279058 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.816762924 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.889997005 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.892326117 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.894844055 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.894944906 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.894956112 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.895049095 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.895059109 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.895119905 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.895129919 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.895138979 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.895148039 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.895165920 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.895176888 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.895185947 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.895211935 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.895266056 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.895275116 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.896262884 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:11.897278070 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.897286892 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.897291899 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.897300005 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.897304058 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.897309065 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.897311926 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.897486925 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.897496939 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.897504091 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.897511959 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.897520065 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.897526979 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.897571087 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.899828911 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.899840117 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.899903059 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.899913073 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.899957895 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.899967909 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.900120020 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.900127888 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.900135040 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.900139093 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.900152922 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.900161028 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.900226116 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.900234938 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.901226997 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.901235104 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.901242971 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.901329994 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.901339054 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.901361942 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:11.901371002 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.007385015 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.055450916 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:12.056380987 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:12.057667971 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:12.061381102 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.061397076 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.061408043 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.061419010 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.061429977 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.061481953 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.061495066 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.061499119 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.061631918 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.061645031 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.061655998 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.061666012 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.061676025 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.062534094 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.062546968 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.062551975 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.062724113 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.062735081 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.062746048 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.062757015 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.062767982 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.062772989 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.475707054 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.524440050 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:12.681107044 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:12.682128906 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:12.685271025 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:12.686091900 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.686110020 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.686130047 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.686139107 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.686192036 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.686202049 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.686235905 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.686245918 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.686291933 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.686301947 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.686327934 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.686373949 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.686425924 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.686435938 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.687001944 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.687011003 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.687047958 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.687057018 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.687129974 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.687139034 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.687185049 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.687194109 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.687227964 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.687237024 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.687283993 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.687294006 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.687299967 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.687304020 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.689166069 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:12.690177917 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.690207005 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.690248966 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.690258026 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.690295935 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.690304995 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.690316916 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.690325975 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.690380096 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.690390110 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.690435886 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.690445900 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.690457106 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.690485954 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.694098949 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.694108009 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.694118023 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.694128036 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.694221020 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.694241047 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.694251060 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.694259882 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.694268942 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:12.841628075 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:12.847460032 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.018563032 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.060883045 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:13.062131882 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:13.065994024 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.066014051 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.066056967 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.066085100 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.066132069 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.066164970 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.066211939 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.066248894 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.066324949 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.066355944 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.066410065 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.066446066 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.066549063 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.066560030 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.067004919 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.067015886 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.067054987 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.067065001 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.067107916 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.067117929 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.067193031 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.067209959 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.162307024 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.211714029 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:13.552679062 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:13.554863930 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:13.557566881 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.557580948 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.557601929 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.557611942 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.557631969 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.557641983 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.557693958 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.557703972 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.557773113 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.557827950 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.557841063 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.557876110 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.557909966 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.557960033 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.559726000 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.559736967 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.559838057 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.559849024 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.559859991 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.559869051 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.559880972 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.559916019 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.559926987 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.559984922 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.559993982 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.560030937 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.560040951 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.560053110 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.569664955 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:13.570641994 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:13.574515104 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.574529886 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.574553013 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.574563980 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.574632883 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.574645042 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.574685097 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.574709892 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.574764013 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.574773073 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.574835062 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.574846983 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.574915886 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.574935913 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.575455904 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.575469017 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.575479984 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.575577021 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.575587988 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.575611115 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.778084040 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.821106911 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:13.852894068 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:13.858464003 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.955879927 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:13.958261967 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:13.960452080 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:13.960901976 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.960918903 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.961019039 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.961030006 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.961121082 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.961131096 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.961191893 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.961203098 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.961222887 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.961329937 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.961340904 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.961349964 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.961370945 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.961380959 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.961481094 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:13.963098049 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.963119984 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.963221073 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.963232040 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.963285923 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.963295937 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.963352919 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.963362932 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.963443995 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.963453054 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.963532925 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.963542938 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.963607073 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.963615894 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.965301991 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.965312004 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.965353012 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.965363026 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.965405941 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.965415955 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.965475082 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.965485096 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.965506077 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.965516090 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.965591908 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.965601921 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.965641975 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.965651035 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.966327906 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.966337919 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.966350079 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.966447115 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.966456890 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:13.966496944 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.028388977 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.070369005 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:14.071911097 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:14.075257063 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.075269938 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.075301886 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.075319052 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.075340986 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.075350046 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.075411081 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.075422049 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.075462103 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.075473070 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.075493097 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.075503111 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.075531960 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.075541973 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.076745987 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.076756001 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.076781034 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.076801062 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.076927900 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.076936960 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.077033043 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.077043056 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.865916967 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.869096994 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:14.873883009 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:14.914844036 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:15.010205984 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:15.011449099 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:15.014590979 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:15.014633894 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:15.015085936 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.015100002 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.015120029 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.015130043 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.015171051 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.015180111 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.015232086 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.015242100 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.015296936 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.015305996 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.015357971 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.015368938 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.015379906 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.015399933 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.016274929 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.016285896 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.016302109 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.016311884 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.016329050 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.016339064 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.016351938 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.016541004 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.016550064 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.016590118 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.016611099 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.016674995 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.016684055 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.016694069 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019401073 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019421101 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019429922 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019479990 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019494057 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019536018 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019546032 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019582987 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019592047 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019606113 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019614935 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019659996 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019669056 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019706964 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019716024 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019733906 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019742966 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019752026 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019809008 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019819975 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.019828081 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.108736992 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.146684885 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:15.148212910 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:15.151637077 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.151653051 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.151673079 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.151684999 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.151808023 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.151818991 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.151868105 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.151880026 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.151912928 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.151935101 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.151999950 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.152009010 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.152029037 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.152040005 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.152986050 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.153036118 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.153045893 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.153098106 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.153107882 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.153147936 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.153160095 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.153211117 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.402041912 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.446080923 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:15.583780050 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:15.586193085 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:15.588653088 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:15.588695049 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.588712931 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.588773966 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.588788033 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.588975906 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.588989019 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.589093924 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.589107990 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.589195967 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.589211941 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.589227915 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.589245081 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.589268923 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.589282036 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.590137959 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:15.591092110 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.591109037 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.591137886 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.591156006 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.591183901 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.591197014 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.591267109 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.591279984 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.591303110 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.591336966 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.591365099 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.591377974 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.591396093 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.591424942 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.593571901 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.593599081 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.593686104 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.593699932 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.593713045 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.593729019 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.593802929 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.593816042 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.593966007 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.593980074 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.593992949 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.594007015 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.594079018 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.594094038 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.594995022 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.595010996 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.595036983 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.595051050 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.595074892 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.595088005 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.595174074 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.922611952 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:15.927442074 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.934226036 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:15.993088961 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:16.099525928 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.149197102 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:16.170084953 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:16.171381950 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:16.175045967 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.175062895 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.175086975 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.175097942 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.175151110 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.175163031 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.175189972 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.175213099 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.175223112 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.175262928 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.175273895 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.175416946 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.175436974 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.175446987 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.176311016 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.176331043 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.176357031 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.176367998 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.176381111 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.176392078 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.176414013 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.176425934 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.246460915 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:16.249110937 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:16.251406908 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.251426935 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.251456976 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.251471996 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.251483917 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.251496077 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.251507998 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.251569033 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.251581907 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.251595020 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.251610041 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.251633883 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.251672983 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.251684904 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.251976013 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:16.253371000 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:16.254007101 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.254039049 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.254082918 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.254096031 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.254170895 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.254184008 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.254198074 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.254276991 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.254290104 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.254302025 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.254317045 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.254348993 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.254362106 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.254374027 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.256879091 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.256895065 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.256920099 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.256932974 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.256942987 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.256954908 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.256969929 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.257065058 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.257077932 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.257111073 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.257123947 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.257148027 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.257160902 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.257173061 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.258239031 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.258253098 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.258265018 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.258394957 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.258410931 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.258446932 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.258460999 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.547665119 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.602428913 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:16.680419922 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:16.682984114 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:16.685184956 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:16.685331106 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.685347080 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.685369015 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.685379028 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.685395956 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.685405970 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.685416937 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.685520887 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.685530901 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.685554981 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.685564995 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.685647011 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.685658932 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.685669899 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.686315060 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:16.687841892 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.687853098 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.687942028 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.687962055 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.688047886 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.688067913 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.688107967 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.688118935 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.688149929 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.688169956 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.688225031 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.688244104 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.688308954 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.688318968 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.690015078 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.690026045 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.690071106 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.690080881 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.690260887 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.690280914 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.690315962 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.690325975 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.690361977 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.690407991 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.690489054 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.690500975 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.690541029 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.690551043 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.691224098 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.691234112 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.691272974 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.691370010 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.691380978 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.691432953 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.691442966 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:16.931329012 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:16.936198950 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.288352966 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.288371086 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.336718082 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:17.336719990 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:17.365092039 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:17.366533041 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:17.369993925 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.370023966 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.370034933 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.370045900 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.370130062 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.370140076 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.370151043 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.370276928 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.370286942 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.370347977 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.370357990 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.370423079 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.370433092 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.370444059 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.371350050 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.371361017 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.371380091 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.371390104 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.371428967 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.371438980 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.371447086 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.371514082 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.445257902 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:17.449167967 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:17.450161934 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.450176001 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.450212002 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.450217009 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.450292110 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.450301886 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.450364113 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.450367928 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.450433969 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.450443029 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.450490952 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.450511932 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.450647116 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.450656891 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.453983068 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:17.454014063 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.454027891 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.454075098 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.454148054 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.454158068 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.454169035 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.454200983 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.454210043 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.454246044 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.454256058 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.454289913 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.454299927 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.454385996 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.454396009 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.455121994 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:17.458836079 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.458848953 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.458867073 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.458877087 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.458908081 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.458918095 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.459011078 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.459021091 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.459041119 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.459050894 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.459081888 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.459090948 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.459100962 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.459151030 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.459897041 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.459906101 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.459919930 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.460082054 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.460092068 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.460130930 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.460140944 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.706418037 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.759362936 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:17.912693977 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:17.914845943 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:17.917567968 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.917581081 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.917601109 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.917609930 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.917675972 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.917685032 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.917761087 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.917771101 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.917809010 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.917818069 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.917875051 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.917884111 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.917983055 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.917992115 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.918628931 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:17.919750929 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.919764042 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.919783115 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.919794083 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.919919014 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:17.919958115 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.919967890 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.920054913 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.920064926 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.920074940 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.920084953 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.920145988 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.920157909 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.920178890 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.920188904 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.923837900 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.923851013 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.923861027 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.923871040 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.923881054 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.923892021 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.923902035 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.923912048 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.923933029 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.923943043 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.923952103 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.923962116 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.923980951 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.923990965 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.924793959 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.924942017 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.924953938 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.924973011 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:17.947767973 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:17.952574015 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.194142103 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.194226027 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:18.194302082 CET497642400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:18.199002028 CET24004976487.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.220308065 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.274199009 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:18.277578115 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:18.282463074 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.282479048 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.282497883 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.282507896 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.282596111 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.282604933 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.282727957 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.282737970 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.282746077 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.282756090 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.282767057 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.282783985 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.282840014 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.282886982 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.284893990 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:18.289751053 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.289761066 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.289802074 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.289810896 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.289866924 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.289876938 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.289966106 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.289977074 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.289987087 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:18.962750912 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:18.967636108 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.139233112 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.180466890 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:19.186491013 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:19.188167095 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:19.191433907 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.191477060 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.191560984 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.191579103 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.191692114 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.191701889 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.191770077 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.191778898 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.191874027 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.191883087 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.191951036 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.191977978 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.192079067 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.192106962 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.193006992 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.193017960 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.193136930 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.193146944 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.193176985 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.193234921 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.193320990 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.193330050 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.193336964 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.399013996 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.399157047 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:19.399712086 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.399775982 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:19.399955988 CET497312400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:19.404740095 CET24004973187.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:19.977961063 CET497302400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:19.982788086 CET24004973087.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:26.035160065 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:26.037280083 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:26.042052984 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:56.087861061 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:33:56.089426994 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:33:56.094259024 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:34:26.482089996 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:34:26.483427048 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:34:26.488409996 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:34:53.087431908 CET4971880192.168.2.6178.237.33.50
                              Jan 9, 2025 16:34:53.399341106 CET4971880192.168.2.6178.237.33.50
                              Jan 9, 2025 16:34:54.008953094 CET4971880192.168.2.6178.237.33.50
                              Jan 9, 2025 16:34:55.211806059 CET4971880192.168.2.6178.237.33.50
                              Jan 9, 2025 16:34:56.564089060 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:34:56.565697908 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:34:56.570511103 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:34:57.618236065 CET4971880192.168.2.6178.237.33.50
                              Jan 9, 2025 16:35:02.555814028 CET4971880192.168.2.6178.237.33.50
                              Jan 9, 2025 16:35:12.164926052 CET4971880192.168.2.6178.237.33.50
                              Jan 9, 2025 16:35:26.959661961 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:35:26.961129904 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:35:26.965905905 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:35:57.230930090 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:35:57.235728025 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:35:57.240632057 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:36:27.581207991 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:36:27.582577944 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:36:27.588440895 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:36:57.671376944 CET24004971587.120.116.245192.168.2.6
                              Jan 9, 2025 16:36:57.675573111 CET497152400192.168.2.687.120.116.245
                              Jan 9, 2025 16:36:57.680361032 CET24004971587.120.116.245192.168.2.6

                              UDP Packets

                              TimestampSource PortDest PortSource IPDest IP
                              Jan 9, 2025 16:33:03.112623930 CET5063853192.168.2.61.1.1.1
                              Jan 9, 2025 16:33:03.119537115 CET53506381.1.1.1192.168.2.6

                              DNS Queries

                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                              Jan 9, 2025 16:33:03.112623930 CET192.168.2.61.1.1.10x20f9Standard query (0)geoplugin.netA (IP address)IN (0x0001)false

                              DNS Answers

                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                              Jan 9, 2025 16:33:03.119537115 CET1.1.1.1192.168.2.60x20f9No error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false

                              HTTP Request Dependency Graph

                              • geoplugin.net

                              HTTP Packets

                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                              0192.168.2.649718178.237.33.50805660C:\ProgramData\Remcos\remcos.exe
                              TimestampBytes transferredDirectionData
                              Jan 9, 2025 16:33:03.131808043 CET71OUTGET /json.gp HTTP/1.1
                              Host: geoplugin.net
                              Cache-Control: no-cache
                              Jan 9, 2025 16:33:03.736411095 CET1171INHTTP/1.1 200 OK
                              date: Thu, 09 Jan 2025 15:33:03 GMT
                              server: Apache
                              content-length: 963
                              content-type: application/json; charset=utf-8
                              cache-control: public, max-age=300
                              access-control-allow-origin: *
                              Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED]
                              Data Ascii: { "geoplugin_request":"8.46.123.189", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}


                              Statistics

                              CPU Usage

                              Click to jump to process

                              Memory Usage

                              Click to jump to process

                              High Level Behavior Distribution

                              Click to dive into process behavior distribution

                              Behavior

                              Click to jump to process

                              System Behavior

                              General

                              Target ID:0
                              Start time:10:32:57
                              Start date:09/01/2025
                              Path:C:\Users\user\Desktop\Material Requirments.pif.exe
                              Wow64 process (32bit):true
                              Commandline:"C:\Users\user\Desktop\Material Requirments.pif.exe"
                              Imagebase:0xbb0000
                              File size:1'005'568 bytes
                              MD5 hash:3A9DA3EDC40736CC832EDED3C389A661
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Yara matches:
                              • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2166318463.00000000074D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2162615893.0000000003F69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.2162615893.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2162615893.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2162615893.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2162615893.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2162615893.0000000003FA8000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                              Reputation:low
                              Has exited:true

                              General

                              Target ID:3
                              Start time:10:32:58
                              Start date:09/01/2025
                              Path:C:\Users\user\Desktop\Material Requirments.pif.exe
                              Wow64 process (32bit):true
                              Commandline:"C:\Users\user\Desktop\Material Requirments.pif.exe"
                              Imagebase:0xce0000
                              File size:1'005'568 bytes
                              MD5 hash:3A9DA3EDC40736CC832EDED3C389A661
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Yara matches:
                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                              • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                              • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                              • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.2161658344.000000000134A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              Reputation:low
                              Has exited:true

                              General

                              Target ID:4
                              Start time:10:32:58
                              Start date:09/01/2025
                              Path:C:\ProgramData\Remcos\remcos.exe
                              Wow64 process (32bit):true
                              Commandline:"C:\ProgramData\Remcos\remcos.exe"
                              Imagebase:0xb0000
                              File size:1'005'568 bytes
                              MD5 hash:3A9DA3EDC40736CC832EDED3C389A661
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Antivirus matches:
                              • Detection: 100%, Joe Sandbox ML
                              • Detection: 58%, ReversingLabs
                              Reputation:low
                              Has exited:true

                              General

                              Target ID:5
                              Start time:10:33:00
                              Start date:09/01/2025
                              Path:C:\ProgramData\Remcos\remcos.exe
                              Wow64 process (32bit):false
                              Commandline:"C:\ProgramData\Remcos\remcos.exe"
                              Imagebase:0x2d0000
                              File size:1'005'568 bytes
                              MD5 hash:3A9DA3EDC40736CC832EDED3C389A661
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Reputation:low
                              Has exited:true

                              General

                              Target ID:6
                              Start time:10:33:00
                              Start date:09/01/2025
                              Path:C:\ProgramData\Remcos\remcos.exe
                              Wow64 process (32bit):true
                              Commandline:"C:\ProgramData\Remcos\remcos.exe"
                              Imagebase:0xd40000
                              File size:1'005'568 bytes
                              MD5 hash:3A9DA3EDC40736CC832EDED3C389A661
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Yara matches:
                              • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.4608458310.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              Reputation:low
                              Has exited:false

                              General

                              Target ID:9
                              Start time:10:33:08
                              Start date:09/01/2025
                              Path:C:\ProgramData\Remcos\remcos.exe
                              Wow64 process (32bit):true
                              Commandline:"C:\ProgramData\Remcos\remcos.exe"
                              Imagebase:0x900000
                              File size:1'005'568 bytes
                              MD5 hash:3A9DA3EDC40736CC832EDED3C389A661
                              Has elevated privileges:false
                              Has administrator privileges:false
                              Programmed in:C, C++ or other language
                              Reputation:low
                              Has exited:true

                              General

                              Target ID:10
                              Start time:10:33:10
                              Start date:09/01/2025
                              Path:C:\ProgramData\Remcos\remcos.exe
                              Wow64 process (32bit):true
                              Commandline:"C:\ProgramData\Remcos\remcos.exe"
                              Imagebase:0xee0000
                              File size:1'005'568 bytes
                              MD5 hash:3A9DA3EDC40736CC832EDED3C389A661
                              Has elevated privileges:false
                              Has administrator privileges:false
                              Programmed in:C, C++ or other language
                              Yara matches:
                              • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.2270181874.000000000148A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              Reputation:low
                              Has exited:true

                              General

                              Target ID:12
                              Start time:10:33:16
                              Start date:09/01/2025
                              Path:C:\ProgramData\Remcos\remcos.exe
                              Wow64 process (32bit):true
                              Commandline:"C:\ProgramData\Remcos\remcos.exe"
                              Imagebase:0x280000
                              File size:1'005'568 bytes
                              MD5 hash:3A9DA3EDC40736CC832EDED3C389A661
                              Has elevated privileges:false
                              Has administrator privileges:false
                              Programmed in:C, C++ or other language
                              Reputation:low
                              Has exited:true

                              General

                              Target ID:13
                              Start time:10:33:18
                              Start date:09/01/2025
                              Path:C:\ProgramData\Remcos\remcos.exe
                              Wow64 process (32bit):true
                              Commandline:"C:\ProgramData\Remcos\remcos.exe"
                              Imagebase:0x540000
                              File size:1'005'568 bytes
                              MD5 hash:3A9DA3EDC40736CC832EDED3C389A661
                              Has elevated privileges:false
                              Has administrator privileges:false
                              Programmed in:C, C++ or other language
                              Yara matches:
                              • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000D.00000002.2352100171.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              Reputation:low
                              Has exited:true

                              General

                              Target ID:14
                              Start time:10:33:25
                              Start date:09/01/2025
                              Path:C:\ProgramData\Remcos\remcos.exe
                              Wow64 process (32bit):true
                              Commandline:"C:\ProgramData\Remcos\remcos.exe"
                              Imagebase:0x100000
                              File size:1'005'568 bytes
                              MD5 hash:3A9DA3EDC40736CC832EDED3C389A661
                              Has elevated privileges:false
                              Has administrator privileges:false
                              Programmed in:C, C++ or other language
                              Reputation:low
                              Has exited:true

                              General

                              Target ID:15
                              Start time:10:33:26
                              Start date:09/01/2025
                              Path:C:\ProgramData\Remcos\remcos.exe
                              Wow64 process (32bit):false
                              Commandline:"C:\ProgramData\Remcos\remcos.exe"
                              Imagebase:0x40000
                              File size:1'005'568 bytes
                              MD5 hash:3A9DA3EDC40736CC832EDED3C389A661
                              Has elevated privileges:false
                              Has administrator privileges:false
                              Programmed in:C, C++ or other language
                              Reputation:low
                              Has exited:true

                              General

                              Target ID:16
                              Start time:10:33:26
                              Start date:09/01/2025
                              Path:C:\ProgramData\Remcos\remcos.exe
                              Wow64 process (32bit):false
                              Commandline:"C:\ProgramData\Remcos\remcos.exe"
                              Imagebase:0xa0000
                              File size:1'005'568 bytes
                              MD5 hash:3A9DA3EDC40736CC832EDED3C389A661
                              Has elevated privileges:false
                              Has administrator privileges:false
                              Programmed in:C, C++ or other language
                              Reputation:low
                              Has exited:true

                              General

                              Target ID:17
                              Start time:10:33:26
                              Start date:09/01/2025
                              Path:C:\ProgramData\Remcos\remcos.exe
                              Wow64 process (32bit):true
                              Commandline:"C:\ProgramData\Remcos\remcos.exe"
                              Imagebase:0x4a0000
                              File size:1'005'568 bytes
                              MD5 hash:3A9DA3EDC40736CC832EDED3C389A661
                              Has elevated privileges:false
                              Has administrator privileges:false
                              Programmed in:C, C++ or other language
                              Yara matches:
                              • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000011.00000002.2431550511.0000000000A07000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              Reputation:low
                              Has exited:true

                              Disassembly

                              Reset < >

                                Execution Graph

                                Execution Coverage:10.4%
                                Dynamic/Decrypted Code Coverage:100%
                                Signature Coverage:3.1%
                                Total number of Nodes:258
                                Total number of Limit Nodes:13
                                execution_graph 31146 1684668 31147 168467a 31146->31147 31148 1684686 31147->31148 31152 1684779 31147->31152 31157 1684210 31148->31157 31150 16846a5 31153 168479d 31152->31153 31163 1684878 31153->31163 31167 1684888 31153->31167 31158 168421b 31157->31158 31175 1687908 31158->31175 31160 16884bd 31179 1687918 31160->31179 31162 16884d6 31162->31150 31164 1684888 31163->31164 31166 168498c 31164->31166 31171 168448c 31164->31171 31168 16848af 31167->31168 31169 168498c 31168->31169 31170 168448c CreateActCtxA 31168->31170 31170->31169 31172 1685918 CreateActCtxA 31171->31172 31174 16859db 31172->31174 31176 1687913 31175->31176 31177 1687918 GetModuleHandleW 31176->31177 31178 168874d 31177->31178 31178->31160 31180 1687923 31179->31180 31182 1688975 31180->31182 31183 168821c 31180->31183 31182->31162 31184 1688227 31183->31184 31187 168824c 31184->31187 31186 1688a5a 31186->31182 31188 1688257 31187->31188 31191 168827c 31188->31191 31190 1688b4d 31190->31186 31192 1688287 31191->31192 31193 168942b 31192->31193 31195 168bad8 31192->31195 31193->31190 31199 168bb10 31195->31199 31202 168bb02 31195->31202 31196 168baee 31196->31193 31206 168bbf7 31199->31206 31200 168bb1f 31200->31196 31203 168bb10 31202->31203 31205 168bbf7 GetModuleHandleW 31203->31205 31204 168bb1f 31204->31196 31205->31204 31207 168bc3c 31206->31207 31208 168bc19 31206->31208 31207->31200 31208->31207 31209 168be40 GetModuleHandleW 31208->31209 31210 168be6d 31209->31210 31210->31200 31234 168dd88 31236 168dd95 31234->31236 31235 168ddcf 31236->31235 31238 168c900 31236->31238 31240 168c90b 31238->31240 31239 168eae8 31240->31239 31242 168e0fc 31240->31242 31243 168e107 31242->31243 31244 168827c GetModuleHandleW 31243->31244 31245 168eb57 31244->31245 31245->31239 31228 73108a0 31229 73108e3 31228->31229 31230 7310901 MonitorFromPoint 31229->31230 31231 7310932 31229->31231 31230->31231 31211 7372830 31212 73729bb 31211->31212 31213 7372856 31211->31213 31213->31212 31215 73703c0 31213->31215 31216 7372ab0 PostMessageW 31215->31216 31217 7372b1c 31216->31217 31217->31213 31246 7371080 31247 7370c7c 31246->31247 31252 73716a6 31247->31252 31272 7371609 31247->31272 31292 7371640 31247->31292 31311 7371630 31247->31311 31253 7371634 31252->31253 31254 73716a9 31252->31254 31262 7371662 31253->31262 31330 7371f20 31253->31330 31335 7371b24 31253->31335 31340 7371e19 31253->31340 31345 73722fa 31253->31345 31351 7371abd 31253->31351 31356 7371c3f 31253->31356 31361 7371e75 31253->31361 31369 7371d56 31253->31369 31374 7371d17 31253->31374 31379 7371be8 31253->31379 31384 737224a 31253->31384 31389 7371eac 31253->31389 31394 737222d 31253->31394 31399 737214e 31253->31399 31403 7371baf 31253->31403 31407 7372260 31253->31407 31254->31247 31262->31247 31273 7371612 31272->31273 31274 7371649 31272->31274 31273->31247 31275 7371d17 3 API calls 31274->31275 31276 7371d56 2 API calls 31274->31276 31277 7371e75 4 API calls 31274->31277 31278 7371c3f 3 API calls 31274->31278 31279 7371abd 2 API calls 31274->31279 31280 73722fa 2 API calls 31274->31280 31281 7371e19 2 API calls 31274->31281 31282 7371662 31274->31282 31283 7371b24 2 API calls 31274->31283 31284 7371f20 3 API calls 31274->31284 31285 7372260 3 API calls 31274->31285 31286 7371baf 2 API calls 31274->31286 31287 737214e 2 API calls 31274->31287 31288 737222d 2 API calls 31274->31288 31289 7371eac 2 API calls 31274->31289 31290 737224a 3 API calls 31274->31290 31291 7371be8 2 API calls 31274->31291 31275->31282 31276->31282 31277->31282 31278->31282 31279->31282 31280->31282 31281->31282 31282->31247 31283->31282 31284->31282 31285->31282 31286->31282 31287->31282 31288->31282 31289->31282 31290->31282 31291->31282 31293 737165a 31292->31293 31294 7371d17 3 API calls 31293->31294 31295 7371d56 2 API calls 31293->31295 31296 7371e75 4 API calls 31293->31296 31297 7371c3f 3 API calls 31293->31297 31298 7371abd 2 API calls 31293->31298 31299 73722fa 2 API calls 31293->31299 31300 7371e19 2 API calls 31293->31300 31301 7371662 31293->31301 31302 7371b24 2 API calls 31293->31302 31303 7371f20 3 API calls 31293->31303 31304 7372260 3 API calls 31293->31304 31305 7371baf 2 API calls 31293->31305 31306 737214e 2 API calls 31293->31306 31307 737222d 2 API calls 31293->31307 31308 7371eac 2 API calls 31293->31308 31309 737224a 3 API calls 31293->31309 31310 7371be8 2 API calls 31293->31310 31294->31301 31295->31301 31296->31301 31297->31301 31298->31301 31299->31301 31300->31301 31301->31247 31302->31301 31303->31301 31304->31301 31305->31301 31306->31301 31307->31301 31308->31301 31309->31301 31310->31301 31312 7371640 31311->31312 31313 7371d17 3 API calls 31312->31313 31314 7371d56 2 API calls 31312->31314 31315 7371e75 4 API calls 31312->31315 31316 7371c3f 3 API calls 31312->31316 31317 7371abd 2 API calls 31312->31317 31318 73722fa 2 API calls 31312->31318 31319 7371e19 2 API calls 31312->31319 31320 7371662 31312->31320 31321 7371b24 2 API calls 31312->31321 31322 7371f20 3 API calls 31312->31322 31323 7372260 3 API calls 31312->31323 31324 7371baf 2 API calls 31312->31324 31325 737214e 2 API calls 31312->31325 31326 737222d 2 API calls 31312->31326 31327 7371eac 2 API calls 31312->31327 31328 737224a 3 API calls 31312->31328 31329 7371be8 2 API calls 31312->31329 31313->31320 31314->31320 31315->31320 31316->31320 31317->31320 31318->31320 31319->31320 31320->31247 31321->31320 31322->31320 31323->31320 31324->31320 31325->31320 31326->31320 31327->31320 31328->31320 31329->31320 31331 7371d1e 31330->31331 31416 7370394 31331->31416 31421 73702c8 31331->31421 31425 73702c3 31331->31425 31336 7371b2a 31335->31336 31429 7370854 31336->31429 31434 7370860 31336->31434 31341 7371e1c 31340->31341 31438 73701d8 31341->31438 31442 73701d0 31341->31442 31342 7371e47 31346 7371bff 31345->31346 31347 737231b 31346->31347 31349 73701d0 WriteProcessMemory 31346->31349 31350 73701d8 WriteProcessMemory 31346->31350 31348 7371c20 31348->31262 31349->31348 31350->31348 31352 7371ac7 31351->31352 31353 7371b58 31352->31353 31354 7370854 CreateProcessA 31352->31354 31355 7370860 CreateProcessA 31352->31355 31354->31353 31355->31353 31357 7371c45 31356->31357 31358 7370394 ReadProcessMemory 31357->31358 31359 73702c3 ReadProcessMemory 31357->31359 31360 73702c8 ReadProcessMemory 31357->31360 31358->31357 31359->31357 31360->31357 31362 7371e1c 31361->31362 31363 7371e7c 31361->31363 31367 73701d0 WriteProcessMemory 31362->31367 31368 73701d8 WriteProcessMemory 31362->31368 31446 7370110 31363->31446 31450 7370118 31363->31450 31364 7371e47 31364->31262 31367->31364 31368->31364 31371 7371d63 31369->31371 31370 737234b 31454 7370006 31371->31454 31458 7370040 31371->31458 31375 7371d1d 31374->31375 31376 7370394 ReadProcessMemory 31375->31376 31377 73702c3 ReadProcessMemory 31375->31377 31378 73702c8 ReadProcessMemory 31375->31378 31376->31375 31377->31375 31378->31375 31380 7371bee 31379->31380 31382 73701d0 WriteProcessMemory 31380->31382 31383 73701d8 WriteProcessMemory 31380->31383 31381 7371c20 31381->31262 31382->31381 31383->31381 31385 7371c56 31384->31385 31386 7370394 ReadProcessMemory 31385->31386 31387 73702c3 ReadProcessMemory 31385->31387 31388 73702c8 ReadProcessMemory 31385->31388 31386->31385 31387->31385 31388->31385 31390 7371eb2 31389->31390 31462 731ff13 31390->31462 31466 731ff18 31390->31466 31391 7371dae 31391->31262 31395 7371ec3 31394->31395 31396 7371dae 31394->31396 31397 731ff13 ResumeThread 31395->31397 31398 731ff18 ResumeThread 31395->31398 31396->31262 31397->31396 31398->31396 31401 73701d0 WriteProcessMemory 31399->31401 31402 73701d8 WriteProcessMemory 31399->31402 31400 7372172 31401->31400 31402->31400 31405 7370006 Wow64SetThreadContext 31403->31405 31406 7370040 Wow64SetThreadContext 31403->31406 31404 7371b83 31404->31262 31405->31404 31406->31404 31408 737226d 31407->31408 31409 737227a 31408->31409 31410 7370394 ReadProcessMemory 31408->31410 31411 73702c3 ReadProcessMemory 31408->31411 31412 73702c8 ReadProcessMemory 31408->31412 31413 7370394 ReadProcessMemory 31409->31413 31414 73702c3 ReadProcessMemory 31409->31414 31415 73702c8 ReadProcessMemory 31409->31415 31410->31409 31411->31409 31412->31409 31413->31409 31414->31409 31415->31409 31417 737039d 31416->31417 31418 7370333 ReadProcessMemory 31417->31418 31419 73703b2 31417->31419 31420 7370357 31418->31420 31420->31331 31422 7370313 ReadProcessMemory 31421->31422 31424 7370357 31422->31424 31424->31331 31426 73702c8 ReadProcessMemory 31425->31426 31428 7370357 31426->31428 31428->31331 31430 737085e CreateProcessA 31429->31430 31431 73707df 31429->31431 31433 7370aab 31430->31433 31435 73708e9 CreateProcessA 31434->31435 31437 7370aab 31435->31437 31439 7370220 WriteProcessMemory 31438->31439 31441 7370277 31439->31441 31441->31342 31443 73701d8 WriteProcessMemory 31442->31443 31445 7370277 31443->31445 31445->31342 31447 7370118 VirtualAllocEx 31446->31447 31449 7370195 31447->31449 31449->31364 31451 7370158 VirtualAllocEx 31450->31451 31453 7370195 31451->31453 31453->31364 31455 737000b 31454->31455 31455->31455 31456 73700a5 Wow64SetThreadContext 31455->31456 31457 73700cd 31456->31457 31457->31370 31459 7370085 Wow64SetThreadContext 31458->31459 31461 73700cd 31459->31461 31461->31370 31463 731ff18 ResumeThread 31462->31463 31465 731ff89 31463->31465 31465->31391 31467 731ff58 ResumeThread 31466->31467 31469 731ff89 31467->31469 31469->31391 31218 168dea0 31219 168dee6 GetCurrentProcess 31218->31219 31221 168df38 GetCurrentThread 31219->31221 31222 168df31 31219->31222 31223 168df6e 31221->31223 31224 168df75 GetCurrentProcess 31221->31224 31222->31221 31223->31224 31225 168dfab GetCurrentThreadId 31224->31225 31227 168e004 31225->31227 31232 168e4f0 DuplicateHandle 31233 168e586 31232->31233

                                Executed Functions

                                Function 07312D70 Relevance: 2.3, Strings: 1, Instructions: 1029COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 21 7312d70-7312d91 22 7312d93 21->22 23 7312d98-7312e84 21->23 22->23 25 73136b1-73136d9 23->25 26 7312e8a-7312fde 23->26 29 7313dbb-7313dc4 25->29 70 7312fe4-731303f 26->70 71 731367f-73136ae 26->71 30 73136e7-73136f0 29->30 31 7313dca-7313de1 29->31 33 73136f2 30->33 34 73136f7-73137d0 30->34 33->34 192 73137d6 call 7314011 34->192 193 73137d6 call 7314020 34->193 51 73137dc-73137e9 52 7313813 51->52 53 73137eb-73137f7 51->53 55 7313819-7313838 52->55 56 7313801-7313807 53->56 57 73137f9-73137ff 53->57 62 7313898-7313910 55->62 63 731383a-7313893 55->63 59 7313811 56->59 57->59 59->55 81 7313912-7313965 62->81 82 7313967-73139aa 62->82 75 7313db8 63->75 79 7313041 70->79 80 7313044-731304f 70->80 71->25 75->29 79->80 83 7313593-7313599 80->83 107 73139b5-73139bb 81->107 82->107 85 7313054-7313072 83->85 86 731359f-731361c 83->86 88 7313074-7313078 85->88 89 73130c9-73130de 85->89 125 7313669-731366f 86->125 88->89 94 731307a-7313085 88->94 91 73130e0 89->91 92 73130e5-73130fb 89->92 91->92 96 7313102-7313119 92->96 97 73130fd 92->97 98 73130bb-73130c1 94->98 102 7313120-7313136 96->102 103 731311b 96->103 97->96 100 73130c3-73130c4 98->100 101 7313087-731308b 98->101 110 7313147-73131b8 100->110 105 7313091-73130a9 101->105 106 731308d 101->106 108 7313138 102->108 109 731313d-7313144 102->109 103->102 113 73130b0-73130b8 105->113 114 73130ab 105->114 106->105 115 7313a12-7313a1e 107->115 108->109 109->110 116 73131ba 110->116 117 73131ce-7313346 110->117 113->98 114->113 119 7313a20-7313aa7 115->119 120 73139bd-73139df 115->120 116->117 118 73131bc-73131c8 116->118 126 7313348 117->126 127 731335c-7313497 117->127 118->117 147 7313c2c-7313c35 119->147 122 73139e1 120->122 123 73139e6-7313a0f 120->123 122->123 123->115 130 7313671-7313677 125->130 131 731361e-7313666 125->131 126->127 132 731334a-7313356 126->132 139 7313499-731349d 127->139 140 73134fb-7313510 127->140 130->71 131->125 132->127 139->140 142 731349f-73134ae 139->142 144 7313512 140->144 145 7313517-7313538 140->145 146 73134ed-73134f3 142->146 144->145 149 731353a 145->149 150 731353f-731355e 145->150 155 73134b0-73134b4 146->155 156 73134f5-73134f6 146->156 151 7313c3b-7313c96 147->151 152 7313aac-7313ac1 147->152 149->150 153 7313560 150->153 154 7313565-7313585 150->154 178 7313c98-7313ccb 151->178 179 7313ccd-7313cf7 151->179 159 7313ac3 152->159 160 7313aca-7313c20 152->160 153->154 161 7313587 154->161 162 731358c 154->162 157 73134b6-73134ba 155->157 158 73134be-73134df 155->158 163 7313590 156->163 157->158 165 73134e1 158->165 166 73134e6-73134ea 158->166 159->160 167 7313ad0-7313b10 159->167 168 7313b15-7313b55 159->168 169 7313b5a-7313b9a 159->169 170 7313b9f-7313bdf 159->170 184 7313c26 160->184 161->162 162->163 163->83 165->166 166->146 167->184 168->184 169->184 170->184 187 7313d00-7313dac 178->187 179->187 184->147 187->75 192->51 193->51
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID: \ lw
                                • API String ID: 0-2684086738
                                • Opcode ID: 97865959c987ba257cf2e139ff1c7de7183ce720926dc92a935336a13fc912fd
                                • Instruction ID: 02084773b38da618336ecfbd7766d839f3d4f1e59aaaf0b4301dcd6adadf3570
                                • Opcode Fuzzy Hash: 97865959c987ba257cf2e139ff1c7de7183ce720926dc92a935336a13fc912fd
                                • Instruction Fuzzy Hash: 8DB2B375E00628DFDB64CF69C984AD9BBB2BF89304F1581E9D50DAB225DB319E81CF40
                                Function 07373F30 Relevance: .6, Instructions: 624COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166200196.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7370000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: a0c45f97b3248a015666f1737fbfc79e0459e4a309f30a4da3d0819ab092789e
                                • Instruction ID: f773ed052a0f86636b92f3908540aa22f61a2b83531f830301cc84278069409d
                                • Opcode Fuzzy Hash: a0c45f97b3248a015666f1737fbfc79e0459e4a309f30a4da3d0819ab092789e
                                • Instruction Fuzzy Hash: E0329EB17012558FEB28EB65C850BAEBBF6AF89700F14406DE549DB3A1CB35ED01CB51
                                Function 07315E50 Relevance: .1, Instructions: 71COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 7644ac9a14606838752d87a3b45456fbd3fae3635e3127290de4edace1150c34
                                • Instruction ID: 9169d99742b50fae6a8b6a9baee8c17a1956a42a6fe4c9b2afbb985c0472c907
                                • Opcode Fuzzy Hash: 7644ac9a14606838752d87a3b45456fbd3fae3635e3127290de4edace1150c34
                                • Instruction Fuzzy Hash: 1E21D5B0D05658CBEB18CFABC94069EFBF6AF89200F14C1AAC458A7255EB3409468F51
                                Function 07315E60 Relevance: .1, Instructions: 65COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 59629bc188056b4b7709bcf70e649cfa17924ffe028f07defd7a2fc4c5db5b0e
                                • Instruction ID: 70e2ae5b8bcef9bb5bcea80d49f9e78b178579f29e8eebd7621e6ee78c5f1713
                                • Opcode Fuzzy Hash: 59629bc188056b4b7709bcf70e649cfa17924ffe028f07defd7a2fc4c5db5b0e
                                • Instruction Fuzzy Hash: FD21A5B1D04658CBEB18CFABC9416AEFBF6BFC9300F14D16AC428A7255EB7019468F50
                                Function 0737222D Relevance: .1, Instructions: 57COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166200196.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7370000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: ae7045b3c97765f09638592a382b948cd007276fb6bbcf32edb5364653c29b89
                                • Instruction ID: 36c000770b4628421855b0e61dfc176c3466bc19c4a8abca7e5604f9d82ccd03
                                • Opcode Fuzzy Hash: ae7045b3c97765f09638592a382b948cd007276fb6bbcf32edb5364653c29b89
                                • Instruction Fuzzy Hash: A3116DF5829258CFDB30CF50C8986F8BBF8BB4A311F0461DA980EA6652D7385A85CF10
                                Function 07371EAC Relevance: .1, Instructions: 53COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166200196.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7370000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 05a0fd944d4df163e3b680ddca186abd6ee24162d9a2ca2b95936b9df3fc3839
                                • Instruction ID: 27f2f02d2b7ddbe7c75f1e404c3866f693c2a38cf202015850953b97e9e6bba7
                                • Opcode Fuzzy Hash: 05a0fd944d4df163e3b680ddca186abd6ee24162d9a2ca2b95936b9df3fc3839
                                • Instruction Fuzzy Hash: FA112EF5925218CFDB64CF64D8987E8BBB8FB4A311F406599980EA7251DB345AC5CF00
                                Function 0168DEA0 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                • GetCurrentProcess.KERNEL32 ref: 0168DF1E
                                • GetCurrentThread.KERNEL32 ref: 0168DF5B
                                • GetCurrentProcess.KERNEL32 ref: 0168DF98
                                • GetCurrentThreadId.KERNEL32 ref: 0168DFF1
                                Memory Dump Source
                                • Source File: 00000000.00000002.2155570245.0000000001680000.00000040.00000800.00020000.00000000.sdmp, Offset: 01680000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_1680000_Material Requirments.jbxd
                                Similarity
                                • API ID: Current$ProcessThread
                                • String ID:
                                • API String ID: 2063062207-0
                                • Opcode ID: 4274bd2826ee313665713c8cd6d90f9c03a6fcb40b7c9c7da1b3265d9f0f626b
                                • Instruction ID: fb85706dcf11c9af7c71b82214ce83d699e82f62e81786b328081ac08dbb0bbf
                                • Opcode Fuzzy Hash: 4274bd2826ee313665713c8cd6d90f9c03a6fcb40b7c9c7da1b3265d9f0f626b
                                • Instruction Fuzzy Hash: 615143B0900749DFEB58DFAAD948BDEBFF1EB88304F208459E509A7390DB746844CB65
                                Function 07370854 Relevance: 1.8, APIs: 1, Instructions: 278processCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 194 7370854-737085c 195 73707df-737081a 194->195 196 737085e-73708f5 194->196 216 7370823-7370848 195->216 217 737081c-7370822 195->217 198 73708f7-7370901 196->198 199 737092e-737094e 196->199 198->199 201 7370903-7370905 198->201 208 7370987-73709b6 199->208 209 7370950-737095a 199->209 202 7370907-7370911 201->202 203 7370928-737092b 201->203 206 7370915-7370924 202->206 207 7370913 202->207 203->199 206->206 210 7370926 206->210 207->206 220 73709ef-7370aa9 CreateProcessA 208->220 221 73709b8-73709c2 208->221 209->208 212 737095c-737095e 209->212 210->203 213 7370981-7370984 212->213 214 7370960-737096a 212->214 213->208 218 737096e-737097d 214->218 219 737096c 214->219 217->216 218->218 223 737097f 218->223 219->218 235 7370ab2-7370b38 220->235 236 7370aab-7370ab1 220->236 221->220 225 73709c4-73709c6 221->225 223->213 227 73709e9-73709ec 225->227 228 73709c8-73709d2 225->228 227->220 230 73709d6-73709e5 228->230 231 73709d4 228->231 230->230 233 73709e7 230->233 231->230 233->227 246 7370b3a-7370b3e 235->246 247 7370b48-7370b4c 235->247 236->235 246->247 248 7370b40 246->248 249 7370b4e-7370b52 247->249 250 7370b5c-7370b60 247->250 248->247 249->250 251 7370b54 249->251 252 7370b62-7370b66 250->252 253 7370b70-7370b74 250->253 251->250 252->253 254 7370b68 252->254 255 7370b86-7370b8d 253->255 256 7370b76-7370b7c 253->256 254->253 257 7370ba4 255->257 258 7370b8f-7370b9e 255->258 256->255 260 7370ba5 257->260 258->257 260->260
                                APIs
                                • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07370A96
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166200196.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7370000_Material Requirments.jbxd
                                Similarity
                                • API ID: CreateProcess
                                • String ID:
                                • API String ID: 963392458-0
                                • Opcode ID: 3c19648ff0ee608c806289e5f70b1bf2b1dfbf910c7736c49b92fe4ad08d94e6
                                • Instruction ID: 5aa80093c02853e342e3c2a72f2f092f4311977dc9d333182e5dcf105ea640de
                                • Opcode Fuzzy Hash: 3c19648ff0ee608c806289e5f70b1bf2b1dfbf910c7736c49b92fe4ad08d94e6
                                • Instruction Fuzzy Hash: 99B17CB1D0021ACFEB24CF68C8417EEBBF2BF49314F148569D848A7250DB799A85CF91
                                Function 07370860 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 261 7370860-73708f5 263 73708f7-7370901 261->263 264 737092e-737094e 261->264 263->264 265 7370903-7370905 263->265 271 7370987-73709b6 264->271 272 7370950-737095a 264->272 266 7370907-7370911 265->266 267 7370928-737092b 265->267 269 7370915-7370924 266->269 270 7370913 266->270 267->264 269->269 273 7370926 269->273 270->269 280 73709ef-7370aa9 CreateProcessA 271->280 281 73709b8-73709c2 271->281 272->271 274 737095c-737095e 272->274 273->267 275 7370981-7370984 274->275 276 7370960-737096a 274->276 275->271 278 737096e-737097d 276->278 279 737096c 276->279 278->278 282 737097f 278->282 279->278 292 7370ab2-7370b38 280->292 293 7370aab-7370ab1 280->293 281->280 283 73709c4-73709c6 281->283 282->275 285 73709e9-73709ec 283->285 286 73709c8-73709d2 283->286 285->280 287 73709d6-73709e5 286->287 288 73709d4 286->288 287->287 290 73709e7 287->290 288->287 290->285 303 7370b3a-7370b3e 292->303 304 7370b48-7370b4c 292->304 293->292 303->304 305 7370b40 303->305 306 7370b4e-7370b52 304->306 307 7370b5c-7370b60 304->307 305->304 306->307 308 7370b54 306->308 309 7370b62-7370b66 307->309 310 7370b70-7370b74 307->310 308->307 309->310 311 7370b68 309->311 312 7370b86-7370b8d 310->312 313 7370b76-7370b7c 310->313 311->310 314 7370ba4 312->314 315 7370b8f-7370b9e 312->315 313->312 317 7370ba5 314->317 315->314 317->317
                                APIs
                                • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07370A96
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166200196.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7370000_Material Requirments.jbxd
                                Similarity
                                • API ID: CreateProcess
                                • String ID:
                                • API String ID: 963392458-0
                                • Opcode ID: 2384e627348e3dbc065d4564048989230a59406a8fba675a06c71d27e27a7ef2
                                • Instruction ID: 1634d316d1a73e1fe665bc4c24ab1af94de250bc546d5e649d3432d66c88ae05
                                • Opcode Fuzzy Hash: 2384e627348e3dbc065d4564048989230a59406a8fba675a06c71d27e27a7ef2
                                • Instruction Fuzzy Hash: CD916CB1D0021ACFEF24DF68C841BEDBBB2BF49314F148169D858A7250DB799A85CF91
                                Function 0168BBF7 Relevance: 1.7, APIs: 1, Instructions: 204COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 318 168bbf7-168bc17 319 168bc19-168bc26 call 168aeec 318->319 320 168bc43-168bc47 318->320 327 168bc28 319->327 328 168bc3c 319->328 322 168bc49-168bc53 320->322 323 168bc5b-168bc9c 320->323 322->323 329 168bca9-168bcb7 323->329 330 168bc9e-168bca6 323->330 376 168bc2e call 168bea0 327->376 377 168bc2e call 168be90 327->377 328->320 331 168bcb9-168bcbe 329->331 332 168bcdb-168bcdd 329->332 330->329 334 168bcc9 331->334 335 168bcc0-168bcc7 call 168aef8 331->335 337 168bce0-168bce7 332->337 333 168bc34-168bc36 333->328 336 168bd78-168bdb4 333->336 341 168bccb-168bcd9 334->341 335->341 364 168bdb6-168bdf0 336->364 338 168bce9-168bcf1 337->338 339 168bcf4-168bcfb 337->339 338->339 342 168bd08-168bd11 call 168af08 339->342 343 168bcfd-168bd05 339->343 341->337 349 168bd1e-168bd23 342->349 350 168bd13-168bd1b 342->350 343->342 351 168bd41-168bd4e 349->351 352 168bd25-168bd2c 349->352 350->349 358 168bd50-168bd6e 351->358 359 168bd71-168bd77 351->359 352->351 354 168bd2e-168bd3e call 168af18 call 168af28 352->354 354->351 358->359 369 168bdf2-168be38 364->369 371 168be3a-168be3d 369->371 372 168be40-168be6b GetModuleHandleW 369->372 371->372 373 168be6d-168be73 372->373 374 168be74-168be88 372->374 373->374 376->333 377->333
                                APIs
                                • GetModuleHandleW.KERNELBASE(00000000), ref: 0168BE5E
                                Memory Dump Source
                                • Source File: 00000000.00000002.2155570245.0000000001680000.00000040.00000800.00020000.00000000.sdmp, Offset: 01680000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_1680000_Material Requirments.jbxd
                                Similarity
                                • API ID: HandleModule
                                • String ID:
                                • API String ID: 4139908857-0
                                • Opcode ID: 10b8cbdaf0ac84c3e3981d1630376a5f1118ca7cc57801bd86212be36e9b6be2
                                • Instruction ID: 79479aa2f0c1a0ccb2e31720f43968246831bea024fbf6cdbd9b2aca5f0e6099
                                • Opcode Fuzzy Hash: 10b8cbdaf0ac84c3e3981d1630376a5f1118ca7cc57801bd86212be36e9b6be2
                                • Instruction Fuzzy Hash: E3813370A00B059FE724EF2AD85179ABBF1FF88200F008A2ED58697B51DB75E845CB95
                                Function 07370006 Relevance: 1.6, APIs: 1, Instructions: 98threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 378 7370006-737000a 379 737000b-7370014 378->379 379->379 380 7370016-737008b 379->380 383 737008d-7370099 380->383 384 737009b-73700cb Wow64SetThreadContext 380->384 383->384 386 73700d4-7370104 384->386 387 73700cd-73700d3 384->387 387->386
                                APIs
                                • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 073700BE
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166200196.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7370000_Material Requirments.jbxd
                                Similarity
                                • API ID: ContextThreadWow64
                                • String ID:
                                • API String ID: 983334009-0
                                • Opcode ID: c278a28d5f47c5be3ceed3d43891ac20e9aac48cd53b78b0d9ff13505bcea0b5
                                • Instruction ID: 67d0a05b1061b581e93b971088f5a5e0c7286fcd4e7ff50b477cc391539b61e9
                                • Opcode Fuzzy Hash: c278a28d5f47c5be3ceed3d43891ac20e9aac48cd53b78b0d9ff13505bcea0b5
                                • Instruction Fuzzy Hash: BA318F718053898FDB12CFB9C8457EEBFF0AF4A220F14846AD444EB251C7785945CBA5
                                Function 0168448C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 391 168448c-16859d9 CreateActCtxA 394 16859db-16859e1 391->394 395 16859e2-1685a3c 391->395 394->395 402 1685a4b-1685a4f 395->402 403 1685a3e-1685a41 395->403 404 1685a60 402->404 405 1685a51-1685a5d 402->405 403->402 407 1685a61 404->407 405->404 407->407
                                APIs
                                • CreateActCtxA.KERNEL32(?), ref: 016859C9
                                Memory Dump Source
                                • Source File: 00000000.00000002.2155570245.0000000001680000.00000040.00000800.00020000.00000000.sdmp, Offset: 01680000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_1680000_Material Requirments.jbxd
                                Similarity
                                • API ID: Create
                                • String ID:
                                • API String ID: 2289755597-0
                                • Opcode ID: 6eba71dcabc0789196eb993bd4906922f6b8c65dbb1cb684c89832655ae92e48
                                • Instruction ID: 26b759c6dbf8f4c34febae9bf212af59cf3813db46093dbc6c48255f8bda3665
                                • Opcode Fuzzy Hash: 6eba71dcabc0789196eb993bd4906922f6b8c65dbb1cb684c89832655ae92e48
                                • Instruction Fuzzy Hash: 5241E071C0071DCBEB24DFA9C884BCEBBB5BF49304F20816AD409AB255DB756946CF90
                                Function 0168590D Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 408 168590d-16859d9 CreateActCtxA 410 16859db-16859e1 408->410 411 16859e2-1685a3c 408->411 410->411 418 1685a4b-1685a4f 411->418 419 1685a3e-1685a41 411->419 420 1685a60 418->420 421 1685a51-1685a5d 418->421 419->418 423 1685a61 420->423 421->420 423->423
                                APIs
                                • CreateActCtxA.KERNEL32(?), ref: 016859C9
                                Memory Dump Source
                                • Source File: 00000000.00000002.2155570245.0000000001680000.00000040.00000800.00020000.00000000.sdmp, Offset: 01680000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_1680000_Material Requirments.jbxd
                                Similarity
                                • API ID: Create
                                • String ID:
                                • API String ID: 2289755597-0
                                • Opcode ID: 14a3f58bc28b9e7ff56eb685a17e98a5c51146748a5abbcfdbaa7367a596b86c
                                • Instruction ID: 4338f5890e7bb810072d419c87efcbccb834ff3bbcf8ce5c7fa82c65dbdd44b4
                                • Opcode Fuzzy Hash: 14a3f58bc28b9e7ff56eb685a17e98a5c51146748a5abbcfdbaa7367a596b86c
                                • Instruction Fuzzy Hash: 9B41F171C0071DCBEB24DFA9C884BCDBBB1BF89304F20816AD409AB254DB756946CF50
                                Function 07310890 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 424 7310890-731089c 425 73108dd-73108ec 424->425 426 731089e-73108dc 424->426 430 7310952-731096d 425->430 431 73108ee-7310930 MonitorFromPoint 425->431 426->425 439 731096f-731097c 430->439 434 7310932-7310938 431->434 435 7310939-7310944 431->435 434->435 440 7310947 call 7310a59 435->440 441 7310947 call 7310a68 435->441 438 731094d-7310950 438->439 440->438 441->438
                                APIs
                                • MonitorFromPoint.USER32(?,?,00000002), ref: 0731091F
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID: FromMonitorPoint
                                • String ID:
                                • API String ID: 1566494148-0
                                • Opcode ID: 6908cf2f0a6e68b2256e9a49ea8077b36f768f71d7a4e7eff04322b75ca9d023
                                • Instruction ID: d2418f8873c8d5d5711624e548902f4d4c405cf52da0b74a2c0c3c530c84dde6
                                • Opcode Fuzzy Hash: 6908cf2f0a6e68b2256e9a49ea8077b36f768f71d7a4e7eff04322b75ca9d023
                                • Instruction Fuzzy Hash: 9121CCB59043899FEB159FA9C4147EEBFB0FB09310F10804AD859BB251C3346945CFA1
                                Function 073701D0 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 442 73701d0-7370226 445 7370236-7370275 WriteProcessMemory 442->445 446 7370228-7370234 442->446 448 7370277-737027d 445->448 449 737027e-73702ae 445->449 446->445 448->449
                                APIs
                                • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07370268
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166200196.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7370000_Material Requirments.jbxd
                                Similarity
                                • API ID: MemoryProcessWrite
                                • String ID:
                                • API String ID: 3559483778-0
                                • Opcode ID: e9611027413fa05c6d6b00788cebb1dc34485ac7d19ceda35ecad578b1b1fa62
                                • Instruction ID: 677e6d8fd9ada440274dcbd4ce412fe0ad178ee54567c51a23deec319252eccd
                                • Opcode Fuzzy Hash: e9611027413fa05c6d6b00788cebb1dc34485ac7d19ceda35ecad578b1b1fa62
                                • Instruction Fuzzy Hash: 042104B29003499FDB10CFA9C885BDEBBF5FF48310F108429E918A7240D7789954CBA4
                                Function 073701D8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 453 73701d8-7370226 455 7370236-7370275 WriteProcessMemory 453->455 456 7370228-7370234 453->456 458 7370277-737027d 455->458 459 737027e-73702ae 455->459 456->455 458->459
                                APIs
                                • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07370268
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166200196.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7370000_Material Requirments.jbxd
                                Similarity
                                • API ID: MemoryProcessWrite
                                • String ID:
                                • API String ID: 3559483778-0
                                • Opcode ID: 94689d859af6d4c4160071f51bc0ccccbb8414eabb16f7d8cbcdb0514c2979a2
                                • Instruction ID: 802e711cf0a4b97dcfa2c42db817cfdea7f96678bb67b85be40bb27e7bdb4a91
                                • Opcode Fuzzy Hash: 94689d859af6d4c4160071f51bc0ccccbb8414eabb16f7d8cbcdb0514c2979a2
                                • Instruction Fuzzy Hash: 032126B19003499FDF10CFA9C885BDEBBF5FF48310F108429E918A7240C7789954CBA4
                                Function 073108A0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 463 73108a0-73108ec 465 7310952-731096d 463->465 466 73108ee-7310930 MonitorFromPoint 463->466 474 731096f-731097c 465->474 469 7310932-7310938 466->469 470 7310939-7310944 466->470 469->470 475 7310947 call 7310a59 470->475 476 7310947 call 7310a68 470->476 473 731094d-7310950 473->474 475->473 476->473
                                APIs
                                • MonitorFromPoint.USER32(?,?,00000002), ref: 0731091F
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID: FromMonitorPoint
                                • String ID:
                                • API String ID: 1566494148-0
                                • Opcode ID: 710b9da8a8180f506dc015c8b09452c3813b21f84031dfd1b0c638b9ad96a2a0
                                • Instruction ID: 46cd4f441e5aa39a930bf3703ce6eda6ae30f8ec9036416c971d9a3173c4b76e
                                • Opcode Fuzzy Hash: 710b9da8a8180f506dc015c8b09452c3813b21f84031dfd1b0c638b9ad96a2a0
                                • Instruction Fuzzy Hash: 4E219AB4A002099FDB14DF9AD415BAEFFF4FB48710F10801AE845AB340CB346944CFA0
                                Function 073702C3 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 477 73702c3-7370355 ReadProcessMemory 482 7370357-737035d 477->482 483 737035e-737038e 477->483 482->483
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07370348
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166200196.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7370000_Material Requirments.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: 981ef3ea2bdc56ff9c5908da5588ee9fc6462f2724fdae5616681400d4909ea4
                                • Instruction ID: 91f6d33ea83008c8db2957e7f00fcbd1ea9af281620f5eef35784d696203223d
                                • Opcode Fuzzy Hash: 981ef3ea2bdc56ff9c5908da5588ee9fc6462f2724fdae5616681400d4909ea4
                                • Instruction Fuzzy Hash: 802128B19003499FDB10DFAAC981BEEFBF5FF48310F548429E518A7240C7399944CBA4
                                Function 073702C8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 498 73702c8-7370355 ReadProcessMemory 502 7370357-737035d 498->502 503 737035e-737038e 498->503 502->503
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07370348
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166200196.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7370000_Material Requirments.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: 98ddb25f7408d1273013823a4ffeca6e1f6cf1c941707db0b41554bbe44ca4a3
                                • Instruction ID: 364450388f0e490037b0abca1f3a20f4cf986dc1a9c5e17602b140730a52d843
                                • Opcode Fuzzy Hash: 98ddb25f7408d1273013823a4ffeca6e1f6cf1c941707db0b41554bbe44ca4a3
                                • Instruction Fuzzy Hash: 602128B19003499FDB10DFAAC981BEEFBF5FF48310F108429E518A7240C7399540CBA4
                                Function 07370040 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 488 7370040-737008b 490 737008d-7370099 488->490 491 737009b-73700cb Wow64SetThreadContext 488->491 490->491 493 73700d4-7370104 491->493 494 73700cd-73700d3 491->494 494->493
                                APIs
                                • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 073700BE
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166200196.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7370000_Material Requirments.jbxd
                                Similarity
                                • API ID: ContextThreadWow64
                                • String ID:
                                • API String ID: 983334009-0
                                • Opcode ID: 2becb8b9adc29d107c30196828ab8695dc42d8e5e0826b1fcc1e36c8cd1f91f4
                                • Instruction ID: cc7bb5642cc4dc48d5ae896fcffd224e6132ee7df914f4897688b4f86d54c10c
                                • Opcode Fuzzy Hash: 2becb8b9adc29d107c30196828ab8695dc42d8e5e0826b1fcc1e36c8cd1f91f4
                                • Instruction Fuzzy Hash: E72129B1D003099FEB14DFAAC4857EEBBF4EF88324F148429D559A7240C7789945CFA5
                                Function 0168E4F0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                Download Yara Rule
                                APIs
                                • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0168E577
                                Memory Dump Source
                                • Source File: 00000000.00000002.2155570245.0000000001680000.00000040.00000800.00020000.00000000.sdmp, Offset: 01680000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_1680000_Material Requirments.jbxd
                                Similarity
                                • API ID: DuplicateHandle
                                • String ID:
                                • API String ID: 3793708945-0
                                • Opcode ID: 425bbcb50e454771986bd73ce5d7f245ad822e8fce00e4a63097d546a45800f0
                                • Instruction ID: ab66c9c81af7769a0703388a51c46a79e660f5e4f48a61ea1695e96a30fb7e2e
                                • Opcode Fuzzy Hash: 425bbcb50e454771986bd73ce5d7f245ad822e8fce00e4a63097d546a45800f0
                                • Instruction Fuzzy Hash: CD21E4B5900248DFDB10CFAAD884ADEFFF8EB48310F14841AE914A3350D379A954CF65
                                Function 07370110 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON
                                Download Yara Rule
                                APIs
                                • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07370186
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166200196.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7370000_Material Requirments.jbxd
                                Similarity
                                • API ID: AllocVirtual
                                • String ID:
                                • API String ID: 4275171209-0
                                • Opcode ID: 4cc4f2c89aa7c3b22add36f21f02fe2f09dae43cbd7bd1d3c9e5efff63d8f560
                                • Instruction ID: ae9201ce47f1446016ceb3336615dd0f75e47c894d96b9c135a361c3269d1869
                                • Opcode Fuzzy Hash: 4cc4f2c89aa7c3b22add36f21f02fe2f09dae43cbd7bd1d3c9e5efff63d8f560
                                • Instruction Fuzzy Hash: AD1136769002499FDB10DFAAC845B9EBBF5AB88320F108819E559A7250C779A950CBA0
                                Function 07370118 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                Download Yara Rule
                                APIs
                                • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07370186
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166200196.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7370000_Material Requirments.jbxd
                                Similarity
                                • API ID: AllocVirtual
                                • String ID:
                                • API String ID: 4275171209-0
                                • Opcode ID: 9a2d332d767db2bd784ec1d10d1a2e7c75409bab0489544923c32e61558b64fb
                                • Instruction ID: 9761ade9d0c4f6690874e637ea68cd510cac6f4b7b48cc29149d71c988c9037c
                                • Opcode Fuzzy Hash: 9a2d332d767db2bd784ec1d10d1a2e7c75409bab0489544923c32e61558b64fb
                                • Instruction Fuzzy Hash: 541156759003499FDB20DFAAC845BDEBBF5AF88320F108819E519A7250C739A900CFA0
                                Function 0731FF13 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID: ResumeThread
                                • String ID:
                                • API String ID: 947044025-0
                                • Opcode ID: 29ecb45199171e43050ca6b731a1ab2264d48362f54219a39e7ed8991b68c20a
                                • Instruction ID: 15ea7f84087f8ee37665c7b786425232afbaaab1dca1bddfc07cbd763fa00d47
                                • Opcode Fuzzy Hash: 29ecb45199171e43050ca6b731a1ab2264d48362f54219a39e7ed8991b68c20a
                                • Instruction Fuzzy Hash: 041158B1D003498FEB10DFAAC8457AEFBF4EF89310F248419D519A7240C779A904CBA4
                                Function 0731FF18 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID: ResumeThread
                                • String ID:
                                • API String ID: 947044025-0
                                • Opcode ID: 2e7d49665113d50db160d4d0195de11fb633207524b5e9c88425e62883658eaf
                                • Instruction ID: be158f33e72eb59399f05f8997f39069b5a790bd745733d0facb5249f045c226
                                • Opcode Fuzzy Hash: 2e7d49665113d50db160d4d0195de11fb633207524b5e9c88425e62883658eaf
                                • Instruction Fuzzy Hash: 64113AB1D003498FEB14DFAAC44579EFBF4AF89714F248419D519A7240C779A544CBA4
                                Function 0168BDF8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                Download Yara Rule
                                APIs
                                • GetModuleHandleW.KERNELBASE(00000000), ref: 0168BE5E
                                Memory Dump Source
                                • Source File: 00000000.00000002.2155570245.0000000001680000.00000040.00000800.00020000.00000000.sdmp, Offset: 01680000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_1680000_Material Requirments.jbxd
                                Similarity
                                • API ID: HandleModule
                                • String ID:
                                • API String ID: 4139908857-0
                                • Opcode ID: 37d0ce511045fdf2401370a51ca9f223e23e80ca2d17fb0a464c07f688d9c30e
                                • Instruction ID: 5ab6e729a441ceef5d7d9fc746330a82ebfabbaea24e3f2b97110f13a2137b77
                                • Opcode Fuzzy Hash: 37d0ce511045fdf2401370a51ca9f223e23e80ca2d17fb0a464c07f688d9c30e
                                • Instruction Fuzzy Hash: 96110FB5C00649CFDB20DF9AC844B9EFBF4AB88214F10852AD618A7250C379A545CFA5
                                Function 073703C0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                Download Yara Rule
                                APIs
                                • PostMessageW.USER32(?,00000010,00000000,?), ref: 07372B0D
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166200196.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7370000_Material Requirments.jbxd
                                Similarity
                                • API ID: MessagePost
                                • String ID:
                                • API String ID: 410705778-0
                                • Opcode ID: f09cc39e345dbd76f3544d869b71dfd15b722bf94afdba05fbfe4fe8699c4a72
                                • Instruction ID: 792526395a2910ac6b24034efe2e5549776c8413e1efbbd78560e3fd07c10e58
                                • Opcode Fuzzy Hash: f09cc39e345dbd76f3544d869b71dfd15b722bf94afdba05fbfe4fe8699c4a72
                                • Instruction Fuzzy Hash: 0F11F2B5900349DFDB20DF9AD485BDEBBF8FB48320F10841AE918A7200C379A944CFA5
                                Function 07372AA8 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON
                                Download Yara Rule
                                APIs
                                • PostMessageW.USER32(?,00000010,00000000,?), ref: 07372B0D
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166200196.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7370000_Material Requirments.jbxd
                                Similarity
                                • API ID: MessagePost
                                • String ID:
                                • API String ID: 410705778-0
                                • Opcode ID: 5ba2b840cbd75efdee8256ba0c48c8ed593959721e57f586a8e407c9ac54b219
                                • Instruction ID: 7f03f3eda7bb3dcb1db92cc5f281b5939d0676d8ccb94918051ab722ec50b0ca
                                • Opcode Fuzzy Hash: 5ba2b840cbd75efdee8256ba0c48c8ed593959721e57f586a8e407c9ac54b219
                                • Instruction Fuzzy Hash: B211C2B5900749DFDB20DF9AD485BDEBBF8FB48320F108419E558A7240C379A544CFA5
                                Function 07370394 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                Download Yara Rule
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07370348
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166200196.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7370000_Material Requirments.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: 24cf701f115360da1af9bd15b6246bbfaa9cb178cb22c2a72c0abbb077dbfc23
                                • Instruction ID: 83e47df386a45ccfa70b27f7191d481f05e8abf27c592ae17eab942df0e0e455
                                • Opcode Fuzzy Hash: 24cf701f115360da1af9bd15b6246bbfaa9cb178cb22c2a72c0abbb077dbfc23
                                • Instruction Fuzzy Hash: F401B1728097958FFB129BB8D4243DDBFF09F46328F09848AC1D8AB292C77D4449C766
                                Function 0145D3D8 Relevance: .1, Instructions: 75COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2152227277.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_145d000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: b83dc543c0ce96b2f095d96eac51bf37492c937d3a3812a3e1a66453c72f4a6e
                                • Instruction ID: 732490f3c4608efac1e047b16ff5dd94bad3ee88106834fff7eb00e234c16da3
                                • Opcode Fuzzy Hash: b83dc543c0ce96b2f095d96eac51bf37492c937d3a3812a3e1a66453c72f4a6e
                                • Instruction Fuzzy Hash: 8B21E072900204EFDB45DF54D9C0B66BF65FF89324F20C16AED090B267C33AE456CAA2
                                Function 0146D1D4 Relevance: .1, Instructions: 72COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2152324647.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_146d000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 1beb45b65cc75edb118fbedaa7fcdce7b72ee4e94408175f673e529dcc0a68eb
                                • Instruction ID: 68a9a3ccdaf9ae13b7af784f8d6935455e54f84d67dec9863f8ca8613a13f056
                                • Opcode Fuzzy Hash: 1beb45b65cc75edb118fbedaa7fcdce7b72ee4e94408175f673e529dcc0a68eb
                                • Instruction Fuzzy Hash: 73212971B04304EFDB05DF94D9C0B26BB69FB84328F24C56ED9894B362C376D846CA62
                                Function 0146D01C Relevance: .1, Instructions: 72COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2152324647.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_146d000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 91bd0ec57cfc34de253690dc1d22a6acc3f96bda6851c0cd2e1e533f2fd38511
                                • Instruction ID: 905b828b257cc985bc8513ceabcd3de798b7a5ba6a627caafe2ff3608763727e
                                • Opcode Fuzzy Hash: 91bd0ec57cfc34de253690dc1d22a6acc3f96bda6851c0cd2e1e533f2fd38511
                                • Instruction Fuzzy Hash: D52103B1A04200EFDB15DF64D980B26BB69EB8431CF20C56ED98A0B366C336D447CA62
                                Function 0146D006 Relevance: .1, Instructions: 62COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2152324647.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_146d000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 98ac1023cb0c66619a315cd6d814d638bf7a1c1ef3ad96aacd33971478593cc9
                                • Instruction ID: b2a942849b6658ce0f87e19bb10445ec7ce632c37cfc2781afe40f6124bde8a8
                                • Opcode Fuzzy Hash: 98ac1023cb0c66619a315cd6d814d638bf7a1c1ef3ad96aacd33971478593cc9
                                • Instruction Fuzzy Hash: 792180755093809FCB02CF24D590716BF71EB46218F28C5DBD8898F2A7C33A980ACB62
                                Function 0145D3D3 Relevance: .1, Instructions: 56COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2152227277.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_145d000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                                • Instruction ID: 6792d4e70b3b61b84ac7ba4d70aa1ed22a603e1943a659cdb15bdac792115ba9
                                • Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                                • Instruction Fuzzy Hash: E711C072904240DFDB06CF44D5C0B56BF61FB84214F24C2AADC090A267C33AD456CB91
                                Function 0146D1CF Relevance: .1, Instructions: 53COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2152324647.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_146d000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                                • Instruction ID: 4d4f4f803ff1a0d23482319c98c46dbe9e5342bf4ee1eec575a1a6e9bbcc9c24
                                • Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                                • Instruction Fuzzy Hash: 7D11BE75A04240DFCB12CF54C5C0B16FF61FB84228F28C6AAD8494B366C33AD44ACB52

                                Non-executed Functions

                                Function 0731D7A8 Relevance: 1.6, Strings: 1, Instructions: 312COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID: aS`u
                                • API String ID: 0-2310418823
                                • Opcode ID: 47959957def805aaafc385588fb8bd334b653740298eac6c45c9252e99433169
                                • Instruction ID: 657a9dfcb21fabcf1a57683a4505b07b2d88e94a6a6bf1e4482fd0e358572ae6
                                • Opcode Fuzzy Hash: 47959957def805aaafc385588fb8bd334b653740298eac6c45c9252e99433169
                                • Instruction Fuzzy Hash: FBE11DB4E102198FDB14DFA9C5909AEFBF2FF89305F248159D418A735AD730A945CFA0
                                Function 0731D793 Relevance: 1.4, Strings: 1, Instructions: 135COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID: aS`u
                                • API String ID: 0-2310418823
                                • Opcode ID: bcd3bf2c0f4e281033f8eb6e4c787fd578d63f7f349f66db3d6ba7408d96b87d
                                • Instruction ID: 6b4a84fdeccfe3c65669c176e7a0602f73c52c5ebc4950ee4f046ad68a60c5c3
                                • Opcode Fuzzy Hash: bcd3bf2c0f4e281033f8eb6e4c787fd578d63f7f349f66db3d6ba7408d96b87d
                                • Instruction Fuzzy Hash: 3A512BB0E102198FDB18DFA9C5405AEFBF2BF89305F248169D418AB316D7319942CFA0
                                Function 0731F6F0 Relevance: .3, Instructions: 312COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: ca46e6dcb1662e1cbd3f28344df7c46ef39622bcd83a3dd83b30c45140fefb77
                                • Instruction ID: 51f6822fd51b40c02fb7927b453e837f9cdc0ee88f680042b59702dcbe419f4a
                                • Opcode Fuzzy Hash: ca46e6dcb1662e1cbd3f28344df7c46ef39622bcd83a3dd83b30c45140fefb77
                                • Instruction Fuzzy Hash: 59E11CB4E0021A8FDB14DFA9C5909AEFBF2FF49305F248169D818AB355D7309946CFA0
                                Function 0731F2B8 Relevance: .3, Instructions: 312COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 7ef321ca5045058c384e6fb46d4f809dd85356b27d20945aa6be675ceec22da3
                                • Instruction ID: 14e344e7bf9632dea5d177f7080f08cf948c4f7586b1e27394a8b8b6acf7e7d9
                                • Opcode Fuzzy Hash: 7ef321ca5045058c384e6fb46d4f809dd85356b27d20945aa6be675ceec22da3
                                • Instruction Fuzzy Hash: 7BE1FEB4E0011A8FDB14DFA9C5909AEFBF2FF89305F248169D418A7356D7319945CFA0
                                Function 0731E018 Relevance: .3, Instructions: 312COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 87ee2b2ea872412f2905831c5e7b7a263896c13ba88b180d0647175df8d16803
                                • Instruction ID: 7d1ead258cffc34b43bc404633cd3175c8f40b6800e0c5c127d496e12c2c16b4
                                • Opcode Fuzzy Hash: 87ee2b2ea872412f2905831c5e7b7a263896c13ba88b180d0647175df8d16803
                                • Instruction Fuzzy Hash: 3BE11EB4E002198FDB14DFA9C5909ADFBF2FF89305F248169D818A7355D731A946CFA0
                                Function 0731DBE0 Relevance: .3, Instructions: 312COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: f0d40fd4f39e4658640b0f3bf0874a569b774fc1799b6d2dfb26e29b5cd75e27
                                • Instruction ID: d952b6cd19fd07a7b9fb6e2abbd9ad066e2e5293be3ecf4af3d9ecc0f70c4b97
                                • Opcode Fuzzy Hash: f0d40fd4f39e4658640b0f3bf0874a569b774fc1799b6d2dfb26e29b5cd75e27
                                • Instruction Fuzzy Hash: E9E1FCB4E102198FDB14DFA9C5909AEFBB2FF89305F248169D418AB35AD7309945CFA0
                                Function 07312D63 Relevance: .2, Instructions: 239COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: e45fa47c66f1435d19799192054a47f818c826d9e9f922f50daec30c1175cc26
                                • Instruction ID: 778b12187df43f548910e58d2bd0c32b4df1ac28a8f6c63a93f30c828fd732bc
                                • Opcode Fuzzy Hash: e45fa47c66f1435d19799192054a47f818c826d9e9f922f50daec30c1175cc26
                                • Instruction Fuzzy Hash: 2DC165B5E00658CFDB58DF6AC9846DDBBF2AF88301F14C1AAD409AB365DB305A85CF50
                                Function 073152A8 Relevance: .2, Instructions: 188COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 56d0c9081b4262820559342bfd0c0267987a873a577aa03f24aa77de53264a80
                                • Instruction ID: c2c1ffaeea867d0e04947bd6ce0144f36dbc6203c06ea79de5a0f1d4cf355e6d
                                • Opcode Fuzzy Hash: 56d0c9081b4262820559342bfd0c0267987a873a577aa03f24aa77de53264a80
                                • Instruction Fuzzy Hash: 586137B5D15219CFEF18CFA9C440AEEBBBAFF8A301F20942AD419A7211DB705956CF50
                                Function 07312A78 Relevance: .2, Instructions: 171COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: e6e3dc9cc555cfda0bc087b8f8a764b117a1f1d691033b0d3cc859f3c018da6e
                                • Instruction ID: 5c9d93237d120c5566bbe4ff7c28849a5b0c735875b13fa573734a5f56af97a9
                                • Opcode Fuzzy Hash: e6e3dc9cc555cfda0bc087b8f8a764b117a1f1d691033b0d3cc859f3c018da6e
                                • Instruction Fuzzy Hash: A9712CB1A1025A8BDB48EF7AE55569EBFF3FBC8344F04C12AD51497229EF305406CB50
                                Function 07312A88 Relevance: .2, Instructions: 159COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 9ac4021d080cfbf83e7e896f7f0de0603e8bb6e98417aa1755abfc3f5eaedcde
                                • Instruction ID: 94309c6cf6986e4145f7b296d10e46643f811abb4a9816c65b808ed9e6570eeb
                                • Opcode Fuzzy Hash: 9ac4021d080cfbf83e7e896f7f0de0603e8bb6e98417aa1755abfc3f5eaedcde
                                • Instruction Fuzzy Hash: AE61FCB0A1021A8FDB48EF7AE95569EBFF3FBC8344F14C129D51497269EF70580A8B50
                                Function 0731F2A7 Relevance: .1, Instructions: 131COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 1d67f766a6356992c4df4d33c5b1e7a0d25ec61cc239f5b74896875ccdc97774
                                • Instruction ID: 8c9a993e149e2d1d5fe9f6b4954a8f4fa505973fc016f1f3d3e00781be48e53a
                                • Opcode Fuzzy Hash: 1d67f766a6356992c4df4d33c5b1e7a0d25ec61cc239f5b74896875ccdc97774
                                • Instruction Fuzzy Hash: E0510BB4E0021A8FDB18DFA9C5409AEFBF2BF89305F248169D418A7316D7319946CFA1
                                Function 0731F6E0 Relevance: .1, Instructions: 130COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 35900aeee4e10ed37817ea498ccee2162c9e00859ef6cfac31af404b5e9da151
                                • Instruction ID: a9383d9d4eeb6587e1de345efbc1ed1cb2f34242e98c972f72e94b9704c8ec0f
                                • Opcode Fuzzy Hash: 35900aeee4e10ed37817ea498ccee2162c9e00859ef6cfac31af404b5e9da151
                                • Instruction Fuzzy Hash: 5051EBB4E1021A8FDB18DFA9C5805AEFBF2BF89305F248169D418A7355D7319942CFA1
                                Function 0731A060 Relevance: .1, Instructions: 114COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.2166087945.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7310000_Material Requirments.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: a7b04550b5d5450592c6fa451cef36969de49473235477d6bf6df5834adda589
                                • Instruction ID: 20ace1796c9ceb63245331671c8028bedb46dfe6502aa59dc5d87667c6559aae
                                • Opcode Fuzzy Hash: a7b04550b5d5450592c6fa451cef36969de49473235477d6bf6df5834adda589
                                • Instruction Fuzzy Hash: 3B4109B4E1A2198FEB08CFAAC5406EEFBF6AF8D302F15D06AD41DA3251DB3049418B54

                                Execution Graph

                                Execution Coverage:1.8%
                                Dynamic/Decrypted Code Coverage:0%
                                Signature Coverage:1.9%
                                Total number of Nodes:722
                                Total number of Limit Nodes:26
                                execution_graph 48059 442c0c 48060 442c15 48059->48060 48065 442c2e 48059->48065 48061 442c1d 48060->48061 48066 442c94 48060->48066 48063 442c25 48063->48061 48077 442f61 22 API calls 2 library calls 48063->48077 48067 442ca0 48066->48067 48068 442c9d 48066->48068 48078 44e3ce GetEnvironmentStringsW 48067->48078 48068->48063 48073 442ce2 48073->48063 48074 442cb8 48086 446cd5 20 API calls _free 48074->48086 48076 442cad 48087 446cd5 20 API calls _free 48076->48087 48077->48065 48079 44e3e2 48078->48079 48080 442ca7 48078->48080 48088 446d0f 48079->48088 48080->48076 48085 442db9 26 API calls 2 library calls 48080->48085 48082 44e3f6 ctype 48095 446cd5 20 API calls _free 48082->48095 48084 44e410 FreeEnvironmentStringsW 48084->48080 48085->48074 48086->48076 48087->48073 48089 446d4d 48088->48089 48093 446d1d _strftime 48088->48093 48097 445564 20 API calls __dosmaperr 48089->48097 48091 446d38 RtlAllocateHeap 48092 446d4b 48091->48092 48091->48093 48092->48082 48093->48089 48093->48091 48096 442410 7 API calls 2 library calls 48093->48096 48095->48084 48096->48093 48097->48092 48098 433bc9 48099 433bd5 ___BuildCatchObject 48098->48099 48130 4338be 48099->48130 48101 433bdc 48102 433d2f 48101->48102 48105 433c06 48101->48105 48423 433d4f IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 48102->48423 48104 433d36 48424 4428ce 28 API calls _Atexit 48104->48424 48117 433c45 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 48105->48117 48417 4436e1 5 API calls __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 48105->48417 48107 433d3c 48425 442880 28 API calls _Atexit 48107->48425 48110 433c1f 48112 433c25 48110->48112 48418 443685 5 API calls __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 48110->48418 48111 433d44 48114 433ca6 48141 433e69 48114->48141 48117->48114 48419 43f037 35 API calls 4 library calls 48117->48419 48124 433cc8 48124->48104 48125 433ccc 48124->48125 48126 433cd5 48125->48126 48421 442871 28 API calls _Atexit 48125->48421 48422 433a4d 13 API calls 2 library calls 48126->48422 48129 433cdd 48129->48112 48131 4338c7 48130->48131 48426 434015 IsProcessorFeaturePresent 48131->48426 48133 4338d3 48427 437bfe 10 API calls 3 library calls 48133->48427 48135 4338d8 48140 4338dc 48135->48140 48428 44356e IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 48135->48428 48137 4338e5 48138 4338f3 48137->48138 48429 437c27 8 API calls 3 library calls 48137->48429 48138->48101 48140->48101 48430 436260 48141->48430 48143 433e7c GetStartupInfoW 48144 433cac 48143->48144 48145 443632 48144->48145 48431 44dfd9 48145->48431 48147 433cb5 48150 40d83a 48147->48150 48148 44363b 48148->48147 48435 44e2e3 35 API calls 48148->48435 48437 41beee LoadLibraryA GetProcAddress 48150->48437 48152 40d856 GetModuleFileNameW 48442 40e240 48152->48442 48154 40d872 48457 401fbd 48154->48457 48157 401fbd 28 API calls 48158 40d890 48157->48158 48461 41b1ce 48158->48461 48162 40d8a2 48486 401d8c 48162->48486 48164 40d8ab 48165 40d908 48164->48165 48166 40d8be 48164->48166 48492 401d64 48165->48492 48679 40ea5e 111 API calls 48166->48679 48169 40d918 48172 401d64 22 API calls 48169->48172 48170 40d8d0 48171 401d64 22 API calls 48170->48171 48175 40d8dc 48171->48175 48173 40d937 48172->48173 48497 404cbf 48173->48497 48680 40ea0f 65 API calls 48175->48680 48176 40d946 48501 405ce6 48176->48501 48179 40d952 48504 401eef 48179->48504 48180 40d8f7 48681 40e22d 65 API calls 48180->48681 48183 40d95e 48508 401eea 48183->48508 48185 40d967 48187 401eea 11 API calls 48185->48187 48186 401eea 11 API calls 48188 40dd72 48186->48188 48189 40d970 48187->48189 48420 433e9f GetModuleHandleW 48188->48420 48190 401d64 22 API calls 48189->48190 48191 40d979 48190->48191 48512 401ebd 48191->48512 48193 40d984 48194 401d64 22 API calls 48193->48194 48195 40d99d 48194->48195 48196 401d64 22 API calls 48195->48196 48197 40d9b8 48196->48197 48198 40da19 48197->48198 48682 4085b4 28 API calls 48197->48682 48199 401d64 22 API calls 48198->48199 48214 40e20c 48198->48214 48204 40da30 48199->48204 48201 40d9e5 48202 401eef 11 API calls 48201->48202 48203 40d9f1 48202->48203 48206 401eea 11 API calls 48203->48206 48205 40da77 48204->48205 48211 41258f 3 API calls 48204->48211 48516 40bed7 48205->48516 48208 40d9fa 48206->48208 48683 41258f RegOpenKeyExA 48208->48683 48209 40da7d 48210 40d900 48209->48210 48519 41a66e 48209->48519 48210->48186 48216 40da5b 48211->48216 48718 4129da 30 API calls 48214->48718 48215 40da98 48218 40daeb 48215->48218 48536 40697b 48215->48536 48216->48205 48686 4129da 30 API calls 48216->48686 48219 401d64 22 API calls 48218->48219 48222 40daf4 48219->48222 48231 40db00 48222->48231 48232 40db05 48222->48232 48224 40e222 48719 41138d 64 API calls ___scrt_fastfail 48224->48719 48225 40dac1 48229 401d64 22 API calls 48225->48229 48226 40dab7 48687 40699d 30 API calls 48226->48687 48239 40daca 48229->48239 48690 4069ba CreateProcessA CloseHandle CloseHandle ___scrt_fastfail 48231->48690 48236 401d64 22 API calls 48232->48236 48233 40dabc 48688 4064d0 97 API calls 48233->48688 48237 40db0e 48236->48237 48540 41b013 48237->48540 48239->48218 48242 40dae6 48239->48242 48240 40db19 48544 401e18 48240->48544 48689 4064d0 97 API calls 48242->48689 48244 40db24 48548 401e13 48244->48548 48246 40db2d 48247 401d64 22 API calls 48246->48247 48248 40db36 48247->48248 48249 401d64 22 API calls 48248->48249 48250 40db50 48249->48250 48251 401d64 22 API calls 48250->48251 48252 40db6a 48251->48252 48253 401d64 22 API calls 48252->48253 48255 40db83 48253->48255 48254 40dbf0 48257 40dbff 48254->48257 48261 40dd7d ___scrt_fastfail 48254->48261 48255->48254 48256 401d64 22 API calls 48255->48256 48260 40db98 _wcslen 48256->48260 48258 401d64 22 API calls 48257->48258 48263 40dc84 48257->48263 48259 40dc11 48258->48259 48262 401d64 22 API calls 48259->48262 48260->48254 48264 401d64 22 API calls 48260->48264 48693 412735 RegOpenKeyExA RegQueryValueExA RegCloseKey 48261->48693 48265 40dc23 48262->48265 48286 40dc7f ___scrt_fastfail 48263->48286 48266 40dbb3 48264->48266 48268 401d64 22 API calls 48265->48268 48270 401d64 22 API calls 48266->48270 48269 40dc35 48268->48269 48273 401d64 22 API calls 48269->48273 48271 40dbc8 48270->48271 48552 40c89e 48271->48552 48272 40ddc2 48274 401d64 22 API calls 48272->48274 48276 40dc5e 48273->48276 48277 40dde9 48274->48277 48281 401d64 22 API calls 48276->48281 48694 401f66 48277->48694 48279 401e18 11 API calls 48280 40dbe7 48279->48280 48283 401e13 11 API calls 48280->48283 48284 40dc6f 48281->48284 48283->48254 48609 40bc67 48284->48609 48285 40ddf8 48698 4127aa 14 API calls 48285->48698 48286->48263 48691 41297a 31 API calls 48286->48691 48290 40de0e 48292 401d64 22 API calls 48290->48292 48291 40dd18 48294 401d64 22 API calls 48291->48294 48293 40de1a 48292->48293 48699 43a7f7 39 API calls _strftime 48293->48699 48297 40dd2f 48294->48297 48296 40de27 48299 40de54 48296->48299 48700 41c0bb 86 API calls ___scrt_fastfail 48296->48700 48297->48272 48298 401d64 22 API calls 48297->48298 48300 40dd51 48298->48300 48302 401f66 28 API calls 48299->48302 48303 41b013 28 API calls 48300->48303 48305 40de69 48302->48305 48306 40dd5a 48303->48306 48304 40de38 CreateThread 48304->48299 48918 41cb7a 10 API calls 48304->48918 48307 401f66 28 API calls 48305->48307 48692 40e2f1 109 API calls 48306->48692 48309 40de78 48307->48309 48701 41a891 79 API calls 48309->48701 48310 40dd5f 48310->48272 48312 40dd66 48310->48312 48312->48210 48313 40de7d 48314 401d64 22 API calls 48313->48314 48315 40de89 48314->48315 48316 401d64 22 API calls 48315->48316 48317 40de9e 48316->48317 48318 401d64 22 API calls 48317->48318 48319 40debe 48318->48319 48702 43a7f7 39 API calls _strftime 48319->48702 48321 40decb 48322 401d64 22 API calls 48321->48322 48323 40ded6 48322->48323 48324 401d64 22 API calls 48323->48324 48325 40dee7 48324->48325 48326 401d64 22 API calls 48325->48326 48327 40defc 48326->48327 48328 401d64 22 API calls 48327->48328 48329 40df0d 48328->48329 48330 40df14 StrToIntA 48329->48330 48703 409517 141 API calls _wcslen 48330->48703 48332 40df26 48333 401d64 22 API calls 48332->48333 48335 40df2f 48333->48335 48334 40df74 48337 401d64 22 API calls 48334->48337 48335->48334 48704 433818 22 API calls 3 library calls 48335->48704 48342 40df84 48337->48342 48338 40df44 48339 401d64 22 API calls 48338->48339 48340 40df57 48339->48340 48341 40df5e CreateThread 48340->48341 48341->48334 48920 41931e 102 API calls 2 library calls 48341->48920 48343 40dfcc 48342->48343 48705 433818 22 API calls 3 library calls 48342->48705 48344 401d64 22 API calls 48343->48344 48349 40dfd5 48344->48349 48346 40df99 48347 401d64 22 API calls 48346->48347 48348 40dfab 48347->48348 48353 40dfb2 CreateThread 48348->48353 48350 40e03f 48349->48350 48352 401d64 22 API calls 48349->48352 48351 401d64 22 API calls 48350->48351 48355 40e048 48351->48355 48354 40dff1 48352->48354 48353->48343 48919 41931e 102 API calls 2 library calls 48353->48919 48357 401d64 22 API calls 48354->48357 48356 40e08d 48355->48356 48359 401d64 22 API calls 48355->48359 48709 41a9ad 29 API calls 48356->48709 48360 40e006 48357->48360 48362 40e05d 48359->48362 48706 40c854 31 API calls 48360->48706 48361 40e096 48363 401e18 11 API calls 48361->48363 48367 401d64 22 API calls 48362->48367 48364 40e0a1 48363->48364 48366 401e13 11 API calls 48364->48366 48370 40e0aa CreateThread 48366->48370 48371 40e072 48367->48371 48368 40e019 48369 401e18 11 API calls 48368->48369 48372 40e025 48369->48372 48375 40e0d7 48370->48375 48376 40e0cb CreateThread 48370->48376 48921 40e627 82 API calls 48370->48921 48707 43a7f7 39 API calls _strftime 48371->48707 48374 401e13 11 API calls 48372->48374 48380 40e02e CreateThread 48374->48380 48377 40e0e0 CreateThread 48375->48377 48378 40e0ec 48375->48378 48376->48375 48922 41100e 138 API calls 48376->48922 48377->48378 48923 4115fc 38 API calls ___scrt_fastfail 48377->48923 48382 40e146 48378->48382 48384 401f66 28 API calls 48378->48384 48380->48350 48924 40196b 49 API calls _strftime 48380->48924 48381 40e07f 48708 40b95c 7 API calls 48381->48708 48712 412546 RegOpenKeyExA RegQueryValueExA RegCloseKey 48382->48712 48385 40e119 48384->48385 48710 404c9e 28 API calls 48385->48710 48388 40e15e 48390 40e1fd 48388->48390 48392 41b013 28 API calls 48388->48392 48389 40e126 48391 401f66 28 API calls 48389->48391 48715 40cbac 27 API calls 48390->48715 48393 40e135 48391->48393 48396 40e177 48392->48396 48711 41a891 79 API calls 48393->48711 48395 40e202 48716 40cc37 45 API calls 48395->48716 48713 41265c 31 API calls 48396->48713 48399 40e13a 48401 401eea 11 API calls 48399->48401 48400 40e207 48717 4140ac 168 API calls _strftime 48400->48717 48401->48382 48404 40e18d 48405 401e13 11 API calls 48404->48405 48408 40e198 48405->48408 48406 40e1c0 DeleteFileW 48407 40e1c7 48406->48407 48406->48408 48410 41b013 28 API calls 48407->48410 48408->48406 48408->48407 48409 40e1ae Sleep 48408->48409 48409->48408 48411 40e1d7 48410->48411 48714 412a52 RegOpenKeyExW RegDeleteValueW 48411->48714 48413 40e1ea 48414 401e13 11 API calls 48413->48414 48415 40e1f4 48414->48415 48416 401e13 11 API calls 48415->48416 48416->48390 48417->48110 48418->48117 48419->48114 48420->48124 48421->48126 48422->48129 48423->48104 48424->48107 48425->48111 48426->48133 48427->48135 48428->48137 48429->48140 48430->48143 48432 44dfeb 48431->48432 48433 44dfe2 48431->48433 48432->48148 48436 44ded8 48 API calls 4 library calls 48433->48436 48435->48148 48436->48432 48438 41bf2d LoadLibraryA GetProcAddress 48437->48438 48439 41bf1d GetModuleHandleA GetProcAddress 48437->48439 48440 41bf56 32 API calls 48438->48440 48441 41bf46 LoadLibraryA GetProcAddress 48438->48441 48439->48438 48440->48152 48441->48440 48720 41a84a FindResourceA 48442->48720 48446 40e26a ctype 48730 401f86 48446->48730 48449 401eef 11 API calls 48450 40e290 48449->48450 48451 401eea 11 API calls 48450->48451 48452 40e299 48451->48452 48453 43aa9c ___std_exception_copy 21 API calls 48452->48453 48454 40e2aa ctype 48453->48454 48734 406052 48454->48734 48456 40e2dd 48456->48154 48458 401fcc 48457->48458 48744 402501 48458->48744 48460 401fea 48460->48157 48481 41b1e1 48461->48481 48462 41b251 48463 401eea 11 API calls 48462->48463 48464 41b283 48463->48464 48465 401eea 11 API calls 48464->48465 48467 41b28b 48465->48467 48466 41b253 48757 403b60 28 API calls 48466->48757 48470 401eea 11 API calls 48467->48470 48472 40d899 48470->48472 48471 41b25f 48473 401eef 11 API calls 48471->48473 48482 40e995 48472->48482 48475 41b268 48473->48475 48474 401eef 11 API calls 48474->48481 48476 401eea 11 API calls 48475->48476 48478 41b270 48476->48478 48477 401eea 11 API calls 48477->48481 48480 41c1b4 28 API calls 48478->48480 48480->48462 48481->48462 48481->48466 48481->48474 48481->48477 48749 403b60 28 API calls 48481->48749 48750 41c1b4 48481->48750 48483 40e9a2 48482->48483 48485 40e9b2 48483->48485 48785 40200a 11 API calls 48483->48785 48485->48162 48487 40200a 48486->48487 48491 40203a 48487->48491 48786 402654 11 API calls 48487->48786 48489 40202b 48787 4026ba 11 API calls _Deallocate 48489->48787 48491->48164 48493 401d6c 48492->48493 48494 401d74 48493->48494 48788 401fff 22 API calls 48493->48788 48494->48169 48498 404ccb 48497->48498 48789 402e78 48498->48789 48500 404cee 48500->48176 48798 404bc4 48501->48798 48503 405cf4 48503->48179 48505 401efe 48504->48505 48507 401f0a 48505->48507 48807 4021b9 11 API calls 48505->48807 48507->48183 48510 4021b9 48508->48510 48509 4021e8 48509->48185 48510->48509 48808 40262e 11 API calls _Deallocate 48510->48808 48514 401ec9 48512->48514 48513 401ee4 48513->48193 48514->48513 48515 402325 28 API calls 48514->48515 48515->48513 48809 401e8f 48516->48809 48518 40bee1 CreateMutexA GetLastError 48518->48209 48811 41b366 48519->48811 48524 401eef 11 API calls 48525 41a6aa 48524->48525 48526 401eea 11 API calls 48525->48526 48528 41a6b2 48526->48528 48527 41a705 48527->48215 48528->48527 48529 4125eb 31 API calls 48528->48529 48530 41a6d8 48529->48530 48531 41a6e3 StrToIntA 48530->48531 48532 41a6f1 48531->48532 48533 41a6fa 48531->48533 48819 41c30d 22 API calls 48532->48819 48535 401eea 11 API calls 48533->48535 48535->48527 48537 40698f 48536->48537 48538 41258f 3 API calls 48537->48538 48539 406996 48538->48539 48539->48225 48539->48226 48541 41b027 48540->48541 48820 40b027 48541->48820 48543 41b02f 48543->48240 48545 401e27 48544->48545 48547 401e33 48545->48547 48829 402121 11 API calls 48545->48829 48547->48244 48550 402121 48548->48550 48549 402150 48549->48246 48550->48549 48830 402718 11 API calls _Deallocate 48550->48830 48553 40c8ba 48552->48553 48554 40c8da 48553->48554 48555 40c90f 48553->48555 48557 40c8d0 48553->48557 48835 41a956 29 API calls 48554->48835 48558 41b366 GetCurrentProcess 48555->48558 48556 40ca03 GetLongPathNameW 48831 403b40 48556->48831 48557->48556 48561 40c914 48558->48561 48564 40c918 48561->48564 48565 40c96a 48561->48565 48562 40c8e3 48566 401e18 11 API calls 48562->48566 48569 403b40 28 API calls 48564->48569 48568 403b40 28 API calls 48565->48568 48570 40c8ed 48566->48570 48567 403b40 28 API calls 48571 40ca27 48567->48571 48572 40c978 48568->48572 48573 40c926 48569->48573 48574 401e13 11 API calls 48570->48574 48838 40cd0a 28 API calls 48571->48838 48578 403b40 28 API calls 48572->48578 48579 403b40 28 API calls 48573->48579 48574->48557 48576 40ca3a 48839 402860 28 API calls 48576->48839 48581 40c98e 48578->48581 48582 40c93c 48579->48582 48580 40ca45 48840 402860 28 API calls 48580->48840 48837 402860 28 API calls 48581->48837 48836 402860 28 API calls 48582->48836 48586 40ca4f 48590 401e13 11 API calls 48586->48590 48587 40c999 48591 401e18 11 API calls 48587->48591 48588 40c947 48589 401e18 11 API calls 48588->48589 48593 40c952 48589->48593 48594 40ca59 48590->48594 48592 40c9a4 48591->48592 48595 401e13 11 API calls 48592->48595 48596 401e13 11 API calls 48593->48596 48597 401e13 11 API calls 48594->48597 48599 40c9ad 48595->48599 48600 40c95b 48596->48600 48598 40ca62 48597->48598 48601 401e13 11 API calls 48598->48601 48602 401e13 11 API calls 48599->48602 48603 401e13 11 API calls 48600->48603 48604 40ca6b 48601->48604 48602->48570 48603->48570 48605 401e13 11 API calls 48604->48605 48606 40ca74 48605->48606 48607 401e13 11 API calls 48606->48607 48608 40ca7d 48607->48608 48608->48279 48610 40bc7a _wcslen 48609->48610 48611 40bc84 48610->48611 48612 40bcce 48610->48612 48615 40bc8d CreateDirectoryW 48611->48615 48613 40c89e 31 API calls 48612->48613 48614 40bce0 48613->48614 48616 401e18 11 API calls 48614->48616 48842 40856b 48615->48842 48618 40bccc 48616->48618 48620 401e13 11 API calls 48618->48620 48619 40bca9 48876 4028cf 48619->48876 48626 40bcf7 48620->48626 48622 40bcb5 48623 401e18 11 API calls 48622->48623 48624 40bcc3 48623->48624 48625 401e13 11 API calls 48624->48625 48625->48618 48627 40bd10 48626->48627 48628 40bd2d 48626->48628 48630 40bb7b 31 API calls 48627->48630 48629 40bd36 CopyFileW 48628->48629 48631 40be07 48629->48631 48633 40bd48 _wcslen 48629->48633 48632 40bd21 48630->48632 48848 40bb7b 48631->48848 48632->48286 48633->48631 48635 40bd64 48633->48635 48636 40bdb7 48633->48636 48641 40c89e 31 API calls 48635->48641 48640 40c89e 31 API calls 48636->48640 48638 40be21 48646 40be2a SetFileAttributesW 48638->48646 48639 40be4d 48642 40be95 CloseHandle 48639->48642 48648 403b40 28 API calls 48639->48648 48643 40bdbd 48640->48643 48644 40bd6a 48641->48644 48874 401e07 48642->48874 48649 401e18 11 API calls 48643->48649 48645 401e18 11 API calls 48644->48645 48650 40bd76 48645->48650 48651 40be39 _wcslen 48646->48651 48653 40be63 48648->48653 48678 40bdb1 48649->48678 48654 401e13 11 API calls 48650->48654 48651->48639 48665 40be4a SetFileAttributesW 48651->48665 48652 40beb1 ShellExecuteW 48655 40bec4 48652->48655 48656 40bece ExitProcess 48652->48656 48657 41b013 28 API calls 48653->48657 48659 40bd7f 48654->48659 48660 40bed7 CreateMutexA GetLastError 48655->48660 48662 40be76 48657->48662 48658 401e13 11 API calls 48663 40bdcf 48658->48663 48661 40856b 28 API calls 48659->48661 48660->48632 48664 40bd93 48661->48664 48879 41284c RegCreateKeyW 48662->48879 48667 40bddb CreateDirectoryW 48663->48667 48668 4028cf 28 API calls 48664->48668 48665->48639 48670 401e07 48667->48670 48671 40bd9f 48668->48671 48673 40bdeb CopyFileW 48670->48673 48674 401e18 11 API calls 48671->48674 48672 401e13 11 API calls 48672->48642 48673->48631 48675 40bdf8 48673->48675 48676 40bda8 48674->48676 48675->48632 48677 401e13 11 API calls 48676->48677 48677->48678 48678->48658 48679->48170 48680->48180 48682->48201 48684 4125e3 48683->48684 48685 4125b9 RegQueryValueExA RegCloseKey 48683->48685 48684->48198 48685->48684 48686->48205 48687->48233 48688->48225 48689->48218 48690->48232 48691->48291 48692->48310 48693->48272 48695 401f6e 48694->48695 48913 402301 48695->48913 48698->48290 48699->48296 48700->48304 48701->48313 48702->48321 48703->48332 48704->48338 48705->48346 48706->48368 48707->48381 48708->48356 48709->48361 48710->48389 48711->48399 48712->48388 48713->48404 48714->48413 48715->48395 48716->48400 48917 41a07f 103 API calls 48717->48917 48718->48224 48721 41a867 LoadResource LockResource SizeofResource 48720->48721 48722 40e25b 48720->48722 48721->48722 48723 43aa9c 48722->48723 48728 446d0f _strftime 48723->48728 48724 446d4d 48738 445564 20 API calls __dosmaperr 48724->48738 48726 446d38 RtlAllocateHeap 48727 446d4b 48726->48727 48726->48728 48727->48446 48728->48724 48728->48726 48737 442410 7 API calls 2 library calls 48728->48737 48731 401f8e 48730->48731 48739 402325 48731->48739 48733 401fa4 48733->48449 48735 401f86 28 API calls 48734->48735 48736 406066 48735->48736 48736->48456 48737->48728 48738->48727 48740 40232f 48739->48740 48742 40233a 48740->48742 48743 40294a 28 API calls 48740->48743 48742->48733 48743->48742 48745 40250d 48744->48745 48747 40252b 48745->48747 48748 40261a 28 API calls 48745->48748 48747->48460 48748->48747 48749->48481 48751 41c1b9 48750->48751 48752 41c1d6 48751->48752 48753 41c1dd 48751->48753 48777 41c1ee 28 API calls 48752->48777 48758 41c75d 48753->48758 48755 41c1db 48755->48481 48757->48471 48759 41c767 __EH_prolog 48758->48759 48760 41c7a0 48759->48760 48761 41c87e 48759->48761 48778 4026a7 28 API calls 48760->48778 48784 402649 22 API calls std::_Xinvalid_argument 48761->48784 48765 41c7b4 48779 41c741 28 API calls 48765->48779 48767 41c7e7 48768 41c802 48767->48768 48769 41c80e 48767->48769 48780 41c9bd 11 API calls 48768->48780 48781 41c9da 11 API calls 48769->48781 48772 41c80c 48783 41c965 11 API calls 48772->48783 48773 41c81a 48782 41c9da 11 API calls 48773->48782 48776 41c849 48776->48755 48777->48755 48778->48765 48779->48767 48780->48772 48781->48773 48782->48772 48783->48776 48785->48485 48786->48489 48787->48491 48790 402e85 48789->48790 48791 402ea9 48790->48791 48792 402e98 48790->48792 48794 402eae 48790->48794 48791->48500 48796 403445 28 API calls 48792->48796 48794->48791 48797 40225b 11 API calls 48794->48797 48796->48791 48797->48791 48799 404bd0 48798->48799 48802 40245c 48799->48802 48801 404be4 48801->48503 48803 402469 48802->48803 48805 402478 48803->48805 48806 402ad3 28 API calls 48803->48806 48805->48801 48806->48805 48807->48507 48808->48509 48810 401e94 48809->48810 48812 41b373 GetCurrentProcess 48811->48812 48813 41a67c 48811->48813 48812->48813 48814 4125eb RegOpenKeyExA 48813->48814 48815 412619 RegQueryValueExA RegCloseKey 48814->48815 48816 412641 48814->48816 48815->48816 48817 401f66 28 API calls 48816->48817 48818 412656 48817->48818 48818->48524 48819->48533 48821 40b02f 48820->48821 48824 40b04b 48821->48824 48823 40b045 48823->48543 48825 40b055 48824->48825 48827 40b060 48825->48827 48828 40b138 28 API calls 48825->48828 48827->48823 48828->48827 48829->48547 48830->48549 48832 403b48 48831->48832 48841 403b7a 28 API calls 48832->48841 48834 403b5a 48834->48567 48835->48562 48836->48588 48837->48587 48838->48576 48839->48580 48840->48586 48841->48834 48843 408577 48842->48843 48885 402ca8 48843->48885 48847 4085a3 48847->48619 48849 40bba1 48848->48849 48850 40bbdd 48848->48850 48903 40b0dd 48849->48903 48851 40bc1e 48850->48851 48855 40b0dd 28 API calls 48850->48855 48853 40bc5f 48851->48853 48856 40b0dd 28 API calls 48851->48856 48853->48638 48853->48639 48858 40bbf4 48855->48858 48859 40bc35 48856->48859 48857 4028cf 28 API calls 48860 40bbbd 48857->48860 48861 4028cf 28 API calls 48858->48861 48862 4028cf 28 API calls 48859->48862 48863 41284c 14 API calls 48860->48863 48864 40bbfe 48861->48864 48865 40bc3f 48862->48865 48866 40bbd1 48863->48866 48867 41284c 14 API calls 48864->48867 48868 41284c 14 API calls 48865->48868 48869 401e13 11 API calls 48866->48869 48870 40bc12 48867->48870 48871 40bc53 48868->48871 48869->48850 48872 401e13 11 API calls 48870->48872 48873 401e13 11 API calls 48871->48873 48872->48851 48873->48853 48875 401e0c 48874->48875 48909 402d8b 48876->48909 48878 4028dd 48878->48622 48880 41289e 48879->48880 48881 412861 48879->48881 48882 401e13 11 API calls 48880->48882 48884 41287a RegSetValueExW RegCloseKey 48881->48884 48883 40be89 48882->48883 48883->48672 48884->48880 48886 402cb5 48885->48886 48887 402cc8 48886->48887 48889 402cd9 48886->48889 48890 402cde 48886->48890 48896 403374 28 API calls 48887->48896 48892 402de3 48889->48892 48890->48889 48897 402f21 11 API calls 48890->48897 48893 402daf 48892->48893 48898 4030f7 48893->48898 48895 402dcd 48895->48847 48896->48889 48897->48889 48899 403101 48898->48899 48901 403115 48899->48901 48902 4036c2 28 API calls 48899->48902 48901->48895 48902->48901 48904 40b0e9 48903->48904 48905 402ca8 28 API calls 48904->48905 48906 40b10c 48905->48906 48907 402de3 28 API calls 48906->48907 48908 40b11f 48907->48908 48908->48857 48910 402d97 48909->48910 48911 4030f7 28 API calls 48910->48911 48912 402dab 48911->48912 48912->48878 48914 40230d 48913->48914 48915 402325 28 API calls 48914->48915 48916 401f80 48915->48916 48916->48285 48925 41170f 62 API calls 48922->48925 48926 43aba8 48928 43abb4 _swprintf ___BuildCatchObject 48926->48928 48927 43abc2 48942 445564 20 API calls __dosmaperr 48927->48942 48928->48927 48931 43abec 48928->48931 48930 43abc7 __fread_nolock 48937 444cdc EnterCriticalSection 48931->48937 48933 43abf7 48938 43ac98 48933->48938 48937->48933 48939 43aca6 48938->48939 48939->48939 48941 43ac02 48939->48941 48944 448626 36 API calls 2 library calls 48939->48944 48943 43ac1f LeaveCriticalSection std::_Lockit::~_Lockit 48941->48943 48942->48930 48943->48930 48944->48939 48945 402bcc 48946 402bd7 48945->48946 48947 402bdf 48945->48947 48963 403315 28 API calls __Getctype 48946->48963 48949 402beb 48947->48949 48953 4015d3 48947->48953 48950 402bdd 48955 433818 48953->48955 48954 43aa9c ___std_exception_copy 21 API calls 48954->48955 48955->48954 48956 402be9 48955->48956 48959 433839 std::_Facet_Register 48955->48959 48964 442410 7 API calls 2 library calls 48955->48964 48958 433ff7 std::_Facet_Register 48966 437de7 RaiseException 48958->48966 48959->48958 48965 437de7 RaiseException 48959->48965 48961 434014 48963->48950 48964->48955 48965->48958 48966->48961

                                Executed Functions

                                Function 0041BEEE Relevance: 115.6, APIs: 40, Strings: 26, Instructions: 140libraryloaderCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                • LoadLibraryA.KERNELBASE(Psapi,GetProcessImageFileNameW,?,?,?,?,0040D856), ref: 0041BF03
                                • GetProcAddress.KERNEL32(00000000), ref: 0041BF0C
                                • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040D856), ref: 0041BF23
                                • GetProcAddress.KERNEL32(00000000), ref: 0041BF26
                                • LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040D856), ref: 0041BF38
                                • GetProcAddress.KERNEL32(00000000), ref: 0041BF3B
                                • LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040D856), ref: 0041BF4C
                                • GetProcAddress.KERNEL32(00000000), ref: 0041BF4F
                                • LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040D856), ref: 0041BF60
                                • GetProcAddress.KERNEL32(00000000), ref: 0041BF63
                                • LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040D856), ref: 0041BF70
                                • GetProcAddress.KERNEL32(00000000), ref: 0041BF73
                                • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040D856), ref: 0041BF80
                                • GetProcAddress.KERNEL32(00000000), ref: 0041BF83
                                • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040D856), ref: 0041BF90
                                • GetProcAddress.KERNEL32(00000000), ref: 0041BF93
                                • LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040D856), ref: 0041BFA4
                                • GetProcAddress.KERNEL32(00000000), ref: 0041BFA7
                                • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040D856), ref: 0041BFB4
                                • GetProcAddress.KERNEL32(00000000), ref: 0041BFB7
                                • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040D856), ref: 0041BFC8
                                • GetProcAddress.KERNEL32(00000000), ref: 0041BFCB
                                • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040D856), ref: 0041BFDC
                                • GetProcAddress.KERNEL32(00000000), ref: 0041BFDF
                                • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040D856), ref: 0041BFF0
                                • GetProcAddress.KERNEL32(00000000), ref: 0041BFF3
                                • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040D856), ref: 0041C000
                                • GetProcAddress.KERNEL32(00000000), ref: 0041C003
                                • LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040D856), ref: 0041C011
                                • GetProcAddress.KERNEL32(00000000), ref: 0041C014
                                • LoadLibraryA.KERNEL32(kernel32,GetConsoleWindow,?,?,?,?,0040D856), ref: 0041C021
                                • GetProcAddress.KERNEL32(00000000), ref: 0041C024
                                • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040D856), ref: 0041C036
                                • GetProcAddress.KERNEL32(00000000), ref: 0041C039
                                • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040D856), ref: 0041C046
                                • GetProcAddress.KERNEL32(00000000), ref: 0041C049
                                • LoadLibraryA.KERNELBASE(Iphlpapi,GetExtendedTcpTable,?,?,?,?,0040D856), ref: 0041C05B
                                • GetProcAddress.KERNEL32(00000000), ref: 0041C05E
                                • LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedUdpTable,?,?,?,?,0040D856), ref: 0041C06B
                                • GetProcAddress.KERNEL32(00000000), ref: 0041C06E
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: AddressProc$HandleLibraryLoadModule
                                • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                                • API String ID: 384173800-625181639
                                • Opcode ID: b0b2e61fc073e98d70dce9ef4f7eaaaad63808f39ef958059982ad015adeb2a9
                                • Instruction ID: 91c85bc0cfa8e625a7056272f5779649be84715ca0db9f9d819234a6a75bf275
                                • Opcode Fuzzy Hash: b0b2e61fc073e98d70dce9ef4f7eaaaad63808f39ef958059982ad015adeb2a9
                                • Instruction Fuzzy Hash: 4C31E2A0E8035C7ADB207BB69CC9F3B7E6DD9847953510427B54893190EB7DEC408EAE
                                Function 0040D83A Relevance: 58.6, APIs: 12, Strings: 21, Instructions: 800COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 5 40d83a-40d8bc call 41beee GetModuleFileNameW call 40e240 call 401fbd * 2 call 41b1ce call 40e995 call 401d8c call 43ea30 22 40d908-40d9d0 call 401d64 call 401e8f call 401d64 call 404cbf call 405ce6 call 401eef call 401eea * 2 call 401d64 call 401ebd call 40541d call 401d64 call 404bb1 call 401d64 call 404bb1 5->22 23 40d8be-40d903 call 40ea5e call 401d64 call 401e8f call 40fd92 call 40ea0f call 40e22d 5->23 69 40d9d2-40da1d call 4085b4 call 401eef call 401eea call 401e8f call 41258f 22->69 70 40da23-40da3e call 401d64 call 40b125 22->70 49 40dd69-40dd7a call 401eea 23->49 69->70 100 40e20c-40e22c call 401e8f call 4129da call 41138d 69->100 79 40da40-40da5f call 401e8f call 41258f 70->79 80 40da78-40da7f call 40bed7 70->80 79->80 99 40da61-40da77 call 401e8f call 4129da 79->99 89 40da81-40da83 80->89 90 40da88-40da8f 80->90 93 40dd68 89->93 94 40da91 90->94 95 40da93-40da9f call 41a66e 90->95 93->49 94->95 105 40daa1-40daa3 95->105 106 40daa8-40daac 95->106 99->80 105->106 108 40daeb-40dafe call 401d64 call 401e8f 106->108 109 40daae call 40697b 106->109 127 40db00 call 4069ba 108->127 128 40db05-40db8d call 401d64 call 41b013 call 401e18 call 401e13 call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f 108->128 117 40dab3-40dab5 109->117 120 40dac1-40dad4 call 401d64 call 401e8f 117->120 121 40dab7-40dabc call 40699d call 4064d0 117->121 120->108 138 40dad6-40dadc 120->138 121->120 127->128 163 40dbf5-40dbf9 128->163 164 40db8f-40dba8 call 401d64 call 401e8f call 43a821 128->164 138->108 140 40dade-40dae4 138->140 140->108 142 40dae6 call 4064d0 140->142 142->108 166 40dd7d-40ddd4 call 436260 call 4022f8 call 401e8f * 2 call 412735 call 4082d7 163->166 167 40dbff-40dc06 163->167 164->163 190 40dbaa-40dbd6 call 401d64 call 401e8f call 401d64 call 401e8f call 40c89e 164->190 220 40ddd9-40de2f call 401d64 call 401e8f call 401f66 call 401e8f call 4127aa call 401d64 call 401e8f call 43a7f7 166->220 169 40dc84-40dc8e call 4082d7 167->169 170 40dc08-40dc7a call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 40bc67 167->170 176 40dc93-40dcb7 call 4022f8 call 433ad3 169->176 259 40dc7f-40dc82 170->259 198 40dcc6 176->198 199 40dcb9-40dcc4 call 436260 176->199 232 40dbdb-40dbf0 call 401e18 call 401e13 190->232 204 40dcc8-40dd3d call 401e07 call 43e559 call 4022f8 call 401e8f call 4022f8 call 401e8f call 41297a call 433adc call 401d64 call 40b125 198->204 199->204 204->220 272 40dd43-40dd64 call 401d64 call 41b013 call 40e2f1 204->272 273 40de31 220->273 274 40de4c-40de4e 220->274 232->163 259->176 272->220 292 40dd66 272->292 276 40de33-40de4a call 41c0bb CreateThread 273->276 277 40de50-40de52 274->277 278 40de54 274->278 279 40de5a-40df39 call 401f66 * 2 call 41a891 call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 43a7f7 call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f StrToIntA call 409517 call 401d64 call 401e8f 276->279 277->276 278->279 330 40df74 279->330 331 40df3b-40df72 call 433818 call 401d64 call 401e8f CreateThread 279->331 292->93 332 40df76-40df8e call 401d64 call 401e8f 330->332 331->332 343 40df90-40dfc7 call 433818 call 401d64 call 401e8f CreateThread 332->343 344 40dfcc-40dfdf call 401d64 call 401e8f 332->344 343->344 353 40dfe1-40e03a call 401d64 call 401e8f call 401d64 call 401e8f call 40c854 call 401e18 call 401e13 CreateThread 344->353 354 40e03f-40e052 call 401d64 call 401e8f 344->354 353->354 365 40e054-40e088 call 401d64 call 401e8f call 401d64 call 401e8f call 43a7f7 call 40b95c 354->365 366 40e08d-40e0b1 call 41a9ad call 401e18 call 401e13 354->366 365->366 388 40e0b3 366->388 389 40e0b6-40e0c9 CreateThread 366->389 388->389 392 40e0d7-40e0de 389->392 393 40e0cb-40e0d5 CreateThread 389->393 394 40e0e0-40e0ea CreateThread 392->394 395 40e0ec-40e0f3 392->395 393->392 394->395 398 40e0f5-40e0f8 395->398 399 40e106-40e10b 395->399 401 40e146-40e161 call 401e8f call 412546 398->401 402 40e0fa-40e104 398->402 404 40e110-40e141 call 401f66 call 404c9e call 401f66 call 41a891 call 401eea 399->404 413 40e167-40e1a7 call 41b013 call 401e07 call 41265c call 401e13 call 401e07 401->413 414 40e1fd-40e207 call 40cbac call 40cc37 call 4140ac 401->414 402->404 404->401 435 40e1c0-40e1c5 DeleteFileW 413->435 414->100 436 40e1c7-40e1f8 call 41b013 call 401e07 call 412a52 call 401e13 * 2 435->436 437 40e1a9-40e1ac 435->437 436->414 437->436 438 40e1ae-40e1bb Sleep call 401e07 437->438 438->435
                                APIs
                                  • Part of subcall function 0041BEEE: LoadLibraryA.KERNELBASE(Psapi,GetProcessImageFileNameW,?,?,?,?,0040D856), ref: 0041BF03
                                  • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF0C
                                  • Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040D856), ref: 0041BF23
                                  • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF26
                                  • Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040D856), ref: 0041BF38
                                  • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF3B
                                  • Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040D856), ref: 0041BF4C
                                  • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF4F
                                  • Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040D856), ref: 0041BF60
                                  • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF63
                                  • Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040D856), ref: 0041BF70
                                  • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF73
                                  • Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040D856), ref: 0041BF80
                                  • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF83
                                  • Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040D856), ref: 0041BF90
                                  • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF93
                                  • Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040D856), ref: 0041BFA4
                                  • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BFA7
                                  • Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040D856), ref: 0041BFB4
                                  • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BFB7
                                  • Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040D856), ref: 0041BFC8
                                  • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BFCB
                                  • Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040D856), ref: 0041BFDC
                                  • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BFDF
                                  • Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040D856), ref: 0041BFF0
                                  • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BFF3
                                  • Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040D856), ref: 0041C000
                                  • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041C003
                                  • Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040D856), ref: 0041C011
                                • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Material Requirments.pif.exe,00000104), ref: 0040D863
                                  • Part of subcall function 0040FD92: __EH_prolog.LIBCMT ref: 0040FD97
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
                                • String ID: SG$0TG$8SG$8SG$Access Level: $Administrator$C:\Users\user\Desktop\Material Requirments.pif.exe$Exe$Inj$PSG$PSG$Remcos Agent initialized$Software\$User$dMG$del$del$exepath$hSG$licence$license_code.txt
                                • API String ID: 2830904901-456540808
                                • Opcode ID: 789e219f43df678293d23314a0382cdaa002721fd1043111c90fe37ffbe07a24
                                • Instruction ID: b96e9d53b64ce9762df997b7c443b274fb73bccd3fe431706256fac2145036cf
                                • Opcode Fuzzy Hash: 789e219f43df678293d23314a0382cdaa002721fd1043111c90fe37ffbe07a24
                                • Instruction Fuzzy Hash: 2E32C760B043406ADA14B776DC57BBE259A9F81748F00483FB9467B2E2DEBC9D44C39E
                                Function 0040BC67 Relevance: 37.0, APIs: 12, Strings: 9, Instructions: 203fileCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                • _wcslen.LIBCMT ref: 0040BC75
                                • CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,00000000,?,004750FC,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040BC8E
                                • CopyFileW.KERNELBASE(C:\Users\user\Desktop\Material Requirments.pif.exe,00000000,00000000,00000000,00000000,00000000,?,004750FC,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe), ref: 0040BD3E
                                • _wcslen.LIBCMT ref: 0040BD54
                                • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040BDDC
                                • CopyFileW.KERNEL32(C:\Users\user\Desktop\Material Requirments.pif.exe,00000000,00000000), ref: 0040BDF2
                                • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040BE31
                                • _wcslen.LIBCMT ref: 0040BE34
                                • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040BE4B
                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004750FC,0000000E), ref: 0040BE9B
                                • ShellExecuteW.SHELL32(00000000,open,00000000,00466900,00466900,00000001), ref: 0040BEB9
                                • ExitProcess.KERNEL32 ref: 0040BED0
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
                                • String ID: SG$ SG$ SG$ SG$ SG$6$C:\Users\user\Desktop\Material Requirments.pif.exe$del$open
                                • API String ID: 1579085052-251601857
                                • Opcode ID: e8188cada3ee02d234ecf81338879933279f3a4d96db3535af2124ea23478e3e
                                • Instruction ID: cada26950b0f91ffbe9684419e497f708478a0192fdd3dd39558b78de3226dfb
                                • Opcode Fuzzy Hash: e8188cada3ee02d234ecf81338879933279f3a4d96db3535af2124ea23478e3e
                                • Instruction Fuzzy Hash: 0B51C1316046006BD609B722EC52E7F77889F81719F50443FF985A62E2DF7CAD4582EE
                                Function 0040C89E Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                • GetLongPathNameW.KERNELBASE(00000000,?,00000208), ref: 0040CA04
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: LongNamePath
                                • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                                • API String ID: 82841172-425784914
                                • Opcode ID: 6c406596aee4935c87f0405147d13aa241e9f415684b40df64016293a498d6e0
                                • Instruction ID: f058a63a2e06dcb2b247864a9289bab0e783a4957c20bc3838a58b63f1508e50
                                • Opcode Fuzzy Hash: 6c406596aee4935c87f0405147d13aa241e9f415684b40df64016293a498d6e0
                                • Instruction Fuzzy Hash: F0415C721482009AC214F721DC97DAFB7A4AE90759F10063FF546720E2EE7CAA59C69F
                                Function 0041A66E Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 59COMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                  • Part of subcall function 0041B366: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B377
                                  • Part of subcall function 004125EB: RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 0041260F
                                  • Part of subcall function 004125EB: RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 0041262C
                                  • Part of subcall function 004125EB: RegCloseKey.KERNELBASE(?), ref: 00412637
                                • StrToIntA.SHLWAPI(00000000,0046CC58,?,00000000,00000000,004750FC,00000003,Exe,00000000,0000000E,00000000,0046656C,00000003,00000000), ref: 0041A6E4
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseCurrentOpenProcessQueryValue
                                • String ID: (32 bit)$ (64 bit)$8ZG$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                • API String ID: 1866151309-1475859423
                                • Opcode ID: 6f3eb02be4beaf9b07ef8aecaf0cd0a5b9ef957053fccd77eae8da3d41cdd458
                                • Instruction ID: 1adcdd06a104af508aeef54d465e0c78d2d81651f2e3fe11076ab4bcd17b792f
                                • Opcode Fuzzy Hash: 6f3eb02be4beaf9b07ef8aecaf0cd0a5b9ef957053fccd77eae8da3d41cdd458
                                • Instruction Fuzzy Hash: 1811C660A001012AC704B3A6DCDBDBF765A9B91304F44413FB856A71E2FB6C9D9583EE
                                Function 0041284C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 654 41284c-41285f RegCreateKeyW 655 412861-41289c call 4022f8 call 401e07 RegSetValueExW RegCloseKey 654->655 656 41289e 654->656 658 4128a0-4128ac call 401e13 655->658 656->658
                                APIs
                                • RegCreateKeyW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,?), ref: 00412857
                                • RegSetValueExW.KERNELBASE(?,00000000,00000000,00000001,00000000,00000000,?,?,?,?,00000000,004752F0,762337E0,?), ref: 00412885
                                • RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,004752F0,762337E0,?,?,?,?,?,0040BE18,?,00000000), ref: 00412890
                                Strings
                                • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00412855
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseCreateValue
                                • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                • API String ID: 1818849710-1051519024
                                • Opcode ID: f4e6deeef55d850a19db6f17797bbdd9528135774a9c98646b8c0745f96cd39d
                                • Instruction ID: ab464752906d06cf6e422ab9fb9c42b8cedad3247386a7cb387aa37f92243dc4
                                • Opcode Fuzzy Hash: f4e6deeef55d850a19db6f17797bbdd9528135774a9c98646b8c0745f96cd39d
                                • Instruction Fuzzy Hash: 2DF09071500218BBDF50AFA0EE46FEE376CEF40B55F10452AF902B60A1EF75DA08DA94
                                Function 0040BED7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 664 40bed7-40bf03 call 401e8f CreateMutexA GetLastError
                                APIs
                                • CreateMutexA.KERNELBASE(00000000,00000001,00000000,0040DA7D,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,0046656C,00000003,00000000), ref: 0040BEE6
                                • GetLastError.KERNEL32 ref: 0040BEF1
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CreateErrorLastMutex
                                • String ID: 8SG
                                • API String ID: 1925916568-2887235486
                                • Opcode ID: a3b1be1148cb3973ecd705bae41f9902d0fcd13797bcadbc01d9bc0dca2f87b2
                                • Instruction ID: 2210f0ff69d3cac9d22e7a3f14049619627ec1602d204fa864a150733b7892bf
                                • Opcode Fuzzy Hash: a3b1be1148cb3973ecd705bae41f9902d0fcd13797bcadbc01d9bc0dca2f87b2
                                • Instruction Fuzzy Hash: B9D012702057009BE70817709D4E76D3951D784703F00407DB90BE51E1CEA488409519
                                Function 004125EB Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 667 4125eb-412617 RegOpenKeyExA 668 412619-41263f RegQueryValueExA RegCloseKey 667->668 669 41264a 667->669 668->669 670 412641-412648 668->670 671 41264f-41265b call 401f66 669->671 670->671
                                APIs
                                • RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 0041260F
                                • RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 0041262C
                                • RegCloseKey.KERNELBASE(?), ref: 00412637
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseOpenQueryValue
                                • String ID:
                                • API String ID: 3677997916-0
                                • Opcode ID: 0b101319eb01a71fcfc046be1d182bfe028d9f04373f8a3fc33fb6f26fd39d1b
                                • Instruction ID: 14faf112d3046a25d46051106a5b1d66d342437105d793e51b0bcc882fecfd0c
                                • Opcode Fuzzy Hash: 0b101319eb01a71fcfc046be1d182bfe028d9f04373f8a3fc33fb6f26fd39d1b
                                • Instruction Fuzzy Hash: D8F0D176900118BBCB209B91DD09EDF7B7CEB44B50F00406ABA05F2190DA749E599BA8
                                Function 0041258F Relevance: 4.5, APIs: 3, Instructions: 38registryCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 674 41258f-4125b7 RegOpenKeyExA 675 4125e7-4125ea 674->675 676 4125b9-4125e1 RegQueryValueExA RegCloseKey 674->676 676->675 677 4125e3-4125e6 676->677
                                APIs
                                • RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,00000000), ref: 004125AF
                                • RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 004125CD
                                • RegCloseKey.ADVAPI32(00000000), ref: 004125D8
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseOpenQueryValue
                                • String ID:
                                • API String ID: 3677997916-0
                                • Opcode ID: f2bc15ec1dd87dd5d2b8e96f704feec537dddf8cd8f352820b88cb246238aa27
                                • Instruction ID: f1b1b21d3432ee16d2560aa6e8f8b6fc3b679f7482eced78fea8614e15db81c1
                                • Opcode Fuzzy Hash: f2bc15ec1dd87dd5d2b8e96f704feec537dddf8cd8f352820b88cb246238aa27
                                • Instruction Fuzzy Hash: B4F03075A00208BFDF119FA09C45FDEBBB8EB04B55F104065FA05F6191D670DA54DB94
                                Function 0044E3CE Relevance: 4.5, APIs: 3, Instructions: 37COMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                • GetEnvironmentStringsW.KERNEL32 ref: 0044E3D2
                                • _free.LIBCMT ref: 0044E40B
                                • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044E412
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: EnvironmentStrings$Free_free
                                • String ID:
                                • API String ID: 2716640707-0
                                • Opcode ID: 7b27f9ba7dc7650e4bc281283ea68698952a5186545019ee32ebb3be47f28a21
                                • Instruction ID: 0c7208ec2ac4b9fba9bc784cf89e8dc40a8193b12e74657846f1c542f8109424
                                • Opcode Fuzzy Hash: 7b27f9ba7dc7650e4bc281283ea68698952a5186545019ee32ebb3be47f28a21
                                • Instruction Fuzzy Hash: 6CE06537505A2127F212666B7C89D6B2619EFC27BAB66002EF90496143EE198D0341FA
                                Function 00433818 Relevance: 3.0, APIs: 2, Instructions: 38COMMONLIBRARYCODE
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 692 433818-43381b 693 43382a-43382d call 43aa9c 692->693 695 433832-433835 693->695 696 433837-433838 695->696 697 43381d-433828 call 442410 695->697 697->693 700 433839-43383d 697->700 701 433843-433ff7 call 433f63 call 437de7 700->701 702 433ff8-434014 call 433f96 call 437de7 700->702 701->702
                                APIs
                                • __CxxThrowException@8.LIBVCRUNTIME ref: 00433FF2
                                  • Part of subcall function 00437DE7: RaiseException.KERNEL32(?,?,AFC,?,00476B98,00474D58,00000000,?,?,?,?,00434641,?,0046E690,?), ref: 00437E47
                                • __CxxThrowException@8.LIBVCRUNTIME ref: 0043400F
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Exception@8Throw$ExceptionRaise
                                • String ID:
                                • API String ID: 3476068407-0
                                • Opcode ID: 714a8d54469ce1dfc0cc795a6de609ef5f4529bef40f40983cd82ced525d9c42
                                • Instruction ID: 1c2073f64fee591a786a8a3f9c67cac18272885bad9296719f7a79fda1cbf913
                                • Opcode Fuzzy Hash: 714a8d54469ce1dfc0cc795a6de609ef5f4529bef40f40983cd82ced525d9c42
                                • Instruction Fuzzy Hash: 1BF0BB25C0430D768B04BEA6E80A9AD33BC5E08329F50513BB825914D1FB7C9759C5CD
                                Function 00446D0F Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 740 446d0f-446d1b 741 446d4d-446d58 call 445564 740->741 742 446d1d-446d1f 740->742 749 446d5a-446d5c 741->749 744 446d21-446d22 742->744 745 446d38-446d49 RtlAllocateHeap 742->745 744->745 747 446d24-446d2b call 4449d5 745->747 748 446d4b 745->748 747->741 752 446d2d-446d36 call 442410 747->752 748->749 752->741 752->745
                                APIs
                                • RtlAllocateHeap.NTDLL(00000000,00434633,?,?,00437437,?,?,00000000,00476B98,?,0040CD5A,00434633,?,?,?,?), ref: 00446D41
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: AllocateHeap
                                • String ID:
                                • API String ID: 1279760036-0
                                • Opcode ID: 3749a47779498ace01023331aee3747b41291c6e2f42b057d41e9a48dde58de8
                                • Instruction ID: 40638bbf90b8c7646580dfe44e72c34c865d7c07d7b9b06d8b79509a7ad90776
                                • Opcode Fuzzy Hash: 3749a47779498ace01023331aee3747b41291c6e2f42b057d41e9a48dde58de8
                                • Instruction Fuzzy Hash: 52E0E5B1B00220A6FB202A6A8C02B5B36498F437B4F070033AC0A9A291CE6CCC4081AF

                                Non-executed Functions

                                Function 00405042 Relevance: 47.5, APIs: 15, Strings: 12, Instructions: 280pipesleepfileCOMMON
                                Download Yara Rule
                                APIs
                                • __Init_thread_footer.LIBCMT ref: 0040508E
                                  • Part of subcall function 004336DA: EnterCriticalSection.KERNEL32(00471D18,00476C18,?,004017C1,00476C18,00000000), ref: 004336E4
                                  • Part of subcall function 004336DA: LeaveCriticalSection.KERNEL32(00471D18,?,004017C1,00476C18,00000000), ref: 00433717
                                  • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                • __Init_thread_footer.LIBCMT ref: 004050CB
                                • CreatePipe.KERNEL32(00476D14,00476CFC,00476C20,00000000,0046656C,00000000), ref: 0040515E
                                • CreatePipe.KERNEL32(00476D00,00476D1C,00476C20,00000000), ref: 00405174
                                • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476C30,00476D04), ref: 004051E7
                                  • Part of subcall function 00433724: EnterCriticalSection.KERNEL32(00471D18,00476B98,00476C18,?,0040179E,00476C18), ref: 0043372F
                                  • Part of subcall function 00433724: LeaveCriticalSection.KERNEL32(00471D18,?,0040179E,00476C18), ref: 0043376C
                                • Sleep.KERNEL32(0000012C,00000093,?), ref: 0040523F
                                • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00405264
                                • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 00405291
                                  • Part of subcall function 00433AB0: __onexit.LIBCMT ref: 00433AB6
                                • WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90,00466570,00000062,00466554), ref: 0040538E
                                • Sleep.KERNEL32(00000064,00000062,00466554), ref: 004053A8
                                • TerminateProcess.KERNEL32(00000000), ref: 004053C1
                                • CloseHandle.KERNEL32 ref: 004053CD
                                • CloseHandle.KERNEL32 ref: 004053D5
                                • CloseHandle.KERNEL32 ref: 004053E7
                                • CloseHandle.KERNEL32 ref: 004053EF
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseCriticalHandleSection$CreatePipe$EnterFileInit_thread_footerLeaveProcessSleep$NamedPeekReadTerminateWrite__onexitsend
                                • String ID: lG$ mG$ mG$ mG$0lG$SystemDrive$cmd.exe$xlG$xlG$xlG$xlG$xlG
                                • API String ID: 3815868655-3731297122
                                • Opcode ID: 3b1e93066ff6eb7a68ae194496a8af3bb6091f8b5c3762708b571a1d6ebd6a82
                                • Instruction ID: f3d75f47542da312923ddfb9c6ddab2c5323933c8a72fe1ed5abf95ef94fff6a
                                • Opcode Fuzzy Hash: 3b1e93066ff6eb7a68ae194496a8af3bb6091f8b5c3762708b571a1d6ebd6a82
                                • Instruction Fuzzy Hash: 3491C571600605AFC610BB65ED42A6F3BAAEB84344F01443FF949A22E2DF7D9C448F6D
                                Function 00406F06 Relevance: 46.3, APIs: 10, Strings: 16, Instructions: 849filesleepCOMMON
                                Download Yara Rule
                                APIs
                                • SetEvent.KERNEL32(?,?), ref: 00406F28
                                • GetFileAttributesW.KERNEL32(00000000,00000000,00000000), ref: 00406FF8
                                • DeleteFileW.KERNEL32(00000000), ref: 00407018
                                  • Part of subcall function 0041B63A: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00474EE0,00000000), ref: 0041B694
                                  • Part of subcall function 0041B63A: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,00474EE0,00000000), ref: 0041B6C6
                                  • Part of subcall function 0041B63A: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,00474EE0,00000000), ref: 0041B717
                                  • Part of subcall function 0041B63A: FindClose.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,00000000), ref: 0041B76C
                                  • Part of subcall function 0041B63A: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,00000000), ref: 0041B773
                                  • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                  • Part of subcall function 00406BE9: CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00466454,?,?,00000000,00407273,00000000,?,0000000A,00000000), ref: 00406C38
                                  • Part of subcall function 00406BE9: WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,000186A0,?,?,?,00000000,00407273,00000000,?,0000000A,00000000), ref: 00406C80
                                  • Part of subcall function 00406BE9: CloseHandle.KERNEL32(00000000,?,?,00000000,00407273,00000000,?,0000000A,00000000,00000000), ref: 00406CC0
                                  • Part of subcall function 00406BE9: MoveFileW.KERNEL32(00000000,00000000), ref: 00406CDD
                                  • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                  • Part of subcall function 00404468: WaitForSingleObject.KERNEL32(?,00000000,00401943,?,?,00000004,?,?,00000004,00476B98,00474EE0,00000000), ref: 0040450E
                                  • Part of subcall function 00404468: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00476B98,00474EE0,00000000,?,?,?,?,?,00401943), ref: 0040453C
                                • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00407416
                                • GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004074F5
                                • SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 0040773A
                                • DeleteFileA.KERNEL32(?), ref: 004078CC
                                  • Part of subcall function 00407A8C: __EH_prolog.LIBCMT ref: 00407A91
                                  • Part of subcall function 00407A8C: FindFirstFileW.KERNEL32(00000000,?,00466AA0,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B4A
                                  • Part of subcall function 00407A8C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B6E
                                • Sleep.KERNEL32(000007D0), ref: 00407976
                                • StrToIntA.SHLWAPI(00000000,00000000), ref: 004079BA
                                  • Part of subcall function 0041BD82: SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041BE77
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: File$Find$AttributesCloseDeleteDirectoryEventFirstNextRemove$CreateDriveExecuteH_prologHandleInfoLocalLogicalMoveObjectParametersShellSingleSleepStringsSystemTimeWaitWritesend
                                • String ID: @PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$VNG$open$pPG$pPG$pPG$pPG$NG
                                • API String ID: 2918587301-3905578539
                                • Opcode ID: 20c7d78b19d968e87728629a0481006c3be70c42959219ad9a8b877735904c4e
                                • Instruction ID: 1d2e2627ec10ef381271a766c0004beadc8049fa085ae304c46d09a1b017b010
                                • Opcode Fuzzy Hash: 20c7d78b19d968e87728629a0481006c3be70c42959219ad9a8b877735904c4e
                                • Instruction Fuzzy Hash: 0F42A271A043005BC614FB76C8979AE76A59F90708F40493FF946771E2EE3CAA09C6DB
                                Function 0041100E Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 238threadCOMMON
                                Download Yara Rule
                                APIs
                                • GetCurrentProcessId.KERNEL32 ref: 0041101D
                                  • Part of subcall function 004128AD: RegCreateKeyA.ADVAPI32(80000001,00000000,TeF), ref: 004128BB
                                  • Part of subcall function 004128AD: RegSetValueExA.ADVAPI32(TeF,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128D6
                                  • Part of subcall function 004128AD: RegCloseKey.ADVAPI32(?,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128E1
                                • OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 00411059
                                • CreateThread.KERNEL32(00000000,00000000,0041170F,00000000,00000000,00000000), ref: 004110BE
                                  • Part of subcall function 0041258F: RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,00000000), ref: 004125AF
                                  • Part of subcall function 0041258F: RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 004125CD
                                  • Part of subcall function 0041258F: RegCloseKey.ADVAPI32(00000000), ref: 004125D8
                                • CloseHandle.KERNEL32(00000000), ref: 00411068
                                  • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 00411332
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseOpen$CreateProcessValue$CurrentHandleLocalMutexQueryThreadTime
                                • String ID: 0TG$Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
                                • API String ID: 65172268-427618296
                                • Opcode ID: cb28f0a685770a7bb9aa9b4a2cd47d633bfbf4b64f7c198ceab7d2c5aa9f6345
                                • Instruction ID: de889ccbd4d484bbc366ed6bf297281231fcf4352047712fae5372da0dd81bf3
                                • Opcode Fuzzy Hash: cb28f0a685770a7bb9aa9b4a2cd47d633bfbf4b64f7c198ceab7d2c5aa9f6345
                                • Instruction Fuzzy Hash: 3D717E3160420157C214FB72CC579AE77A8AF94719F40053FF986A21E2EF7C9A49C6AF
                                Function 0040B335 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 145fileCOMMON
                                Download Yara Rule
                                APIs
                                • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040B3B4
                                • FindClose.KERNEL32(00000000), ref: 0040B3CE
                                • FindNextFileA.KERNEL32(00000000,?), ref: 0040B4F1
                                • FindClose.KERNEL32(00000000), ref: 0040B517
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Find$CloseFile$FirstNext
                                • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                                • API String ID: 1164774033-3681987949
                                • Opcode ID: 5ee5c0f1af5388ca2dfbe0bea83cdc8176ac4b0bb7c2639c980c96f63cf8def1
                                • Instruction ID: 4260ee55bd24f38cfaff6d718e7bb7aae0563b8f0cd35122f003610daf392ab1
                                • Opcode Fuzzy Hash: 5ee5c0f1af5388ca2dfbe0bea83cdc8176ac4b0bb7c2639c980c96f63cf8def1
                                • Instruction Fuzzy Hash: 0A510B319042195ADB14F7A2DC96AEE7764EF50318F50017FF806B30E2EF789A45CA9D
                                Function 0040B53A Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 130fileCOMMON
                                Download Yara Rule
                                APIs
                                • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040B5B2
                                • FindClose.KERNEL32(00000000), ref: 0040B5CC
                                • FindNextFileA.KERNEL32(00000000,?), ref: 0040B68C
                                • FindClose.KERNEL32(00000000), ref: 0040B6B2
                                • FindClose.KERNEL32(00000000), ref: 0040B6D1
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Find$Close$File$FirstNext
                                • String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                • API String ID: 3527384056-432212279
                                • Opcode ID: 9dcc4b99c2d9f04c8bf4a00f65f27e30ed0cf46ac5a5bd153f6ec6dc31a74bb0
                                • Instruction ID: 1e8de758c2b97f43aed4804fc6a56dd8ce4d3e4bc3adeefe5a602588f19c01c2
                                • Opcode Fuzzy Hash: 9dcc4b99c2d9f04c8bf4a00f65f27e30ed0cf46ac5a5bd153f6ec6dc31a74bb0
                                • Instruction Fuzzy Hash: F4412C319042196ACB14F7A5EC569EE7768EE11318F50017FF802B31E2EF399A458A9E
                                Function 00415B5E Relevance: 18.1, APIs: 12, Instructions: 80clipboardmemoryCOMMON
                                Download Yara Rule
                                APIs
                                • OpenClipboard.USER32 ref: 00415B5F
                                • EmptyClipboard.USER32 ref: 00415B6D
                                • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 00415B8D
                                • GlobalLock.KERNEL32(00000000), ref: 00415B96
                                • GlobalUnlock.KERNEL32(00000000), ref: 00415BCC
                                • SetClipboardData.USER32(0000000D,00000000), ref: 00415BD5
                                • CloseClipboard.USER32 ref: 00415BF2
                                • OpenClipboard.USER32 ref: 00415BF9
                                • GetClipboardData.USER32(0000000D), ref: 00415C09
                                • GlobalLock.KERNEL32(00000000), ref: 00415C12
                                • GlobalUnlock.KERNEL32(00000000), ref: 00415C1B
                                • CloseClipboard.USER32 ref: 00415C21
                                  • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                                • String ID:
                                • API String ID: 3520204547-0
                                • Opcode ID: 6b9af2cbf1254059537586e91aa77b3ef0234c6528b2cb703d06502217c30b82
                                • Instruction ID: a6dc46a1ac747b1df6f49b20b287b9a63e2ec98da8de7deae82efe0a0170cbcd
                                • Opcode Fuzzy Hash: 6b9af2cbf1254059537586e91aa77b3ef0234c6528b2cb703d06502217c30b82
                                • Instruction Fuzzy Hash: A82137711047009BC714BBB1DC5AAAF7669AF94B06F00443FF907A61E2EF38C945C76A
                                Function 0040E2F1 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 212processCOMMON
                                Download Yara Rule
                                APIs
                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,?,?,004750FC), ref: 0040E30B
                                • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,004750FC), ref: 0040E336
                                • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040E352
                                • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E3D5
                                • CloseHandle.KERNEL32(00000000,?,?,004750FC), ref: 0040E3E4
                                  • Part of subcall function 004128AD: RegCreateKeyA.ADVAPI32(80000001,00000000,TeF), ref: 004128BB
                                  • Part of subcall function 004128AD: RegSetValueExA.ADVAPI32(TeF,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128D6
                                  • Part of subcall function 004128AD: RegCloseKey.ADVAPI32(?,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128E1
                                • CloseHandle.KERNEL32(00000000,?,?,004750FC), ref: 0040E449
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Close$CreateHandleProcess32$FileFirstModuleNameNextSnapshotToolhelp32Value
                                • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
                                • API String ID: 726551946-1743721670
                                • Opcode ID: ff5471935760bfa23c03b8ab47072f72e23108482f1000ed73ed3016ab4baee1
                                • Instruction ID: 57de327b15d82dbd2eac346b6cac6cdabb084366653080b34320caf9a24139d1
                                • Opcode Fuzzy Hash: ff5471935760bfa23c03b8ab47072f72e23108482f1000ed73ed3016ab4baee1
                                • Instruction Fuzzy Hash: A17150311043419BC714FB62D8529AFB7A5AFD1358F400D3EF986631E2EF389919CA9A
                                Function 0041894A Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 197COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID:
                                • String ID: 0$1$2$3$4$5$6$7
                                • API String ID: 0-3177665633
                                • Opcode ID: 22bb99a780371a774d49d3a24464838894f2a6a600e3afa75ae22eb2fb3ccc4d
                                • Instruction ID: a206eb20bee8e87b23b85030021c48398d73e585fead2f4b7fd4ae1d02439eb2
                                • Opcode Fuzzy Hash: 22bb99a780371a774d49d3a24464838894f2a6a600e3afa75ae22eb2fb3ccc4d
                                • Instruction Fuzzy Hash: EA61D5B4108301AEDB00EF21C862FEA77E4AF95750F44485EF591672E2DF78AA48C797
                                Function 00409B10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 108keyboardthreadCOMMON
                                Download Yara Rule
                                APIs
                                • GetForegroundWindow.USER32 ref: 00409B3F
                                • GetWindowThreadProcessId.USER32(00000000,?), ref: 00409B4B
                                • GetKeyboardLayout.USER32(00000000), ref: 00409B52
                                • GetKeyState.USER32(00000010), ref: 00409B5C
                                • GetKeyboardState.USER32(?), ref: 00409B67
                                • ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 00409B8A
                                • ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 00409BE3
                                • ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 00409C1C
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
                                • String ID: `kG
                                • API String ID: 1888522110-3643241581
                                • Opcode ID: 5f876e4edcc7676504864ee7b950bbe64450831f7ae73bd382a61ad2a6b6deb0
                                • Instruction ID: 5852d3e9e60d78bbc7fecef5f6baa999b7b2ba0a9f64a262714a670a3ee03c46
                                • Opcode Fuzzy Hash: 5f876e4edcc7676504864ee7b950bbe64450831f7ae73bd382a61ad2a6b6deb0
                                • Instruction Fuzzy Hash: 3B318F72504308AFD700DF91DC45FDBB7ECEB88715F01083AB645D61A1DBB5E9488B9A
                                Function 00406764 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 55COMMON
                                Download Yara Rule
                                APIs
                                • _wcslen.LIBCMT ref: 00406788
                                • CoGetObject.OLE32(?,00000024,004669B0,00000000), ref: 004067E9
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Object_wcslen
                                • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                                • API String ID: 240030777-3166923314
                                • Opcode ID: b5b54cfb5efba0feed17686b7da0ed45e48d13faafe04a3d4714bea4931c9802
                                • Instruction ID: 6c9b37094527eb08cc4748ecdfbd23cbc672ad5faa28133fe458ce4522bc368c
                                • Opcode Fuzzy Hash: b5b54cfb5efba0feed17686b7da0ed45e48d13faafe04a3d4714bea4931c9802
                                • Instruction Fuzzy Hash: B11133B29011186ADB10FAA58955A9E77BCDB48714F11047FF905F3281E77C9A0486BD
                                Function 00419AB8 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                                Download Yara Rule
                                APIs
                                • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,00475920), ref: 00419ACE
                                • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 00419B1D
                                • GetLastError.KERNEL32 ref: 00419B2B
                                • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 00419B63
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: EnumServicesStatus$ErrorLastManagerOpen
                                • String ID:
                                • API String ID: 3587775597-0
                                • Opcode ID: 3510b006ff103131d7e734301d5ab056212ac3bf17efa735cd5f14477e097ff7
                                • Instruction ID: 410433f0f292194423399e5208e7b63ee2478b974df0930e3a7ace9da88798fe
                                • Opcode Fuzzy Hash: 3510b006ff103131d7e734301d5ab056212ac3bf17efa735cd5f14477e097ff7
                                • Instruction Fuzzy Hash: C28142311043049BC314FB21DC95DAFB7A8BF94718F50492EF582621D2EF78EA09CB9A
                                Function 0044804A Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370timeCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • _free.LIBCMT ref: 004480CC
                                • _free.LIBCMT ref: 004480F0
                                • _free.LIBCMT ref: 00448277
                                • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045E478), ref: 00448289
                                • WideCharToMultiByte.KERNEL32(00000000,00000000,0047279C,000000FF,00000000,0000003F,00000000,?,?), ref: 00448301
                                • WideCharToMultiByte.KERNEL32(00000000,00000000,004727F0,000000FF,?,0000003F,00000000,?), ref: 0044832E
                                • _free.LIBCMT ref: 00448443
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                • String ID: xE
                                • API String ID: 314583886-407097786
                                • Opcode ID: 98c3260bf7def9ea3e826193bb7d6c86e91b4f4d90c0f5399a9b23083f337053
                                • Instruction ID: 53eab31d398634ed2913b9f897b2f59caf849b5b19a8cc02276c673e3ebcc531
                                • Opcode Fuzzy Hash: 98c3260bf7def9ea3e826193bb7d6c86e91b4f4d90c0f5399a9b23083f337053
                                • Instruction Fuzzy Hash: 24C14731904205ABFB249F698D81AAF7BB8EF41310F2441AFE88497351EF798E42C75C
                                Function 004099E4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65windowCOMMON
                                Download Yara Rule
                                APIs
                                • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00409A01
                                • SetWindowsHookExA.USER32(0000000D,004099D0,00000000), ref: 00409A0F
                                • GetLastError.KERNEL32 ref: 00409A1B
                                  • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00409A6B
                                • TranslateMessage.USER32(?), ref: 00409A7A
                                • DispatchMessageA.USER32(?), ref: 00409A85
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                                • String ID: Keylogger initialization failure: error $`#v
                                • API String ID: 3219506041-3226811161
                                • Opcode ID: 838c04a42e3fa76ba13649f2f72e9fa75c17a0b7b67e72b62f7802879ce7e9bb
                                • Instruction ID: 916e88852ed13b3ab14e3660f0b3d121b0d8821096f38c6baae7fa71b0b7a026
                                • Opcode Fuzzy Hash: 838c04a42e3fa76ba13649f2f72e9fa75c17a0b7b67e72b62f7802879ce7e9bb
                                • Instruction Fuzzy Hash: 6D118271604301AFC710BB7A9C4996B77ECAB94B15B10057EFC45E2191EE34DA01CBAA
                                Function 0041B63A Relevance: 13.6, APIs: 9, Instructions: 105fileCOMMON
                                Download Yara Rule
                                APIs
                                • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00474EE0,00000000), ref: 0041B694
                                • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,00474EE0,00000000), ref: 0041B6C6
                                • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00474EE0,00000000), ref: 0041B734
                                • DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00474EE0,00000000), ref: 0041B741
                                  • Part of subcall function 0041B63A: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,00474EE0,00000000), ref: 0041B717
                                • FindClose.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,00000000), ref: 0041B76C
                                • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,00000000), ref: 0041B773
                                • GetLastError.KERNEL32(?,?,?,?,?,?,00474EE0,00000000), ref: 0041B77B
                                • FindClose.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,00000000), ref: 0041B78E
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                                • String ID:
                                • API String ID: 2341273852-0
                                • Opcode ID: efde34e64c866841732902e9cdab88057c95b0ae3d8c091a1d8434bab602889a
                                • Instruction ID: 009c1ade3c0c7cd9a9baeecb78710ce3116f293085b5e5d3e47bbce280e6f24a
                                • Opcode Fuzzy Hash: efde34e64c866841732902e9cdab88057c95b0ae3d8c091a1d8434bab602889a
                                • Instruction Fuzzy Hash: 2931937180521CAACB20E7B19C89FDA777CAF55304F0404EBF515E2181EF799AC4CB69
                                Function 0041301D Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 391registrylibraryloaderCOMMON
                                Download Yara Rule
                                APIs
                                • RegCreateKeyExW.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 004130F2
                                • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 004130FE
                                  • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                • LoadLibraryA.KERNEL32(Shlwapi.dll,SHDeleteKeyW,00000000,00000001), ref: 004132C5
                                • GetProcAddress.KERNEL32(00000000), ref: 004132CC
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: AddressCloseCreateLibraryLoadProcsend
                                • String ID: SHDeleteKeyW$Shlwapi.dll
                                • API String ID: 2127411465-314212984
                                • Opcode ID: f2b9d7219f469e20ed0aaa9d9aa577f1879afdaca84298b6f58ba7a9a1e85655
                                • Instruction ID: 0508f95716d3db9771c6b78d28bd3d55684df0f5bc265fe56362dad8d88080f3
                                • Opcode Fuzzy Hash: f2b9d7219f469e20ed0aaa9d9aa577f1879afdaca84298b6f58ba7a9a1e85655
                                • Instruction Fuzzy Hash: CEB1A371A043006BC614FA76CC979BE76695F9471CF40063FF846B31E2EE7C9A48869B
                                Function 00418E5F Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 245fileCOMMON
                                Download Yara Rule
                                APIs
                                • FindFirstFileW.KERNEL32(00000000,?), ref: 004190B5
                                • FindNextFileW.KERNEL32(00000000,?,?), ref: 00419181
                                  • Part of subcall function 0041B825: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,00403AF3,00466324), ref: 0041B83E
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: File$Find$CreateFirstNext
                                • String ID: PSG$NG$VG$VG
                                • API String ID: 341183262-216422830
                                • Opcode ID: 6b2f9812d83bbda1c847a805ba3d511d1d7b78362aca3fca247fe2c5a67c746b
                                • Instruction ID: 0b04574543ffaf1c42473f802d0f517b04b5d48d9dde9d4f65c428d20583ff9f
                                • Opcode Fuzzy Hash: 6b2f9812d83bbda1c847a805ba3d511d1d7b78362aca3fca247fe2c5a67c746b
                                • Instruction Fuzzy Hash: AF8150315042405AC314FB71C8A6EEF73A8AFD0718F50493FF946671E2EF389A49C69A
                                Function 004515C7 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 188COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,?,?,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B), ref: 004470D3
                                  • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                  • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B,?,00000041,00000000,00000000), ref: 00447147
                                  • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                  • Part of subcall function 004470CF: _free.LIBCMT ref: 0044712E
                                  • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B,?,00000041,00000000,00000000), ref: 0044713B
                                • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 004516D3
                                • IsValidCodePage.KERNEL32(00000000), ref: 0045172E
                                • IsValidLocale.KERNEL32(?,00000001), ref: 0045173D
                                • GetLocaleInfoW.KERNEL32(?,00001001,00443EFC,00000040,?,0044401C,00000055,00000000,?,?,00000055,00000000), ref: 00451785
                                • GetLocaleInfoW.KERNEL32(?,00001002,00443F7C,00000040), ref: 004517A4
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                                • String ID: (E
                                • API String ID: 745075371-542121585
                                • Opcode ID: a84efe1a2cce186fb5bbf2749623e7c2965abdb2206941bc4280497163ca2dcb
                                • Instruction ID: 0c55cced660072bbdea70b00f38c40adf5ab32faa3293abc4b1f14fb3cf6f882
                                • Opcode Fuzzy Hash: a84efe1a2cce186fb5bbf2749623e7c2965abdb2206941bc4280497163ca2dcb
                                • Instruction Fuzzy Hash: EB5193719002059BDB10EFA5CC41BBF77B8AF04706F18056BFD11EB262DB789949CB69
                                Function 0040B21B Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48fileCOMMON
                                Download Yara Rule
                                APIs
                                • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040B257
                                • GetLastError.KERNEL32 ref: 0040B261
                                Strings
                                • UserProfile, xrefs: 0040B227
                                • [Chrome StoredLogins found, cleared!], xrefs: 0040B287
                                • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040B222
                                • [Chrome StoredLogins not found], xrefs: 0040B27B
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: DeleteErrorFileLast
                                • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                                • API String ID: 2018770650-1062637481
                                • Opcode ID: 6e803ae7a0022b18e44729ffa0587c9ab879deb6e92c568688c916ff731c61af
                                • Instruction ID: af3d5975f8ef5736f4e1f689bc2271043fd855ebe8bb8600121af3fad6928989
                                • Opcode Fuzzy Hash: 6e803ae7a0022b18e44729ffa0587c9ab879deb6e92c568688c916ff731c61af
                                • Instruction Fuzzy Hash: 5C01D63168010597CA0476B6DC6F8AF3B24E921708B10017FF802731E2FF3A9905C6DE
                                Function 00416C9D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32COMMON
                                Download Yara Rule
                                APIs
                                • GetCurrentProcess.KERNEL32(00000028,?), ref: 00416CAA
                                • OpenProcessToken.ADVAPI32(00000000), ref: 00416CB1
                                • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00416CC3
                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00416CE2
                                • GetLastError.KERNEL32 ref: 00416CE8
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                                • String ID: SeShutdownPrivilege
                                • API String ID: 3534403312-3733053543
                                • Opcode ID: 594fceb9dcf720018193b7af68db4771e8a957862718425d2e1bf0ede3cec24e
                                • Instruction ID: cb90277d3e2bb8506008076be0b211c0c8a285b816e0fe18bd298ac82c07c5c8
                                • Opcode Fuzzy Hash: 594fceb9dcf720018193b7af68db4771e8a957862718425d2e1bf0ede3cec24e
                                • Instruction Fuzzy Hash: EEF0DA75901229BBDB109B91DC4DEEF7EBCEF05656F110065B805B20A2DE748A08CAA5
                                Function 004089A9 Relevance: 9.3, APIs: 6, Instructions: 288fileCOMMON
                                Download Yara Rule
                                APIs
                                • __EH_prolog.LIBCMT ref: 004089AE
                                  • Part of subcall function 004041F1: socket.WS2_32(?,00000001,00000006), ref: 00404212
                                  • Part of subcall function 0040428C: connect.WS2_32(?,?,?), ref: 004042A5
                                • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00408A8D
                                • FindNextFileW.KERNEL32(00000000,?), ref: 00408AE0
                                • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00408AF7
                                  • Part of subcall function 00404468: WaitForSingleObject.KERNEL32(?,00000000,00401943,?,?,00000004,?,?,00000004,00476B98,00474EE0,00000000), ref: 0040450E
                                  • Part of subcall function 00404468: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00476B98,00474EE0,00000000,?,?,?,?,?,00401943), ref: 0040453C
                                  • Part of subcall function 004047EB: WaitForSingleObject.KERNEL32(?,000000FF,00476B98,?,?,00000000,00476B98,004017F3), ref: 004047FD
                                  • Part of subcall function 004047EB: SetEvent.KERNEL32(?,?,?,00000000,00476B98,004017F3), ref: 00404808
                                  • Part of subcall function 004047EB: CloseHandle.KERNEL32(?,?,?,00000000,00476B98,004017F3), ref: 00404811
                                • __CxxThrowException@8.LIBVCRUNTIME ref: 00408DA1
                                  • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Find$CloseEventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsendsocket
                                • String ID:
                                • API String ID: 4043647387-0
                                • Opcode ID: e8c278dc73b7856a92274fdbf0f698f43df35bda8f9d698ab29bb6355b5f103d
                                • Instruction ID: d6647de2ed81915fd1100427b9b1f0ab8477674b12134c2b00fdd843198b9521
                                • Opcode Fuzzy Hash: e8c278dc73b7856a92274fdbf0f698f43df35bda8f9d698ab29bb6355b5f103d
                                • Instruction Fuzzy Hash: 0DA16E719001089BCB14EBA1DD92AEDB779AF54318F10427FF506B71D2EF385E498B98
                                Function 00419DBA Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                                Download Yara Rule
                                APIs
                                • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,?,?,00419A10,00000000,00000000), ref: 00419DC3
                                • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,?,00419A10,00000000,00000000), ref: 00419DD8
                                • CloseServiceHandle.ADVAPI32(00000000,?,?,00419A10,00000000,00000000), ref: 00419DE5
                                • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,?,00419A10,00000000,00000000), ref: 00419DF0
                                • CloseServiceHandle.ADVAPI32(00000000,?,?,00419A10,00000000,00000000), ref: 00419E02
                                • CloseServiceHandle.ADVAPI32(00000000,?,?,00419A10,00000000,00000000), ref: 00419E05
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Service$CloseHandle$Open$ManagerStart
                                • String ID:
                                • API String ID: 276877138-0
                                • Opcode ID: e86b345e645e90309e83cb8a90fb8247b1eb57cac26ee154ae962e61cbabfd9a
                                • Instruction ID: bfab90d9ddd5c2d56401b7e15998ac1c6a079cb4321381bf248b2ffa9e014974
                                • Opcode Fuzzy Hash: e86b345e645e90309e83cb8a90fb8247b1eb57cac26ee154ae962e61cbabfd9a
                                • Instruction Fuzzy Hash: 60F0E9715403146FD2115B31EC88DBF2A6CDF85BB2B01002EF442A3191CF78CD4995B5
                                Function 00450C8F Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,?,?,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B), ref: 004470D3
                                  • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                  • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B,?,00000041,00000000,00000000), ref: 00447147
                                  • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00443F03,?,?,?,?,?,?,00000004), ref: 00450D71
                                • _wcschr.LIBVCRUNTIME ref: 00450E01
                                • _wcschr.LIBVCRUNTIME ref: 00450E0F
                                • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,00443F03,00000000,00444023), ref: 00450EB2
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
                                • String ID: (E
                                • API String ID: 4212172061-542121585
                                • Opcode ID: 59e7985f3c02f7c10489d8edf0480172058bbcb387fbadea5ac0dcfc1ce8ddaa
                                • Instruction ID: 16e6850baad922d2e300dda2121b2fdf61a8ef58a3873fa5b3432b878cecddba
                                • Opcode Fuzzy Hash: 59e7985f3c02f7c10489d8edf0480172058bbcb387fbadea5ac0dcfc1ce8ddaa
                                • Instruction Fuzzy Hash: A361FC7A500306AAD725AB75CC42ABB73A8EF44316F14082FFD05D7243EB78E949C769
                                Function 00415A51 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97libraryloadershutdownCOMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 00416C9D: GetCurrentProcess.KERNEL32(00000028,?), ref: 00416CAA
                                  • Part of subcall function 00416C9D: OpenProcessToken.ADVAPI32(00000000), ref: 00416CB1
                                  • Part of subcall function 00416C9D: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00416CC3
                                  • Part of subcall function 00416C9D: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00416CE2
                                  • Part of subcall function 00416C9D: GetLastError.KERNEL32 ref: 00416CE8
                                • ExitWindowsEx.USER32(00000000,00000001), ref: 00415AF3
                                • LoadLibraryA.KERNEL32(PowrProf.dll,SetSuspendState,00000000,00000000,00000000), ref: 00415B08
                                • GetProcAddress.KERNEL32(00000000), ref: 00415B0F
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                                • String ID: PowrProf.dll$SetSuspendState
                                • API String ID: 1589313981-1420736420
                                • Opcode ID: 30826b9ea286917c39706bece02ca5451a5fbf857c9dc2056e1e07071d6a19c3
                                • Instruction ID: be3657bdb4b9c596b700244bf1edaf45c421fe256a6f88bebcc25452880e9c8a
                                • Opcode Fuzzy Hash: 30826b9ea286917c39706bece02ca5451a5fbf857c9dc2056e1e07071d6a19c3
                                • Instruction Fuzzy Hash: 84215E71644741A6CB14FBB198A6AFF22599F80748F40483FB442771D2EF7CE889865E
                                Function 0040E627 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 0041258F: RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,00000000), ref: 004125AF
                                  • Part of subcall function 0041258F: RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 004125CD
                                  • Part of subcall function 0041258F: RegCloseKey.ADVAPI32(00000000), ref: 004125D8
                                • Sleep.KERNEL32(00000BB8), ref: 0040E6DB
                                • ExitProcess.KERNEL32 ref: 0040E74A
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseExitOpenProcessQuerySleepValue
                                • String ID: 6.0.0 Pro$override$pth_unenc
                                • API String ID: 2281282204-4012039065
                                • Opcode ID: 0f39cd54224a31741258e188e9d7a1f7f9a1c6686367da54b0b8e4ff16b00178
                                • Instruction ID: 41eca1b412dc6cb4cbd69e66e1420b1d2a9bda06de9f36a729d5cd10817e4b5d
                                • Opcode Fuzzy Hash: 0f39cd54224a31741258e188e9d7a1f7f9a1c6686367da54b0b8e4ff16b00178
                                • Instruction Fuzzy Hash: A821D131F1420027D60876778857B6F399A9B81719F90052EF819A72E7EEBD9E1083DF
                                Function 004513F3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,00451712,?,00000000), ref: 0045148C
                                • GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,00451712,?,00000000), ref: 004514B5
                                • GetACP.KERNEL32(?,?,00451712,?,00000000), ref: 004514CA
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: InfoLocale
                                • String ID: ACP$OCP
                                • API String ID: 2299586839-711371036
                                • Opcode ID: 7de529321666405c3dbd177549b20e94864b34fdb637d578d31b634f87125a95
                                • Instruction ID: 27270ea0035267e4249f05f4639a08e7e92d7e6a6a5113c6df6fa5280cb26525
                                • Opcode Fuzzy Hash: 7de529321666405c3dbd177549b20e94864b34fdb637d578d31b634f87125a95
                                • Instruction Fuzzy Hash: 0821C731600100B7DB308F54C901FA773A6AF52B67F5A9566EC0AD7223EB3ADD49C399
                                Function 0041A84A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                Download Yara Rule
                                APIs
                                • FindResourceA.KERNEL32(SETTINGS,0000000A,00000000), ref: 0041A85B
                                • LoadResource.KERNEL32(00000000,?,?,0040E25B,00000000), ref: 0041A86F
                                • LockResource.KERNEL32(00000000,?,?,0040E25B,00000000), ref: 0041A876
                                • SizeofResource.KERNEL32(00000000,?,?,0040E25B,00000000), ref: 0041A885
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Resource$FindLoadLockSizeof
                                • String ID: SETTINGS
                                • API String ID: 3473537107-594951305
                                • Opcode ID: af91fd7a50235684c3f0857021386823e2c7131a01440ecb0520647964aa65c6
                                • Instruction ID: 1fe06f9b0c9a023904624b9b61caa7bd4c13f92b8b5c35c0d543cfa28092256f
                                • Opcode Fuzzy Hash: af91fd7a50235684c3f0857021386823e2c7131a01440ecb0520647964aa65c6
                                • Instruction Fuzzy Hash: DAE01A76240720ABCB211BA1BD4CD073E39F7867637000039F549A2221CE75CC52CB29
                                Function 00407A8C Relevance: 7.7, APIs: 5, Instructions: 183fileCOMMON
                                Download Yara Rule
                                APIs
                                • __EH_prolog.LIBCMT ref: 00407A91
                                • FindFirstFileW.KERNEL32(00000000,?,00466AA0,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B4A
                                • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B6E
                                • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407C76
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Find$File$CloseFirstH_prologNext
                                • String ID:
                                • API String ID: 1157919129-0
                                • Opcode ID: 9c8ca443f093e1d74b31c981bd859bd21b05936b42f21948fb880635b3f6fc4b
                                • Instruction ID: e1cc7e471fba1e38487cd482a49156f4879f85d64aa43a49cb1f79655cfb0c65
                                • Opcode Fuzzy Hash: 9c8ca443f093e1d74b31c981bd859bd21b05936b42f21948fb880635b3f6fc4b
                                • Instruction Fuzzy Hash: 325162729001085ACB14FBA5DD969ED7B78AF50318F50417FB806B31D2EF3CAB498B99
                                Function 00406128 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                                Download Yara Rule
                                APIs
                                • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406234
                                • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 00406318
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: DownloadExecuteFileShell
                                • String ID: C:\Users\user\Desktop\Material Requirments.pif.exe$open
                                • API String ID: 2825088817-3037481641
                                • Opcode ID: 6287b0586cbb289bb444097dceff6d580084b6a589887e880c419046f190039f
                                • Instruction ID: e32f65eb076a11421f0b28df520d432f118a03887cfea0ef8c7e4d0a3f62d172
                                • Opcode Fuzzy Hash: 6287b0586cbb289bb444097dceff6d580084b6a589887e880c419046f190039f
                                • Instruction Fuzzy Hash: E361CF3160430067CA14FA76D8569BE37A59F81718F01493FBC46772E6EF3CAA05C69B
                                Function 00406AC2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                                Download Yara Rule
                                APIs
                                • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00406ADD
                                • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00406BA5
                                  • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: FileFind$FirstNextsend
                                • String ID: pPG$pPG
                                • API String ID: 4113138495-3204143781
                                • Opcode ID: 2e9ae0b7e9190ad95278273942c8401612e77b78bc4d77a242feb02d348533f5
                                • Instruction ID: b94dab712156e78be0f8cc3bef15d45c6a114b58aade1ae888b20ae253cfdc5a
                                • Opcode Fuzzy Hash: 2e9ae0b7e9190ad95278273942c8401612e77b78bc4d77a242feb02d348533f5
                                • Instruction Fuzzy Hash: F42187715043015BC714FB61DC95DEF77A8AF90318F40093EF996A31E1EF38AA08CA9A
                                Function 0041BD82 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                                Download Yara Rule
                                APIs
                                • SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041BE77
                                  • Part of subcall function 004127AA: RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,004665B0), ref: 004127B9
                                  • Part of subcall function 004127AA: RegSetValueExA.ADVAPI32(004665B0,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0041BE51,WallpaperStyle,004665B0,00000001,00474EE0,00000000), ref: 004127E1
                                  • Part of subcall function 004127AA: RegCloseKey.ADVAPI32(004665B0,?,?,0041BE51,WallpaperStyle,004665B0,00000001,00474EE0,00000000,?,004079DD,00000001), ref: 004127EC
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseCreateInfoParametersSystemValue
                                • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                                • API String ID: 4127273184-3576401099
                                • Opcode ID: 2d3493454e262f3515024853f455386b3a69767c6923c1b92277856bed51226b
                                • Instruction ID: 3b74369dcb7a8544f1b55df16a592c3d868ba554001bd6a4c71ed5c97b6fc17b
                                • Opcode Fuzzy Hash: 2d3493454e262f3515024853f455386b3a69767c6923c1b92277856bed51226b
                                • Instruction Fuzzy Hash: F5112132B8035033D518313A5E67BBF2816D34AB60F55415FB6066A6CAFADE4AA103DF
                                Function 00408DA7 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON
                                Download Yara Rule
                                APIs
                                • __EH_prolog.LIBCMT ref: 00408DAC
                                • FindFirstFileW.KERNEL32(00000000,?), ref: 00408E24
                                • FindNextFileW.KERNEL32(00000000,?), ref: 00408E4D
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: FileFind$FirstH_prologNext
                                • String ID:
                                • API String ID: 301083792-0
                                • Opcode ID: 169026de76200cf443d3f17a25961bb159ed2710e845ee18da41074ca456c7f2
                                • Instruction ID: 402ed7a5658d2f2a6adb961a0daa6f616ba37c5e7974c2bf040f6c8ce137202a
                                • Opcode Fuzzy Hash: 169026de76200cf443d3f17a25961bb159ed2710e845ee18da41074ca456c7f2
                                • Instruction Fuzzy Hash: 127141728001199BCB15EBA1DC919EE7778AF54314F10427FE846B71E2EF385E49CB98
                                Function 0045107A Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,?,?,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B), ref: 004470D3
                                  • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                  • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B,?,00000041,00000000,00000000), ref: 00447147
                                  • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                  • Part of subcall function 004470CF: _free.LIBCMT ref: 0044712E
                                  • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B,?,00000041,00000000,00000000), ref: 0044713B
                                • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004510CE
                                • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0045111F
                                • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004511DF
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ErrorInfoLastLocale$_free$_abort
                                • String ID:
                                • API String ID: 2829624132-0
                                • Opcode ID: dd837d4aabf90151236531eaa8a7eeaa8db7e820d6096a7a5c305d7033fab590
                                • Instruction ID: aee342ac21436657f5846041838c3bd09d84a4d920a4c2a145562aed062da8a9
                                • Opcode Fuzzy Hash: dd837d4aabf90151236531eaa8a7eeaa8db7e820d6096a7a5c305d7033fab590
                                • Instruction Fuzzy Hash: F661D8719005079BDB289F25CC82B7677A8EF04306F1041BBFD05D66A2EB78D949DB58
                                Function 0043A86D Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0043A965
                                • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0043A96F
                                • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0043A97C
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                • String ID:
                                • API String ID: 3906539128-0
                                • Opcode ID: af6e046c0509c32b3386d0bc76265e00dd1467fe013a3816057f721e951f2d82
                                • Instruction ID: 2e36d9e0b5662236be867d7d52d6a22dc3a0b47d07fc7de068387a758ceea7c7
                                • Opcode Fuzzy Hash: af6e046c0509c32b3386d0bc76265e00dd1467fe013a3816057f721e951f2d82
                                • Instruction Fuzzy Hash: E731D6B491131CABCB21DF24D98978DB7B8BF08311F5051EAE80CA7251EB749F818F49
                                Function 00432B45 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                                Download Yara Rule
                                APIs
                                • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,00000001,004328CD,00000024,?,?,?), ref: 00432B57
                                • CryptGenRandom.ADVAPI32(?,?,?,?,?,?,?,?,?,0042CDC9,?), ref: 00432B6D
                                • CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?,?,0042CDC9,?), ref: 00432B7F
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Crypt$Context$AcquireRandomRelease
                                • String ID:
                                • API String ID: 1815803762-0
                                • Opcode ID: 35a60dd61fd8b237ab80bed8c3b3b6d5f5cecafcaafe6d2ae27acd69f3d7963f
                                • Instruction ID: 69441ad90531868046e0b1178e1924530c202fcb63ed7aa5228c64bcbe668f15
                                • Opcode Fuzzy Hash: 35a60dd61fd8b237ab80bed8c3b3b6d5f5cecafcaafe6d2ae27acd69f3d7963f
                                • Instruction Fuzzy Hash: ADE09231608350FFFB300F25AC08F177B94EB89B65F21063AF155E40E4CAA59805961C
                                Function 00442764 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • GetCurrentProcess.KERNEL32(?,?,0044273A,?), ref: 00442785
                                • TerminateProcess.KERNEL32(00000000,?,0044273A,?), ref: 0044278C
                                • ExitProcess.KERNEL32 ref: 0044279E
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Process$CurrentExitTerminate
                                • String ID:
                                • API String ID: 1703294689-0
                                • Opcode ID: 580307e7f9ed19ccdf9c10412063d8ea8bc62da0884c48fe7532ae208af4f440
                                • Instruction ID: c8bd48e99420b6c7b8697c64d03bd4ba31791432aa3bec6fd876c0c539ce8582
                                • Opcode Fuzzy Hash: 580307e7f9ed19ccdf9c10412063d8ea8bc62da0884c48fe7532ae208af4f440
                                • Instruction Fuzzy Hash: 7EE04F31000704AFEF016F10DD099493F29EF50396F448469F90896132CF79DC42CA48
                                Function 0044D7F9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID:
                                • String ID: .
                                • API String ID: 0-248832578
                                • Opcode ID: 90d0b4729825bd90b6a9b0e481f721cabe6d10aefd9ef70f2d231800c5ca14c4
                                • Instruction ID: eafca5d3f29716c6c78e4e4ea3ad02361a474eaab44c7f235df41bcab4a95e78
                                • Opcode Fuzzy Hash: 90d0b4729825bd90b6a9b0e481f721cabe6d10aefd9ef70f2d231800c5ca14c4
                                • Instruction Fuzzy Hash: 3431F472D00249ABEB249E79CC85EFB7BBDDB85314F0401AEF419D7251E6349E418B54
                                Function 004477A7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,?,?,00000004), ref: 004477FA
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: InfoLocale
                                • String ID: GetLocaleInfoEx
                                • API String ID: 2299586839-2904428671
                                • Opcode ID: 6bd799bfac9af36fd133eb5d72b5b36b41e76e7aabeb18fd4f2c376b7933ddb9
                                • Instruction ID: 58a0a1dc03b065be57d87c6409a63545e464c60cfee5b8c381720ea1698dad41
                                • Opcode Fuzzy Hash: 6bd799bfac9af36fd133eb5d72b5b36b41e76e7aabeb18fd4f2c376b7933ddb9
                                • Instruction Fuzzy Hash: A0F0F631640318B7DB056F61CC06F6E7B64DB04712F10019AFC0467252CF75AB119A9D
                                Function 004512CA Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,?,?,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B), ref: 004470D3
                                  • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                  • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B,?,00000041,00000000,00000000), ref: 00447147
                                  • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                  • Part of subcall function 004470CF: _free.LIBCMT ref: 0044712E
                                  • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B,?,00000041,00000000,00000000), ref: 0044713B
                                • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0045131E
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ErrorLast$_free$InfoLocale_abort
                                • String ID:
                                • API String ID: 1663032902-0
                                • Opcode ID: bc85fdc09d4fce3dfbe50538f39d64f32c4b6099e2a05669c9b1daebb1f6e385
                                • Instruction ID: 0b21b5069fbf1db5bec531630a8d3eee6f1f474d64bb54c6a1c44a3d8e2cc721
                                • Opcode Fuzzy Hash: bc85fdc09d4fce3dfbe50538f39d64f32c4b6099e2a05669c9b1daebb1f6e385
                                • Instruction Fuzzy Hash: 2221D372501206ABEB24AB25CC61B7B77ACEB04316F10017BFD01D6663EB78AD49CB58
                                Function 00450F52 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,?,?,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B), ref: 004470D3
                                  • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                  • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B,?,00000041,00000000,00000000), ref: 00447147
                                  • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                • EnumSystemLocalesW.KERNEL32(0045107A,00000001,00000000,?,00443EFC,?,004516A7,00000000,?,?,?), ref: 00450FC4
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                • String ID:
                                • API String ID: 1084509184-0
                                • Opcode ID: 2806d9e87b91580947c38d8a0617f63d2b95e775220bf3e675df36a013b02c7b
                                • Instruction ID: 451a354658792f2252a151bea30e2a99c0585190810680eeac5085bd3c0c80bb
                                • Opcode Fuzzy Hash: 2806d9e87b91580947c38d8a0617f63d2b95e775220bf3e675df36a013b02c7b
                                • Instruction Fuzzy Hash: FD11293B2007019FDB28AF39C8916BABB92FF8435AB14442DE94747B41D7B9B847C744
                                Function 004514FA Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,?,?,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B), ref: 004470D3
                                  • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                  • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B,?,00000041,00000000,00000000), ref: 00447147
                                  • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00451298,00000000,00000000,?), ref: 00451526
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ErrorLast$InfoLocale_abort_free
                                • String ID:
                                • API String ID: 2692324296-0
                                • Opcode ID: e61a00dc03fcb481ae1f4eaad0348555d58099959c5ffac150b0217cf8aecc77
                                • Instruction ID: d2fe2c3fce417e68b0623dfb5eb434355baf81d8c10f12b7a8aa08190ad777f0
                                • Opcode Fuzzy Hash: e61a00dc03fcb481ae1f4eaad0348555d58099959c5ffac150b0217cf8aecc77
                                • Instruction Fuzzy Hash: 4AF0F9326102197BDB289A258C46BBB7758EB80755F04046AEC07A3251FA78FD45C6D4
                                Function 00450FED Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,?,?,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B), ref: 004470D3
                                  • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                  • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B,?,00000041,00000000,00000000), ref: 00447147
                                  • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                • EnumSystemLocalesW.KERNEL32(004512CA,00000001,?,?,00443EFC,?,0045166B,00443EFC,?,?,?,?,?,00443EFC,?,?), ref: 00451039
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                • String ID:
                                • API String ID: 1084509184-0
                                • Opcode ID: 1383e35cddf71846be5f04bfb451628eb58ff654fdb94fb85b79533aadb6d968
                                • Instruction ID: 969c50ee721750b2a7664082bdad3607fc28c6e2ba06475257799e5d9796a5a7
                                • Opcode Fuzzy Hash: 1383e35cddf71846be5f04bfb451628eb58ff654fdb94fb85b79533aadb6d968
                                • Instruction Fuzzy Hash: 19F028363003045FDB245F76DC81B7B7B95EF8075DF04442EFD4187A92D6B99C828604
                                Function 0041A9AD Relevance: 1.5, APIs: 1, Instructions: 40COMMON
                                Download Yara Rule
                                APIs
                                • GetUserNameW.ADVAPI32(?,0040E096), ref: 0041A9E2
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: NameUser
                                • String ID:
                                • API String ID: 2645101109-0
                                • Opcode ID: f5195ddae15c7d34c300528ec03d286bb21d05f767aca0bcb2c6ffa1c941d70b
                                • Instruction ID: dd4171341b6269d20eef4dfb17ad31a68228dcd82fcdc0eb213b330dd994abd5
                                • Opcode Fuzzy Hash: f5195ddae15c7d34c300528ec03d286bb21d05f767aca0bcb2c6ffa1c941d70b
                                • Instruction Fuzzy Hash: 16014F7290011CAADB00EB90DC49ADDBB7CEF44315F10016AB502B3195EFB4AB898A98
                                Function 004472BE Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 00444CDC: EnterCriticalSection.KERNEL32(?,?,0044246B,00000000,0046EAD0,0000000C,00442426,?,?,?,00448949,?,?,00447184,00000001,00000364), ref: 00444CEB
                                • EnumSystemLocalesW.KERNEL32(00447278,00000001,0046EC58,0000000C), ref: 004472F6
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CriticalEnterEnumLocalesSectionSystem
                                • String ID:
                                • API String ID: 1272433827-0
                                • Opcode ID: ce5d864c7127ce76761e0cbea026e968eb5e88cd2d94c9e55423b39c5525c7e8
                                • Instruction ID: acebf021cc54f47487df9b00313a15cc1bfd22b3d47c3c45ccbcf72c34342655
                                • Opcode Fuzzy Hash: ce5d864c7127ce76761e0cbea026e968eb5e88cd2d94c9e55423b39c5525c7e8
                                • Instruction Fuzzy Hash: 97F06236620200DFEB10EF79DE46B5D37E0EB44715F10816AF414DB2A1CBB89981DB4D
                                Function 00450F07 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,?,?,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B), ref: 004470D3
                                  • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                  • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B,?,00000041,00000000,00000000), ref: 00447147
                                  • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                • EnumSystemLocalesW.KERNEL32(00450E5E,00000001,?,?,?,004516C9,00443EFC,?,?,?,?,?,00443EFC,?,?,?), ref: 00450F3E
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                • String ID:
                                • API String ID: 1084509184-0
                                • Opcode ID: c0752d91e59c0ec8caa35cedbb84099f1f2f8e555a7fabae98b3644acfac0ab5
                                • Instruction ID: 7585e2e2e927d60b614fbbb7cbec4ece609ea7599c31e6a5607aeddcbc8761df
                                • Opcode Fuzzy Hash: c0752d91e59c0ec8caa35cedbb84099f1f2f8e555a7fabae98b3644acfac0ab5
                                • Instruction Fuzzy Hash: 89F0E53A30020557CB28AF35D845B6A7F94EFC1715B16449EFE098B252C67AD886C794
                                Function 0040E751 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                Download Yara Rule
                                APIs
                                • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,004146BA,00474EE0,00475A38,00474EE0,00000000,00474EE0,?,00474EE0,6.0.0 Pro), ref: 0040E765
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: InfoLocale
                                • String ID:
                                • API String ID: 2299586839-0
                                • Opcode ID: ff82ce7bf407c802d293f31a31b0080957453d6e74de6d4842115703ee3f00be
                                • Instruction ID: 426317967f55bc2b8d076a22fb2a8dcf1c85f3a8f112093483d3870effb55d88
                                • Opcode Fuzzy Hash: ff82ce7bf407c802d293f31a31b0080957453d6e74de6d4842115703ee3f00be
                                • Instruction Fuzzy Hash: A6D05E607002197BEA109691CC0AE9B7A9CE700B66F000165BA01E72C0E9A0AF048AE1
                                Function 00433EE2 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                Download Yara Rule
                                APIs
                                • SetUnhandledExceptionFilter.KERNEL32(Function_00033EEE,00433BBC), ref: 00433EE7
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ExceptionFilterUnhandled
                                • String ID:
                                • API String ID: 3192549508-0
                                • Opcode ID: e588410f7d772084ad9b5e6a201b2d06307ba3208cc6e1757a1b1bd45e9a1e30
                                • Instruction ID: 9bcc487b38fe881941be7e97ad5738302595bcb4dafebc2e14986f4c0a09dd7d
                                • Opcode Fuzzy Hash: e588410f7d772084ad9b5e6a201b2d06307ba3208cc6e1757a1b1bd45e9a1e30
                                • Instruction Fuzzy Hash:
                                Function 0044EB3E Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: HeapProcess
                                • String ID:
                                • API String ID: 54951025-0
                                • Opcode ID: 92e8274eb45f99ac31ca5a7841fd9c067bc26919afa491827186e59168ab32af
                                • Instruction ID: 07883168748708d5871df038b293f30180ed36dce4f2d3eb69edcdcf819b44e4
                                • Opcode Fuzzy Hash: 92e8274eb45f99ac31ca5a7841fd9c067bc26919afa491827186e59168ab32af
                                • Instruction Fuzzy Hash: 8EA01130202202CBA3008F32AB0A20A3BA8AA00AA23028038A00AC02A0EE2080808A08
                                Function 00418195 Relevance: 51.1, APIs: 28, Strings: 1, Instructions: 324windowmemoryCOMMON
                                Download Yara Rule
                                APIs
                                • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004181AF
                                • CreateCompatibleDC.GDI32(00000000), ref: 004181BA
                                  • Part of subcall function 00418648: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00418678
                                • CreateCompatibleBitmap.GDI32(?,00000000), ref: 0041823B
                                • DeleteDC.GDI32(?), ref: 00418253
                                • DeleteDC.GDI32(00000000), ref: 00418256
                                • SelectObject.GDI32(00000000,00000000), ref: 00418261
                                • StretchBlt.GDI32(00000000,00000000,00000000,00000000,?,?,?,?,00000000,?,00CC0020), ref: 00418289
                                • GetIconInfo.USER32(?,?), ref: 004182C1
                                • DeleteObject.GDI32(?), ref: 004182F0
                                • DeleteObject.GDI32(?), ref: 004182FD
                                • DrawIcon.USER32(00000000,?,?,?), ref: 0041830A
                                • BitBlt.GDI32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00660046), ref: 0041833A
                                • GetObjectA.GDI32(?,00000018,?), ref: 00418369
                                • LocalAlloc.KERNEL32(00000040,00000028), ref: 004183B2
                                • LocalAlloc.KERNEL32(00000040,00000001), ref: 004183D5
                                • GlobalAlloc.KERNEL32(00000000,?), ref: 0041843E
                                • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00418461
                                • DeleteDC.GDI32(?), ref: 00418475
                                • DeleteDC.GDI32(00000000), ref: 00418478
                                • DeleteObject.GDI32(00000000), ref: 0041847B
                                • GlobalFree.KERNEL32(00CC0020), ref: 00418486
                                • DeleteObject.GDI32(00000000), ref: 0041853A
                                • GlobalFree.KERNEL32(?), ref: 00418541
                                • DeleteDC.GDI32(?), ref: 00418551
                                • DeleteDC.GDI32(00000000), ref: 0041855C
                                • DeleteDC.GDI32(?), ref: 0041858E
                                • DeleteDC.GDI32(00000000), ref: 00418591
                                • DeleteObject.GDI32(?), ref: 00418597
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Delete$Object$AllocCreateGlobal$CompatibleFreeIconLocal$BitmapBitsDisplayDrawEnumInfoSelectSettingsStretch
                                • String ID: DISPLAY
                                • API String ID: 1765752176-865373369
                                • Opcode ID: 5659f36c14f58d87aad76544980ee93a241d23a17f053f78e3145603317d738a
                                • Instruction ID: a1654617e6feb41a21483335bab58d6c80918fdf06c9fa75f2eb3c48c5790805
                                • Opcode Fuzzy Hash: 5659f36c14f58d87aad76544980ee93a241d23a17f053f78e3145603317d738a
                                • Instruction Fuzzy Hash: EFC16C31504344AFD7209F21CC44BABBBE9EF88751F44482EF989A32A1DF34E945CB5A
                                Function 0041742B Relevance: 49.3, APIs: 22, Strings: 6, Instructions: 290libraryloaderthreadCOMMON
                                Download Yara Rule
                                APIs
                                • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00417472
                                • GetProcAddress.KERNEL32(00000000), ref: 00417475
                                • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 00417486
                                • GetProcAddress.KERNEL32(00000000), ref: 00417489
                                • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041749A
                                • GetProcAddress.KERNEL32(00000000), ref: 0041749D
                                • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 004174AE
                                • GetProcAddress.KERNEL32(00000000), ref: 004174B1
                                • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00417552
                                • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041756A
                                • GetThreadContext.KERNEL32(?,00000000), ref: 00417580
                                • ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 004175A6
                                • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00417626
                                • TerminateProcess.KERNEL32(?,00000000), ref: 0041763A
                                • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00417671
                                • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0041773E
                                • SetThreadContext.KERNEL32(?,00000000), ref: 0041775B
                                • ResumeThread.KERNEL32(?), ref: 00417768
                                • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00417780
                                • GetCurrentProcess.KERNEL32(?), ref: 0041778B
                                • TerminateProcess.KERNEL32(?,00000000), ref: 004177A5
                                • GetLastError.KERNEL32 ref: 004177AD
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
                                • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$`#v$ntdll
                                • API String ID: 4188446516-108836778
                                • Opcode ID: ca58d074774f4cb3cec8caed2bdcc8ae3fb1cd477b48ba63cf2103ffe40dc484
                                • Instruction ID: 9d7e092ec3b05a7a521957261ed1896ff906ab06cfb84d00d3f911d9ff722cfe
                                • Opcode Fuzzy Hash: ca58d074774f4cb3cec8caed2bdcc8ae3fb1cd477b48ba63cf2103ffe40dc484
                                • Instruction Fuzzy Hash: C3A16D71508304AFD710DF65CD89B6B7BF8FB48345F00082EF699962A1DB75E884CB6A
                                Function 0040C28E Relevance: 47.5, APIs: 6, Strings: 21, Instructions: 282registryCOMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 00411771: TerminateProcess.KERNEL32(00000000,?,0040C67D), ref: 00411781
                                  • Part of subcall function 00411771: WaitForSingleObject.KERNEL32(000000FF,?,0040C67D), ref: 00411794
                                • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040C38B
                                • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040C39E
                                • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040C3B7
                                • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040C3E7
                                  • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(004099A9,00000000,00000000,?,0040C2B0,?,00000000), ref: 0040AFC9
                                  • Part of subcall function 0040AFBA: UnhookWindowsHookEx.USER32(00475108), ref: 0040AFD5
                                  • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(00409993,00000000,?,0040C2B0,?,00000000), ref: 0040AFE3
                                  • Part of subcall function 0041B79A: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041B8B0,00000000,00000000,00000000), ref: 0041B7D9
                                • ShellExecuteW.SHELL32(00000000,open,00000000,00466900,00466900,00000000), ref: 0040C632
                                • ExitProcess.KERNEL32 ref: 0040C63E
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                • String ID: SG$ SG$ SG$""", 0$")$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$PSG$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                                • API String ID: 1861856835-1415323999
                                • Opcode ID: d97240247ac226db69a3a2bbe58a8d24045e0baf2dc6ee3fc0b26a83310237f8
                                • Instruction ID: 61d23169d088639e971774d7266815e56d2523c1fe05d3951d40341dc357c42d
                                • Opcode Fuzzy Hash: d97240247ac226db69a3a2bbe58a8d24045e0baf2dc6ee3fc0b26a83310237f8
                                • Instruction Fuzzy Hash: F891A3316042005AC314FB21D852AAF7799AF90318F50453FF88AB71E2EF7CAD49C69E
                                Function 0040BF04 Relevance: 44.0, APIs: 6, Strings: 19, Instructions: 260registryCOMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 00411771: TerminateProcess.KERNEL32(00000000,?,0040C67D), ref: 00411781
                                  • Part of subcall function 00411771: WaitForSingleObject.KERNEL32(000000FF,?,0040C67D), ref: 00411794
                                • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,00475308,?,pth_unenc), ref: 0040C013
                                • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040C026
                                • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,00475308,?,pth_unenc), ref: 0040C056
                                • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,00475308,?,pth_unenc), ref: 0040C065
                                  • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(004099A9,00000000,00000000,?,0040C2B0,?,00000000), ref: 0040AFC9
                                  • Part of subcall function 0040AFBA: UnhookWindowsHookEx.USER32(00475108), ref: 0040AFD5
                                  • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(00409993,00000000,?,0040C2B0,?,00000000), ref: 0040AFE3
                                  • Part of subcall function 0041AD43: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,00403A40), ref: 0041AD6A
                                • ShellExecuteW.SHELL32(00000000,open,00000000,00466900,00466900,00000000), ref: 0040C280
                                • ExitProcess.KERNEL32 ref: 0040C287
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                • String ID: SG$ SG$")$.vbs$On Error Resume Next$PSG$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$pth_unenc$wend$while fso.FileExists("
                                • API String ID: 3797177996-899740633
                                • Opcode ID: efcf010fa8cf7d0721cf0bfb300c9e65f4e72c4c08afdf4bcbbc236f7cd5d0b7
                                • Instruction ID: 3970d62be7f9f5e1fdb580af11360c5c0218cddba346a3e39168d22276c4a34b
                                • Opcode Fuzzy Hash: efcf010fa8cf7d0721cf0bfb300c9e65f4e72c4c08afdf4bcbbc236f7cd5d0b7
                                • Instruction Fuzzy Hash: 838194316042005BC315FB21D852AAF7799AF91708F10453FF986A72E2EF7C9D49C69E
                                Function 0041138D Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 189synchronizationsleepfileCOMMON
                                Download Yara Rule
                                APIs
                                • CreateMutexA.KERNEL32(00000000,00000001,00000000,00475308,?,00000000), ref: 004113AC
                                • ExitProcess.KERNEL32 ref: 004115F5
                                  • Part of subcall function 00412735: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?,00000208), ref: 00412751
                                  • Part of subcall function 00412735: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 0041276A
                                  • Part of subcall function 00412735: RegCloseKey.ADVAPI32(?), ref: 00412775
                                  • Part of subcall function 0041B825: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,00403AF3,00466324), ref: 0041B83E
                                • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,?,00000000), ref: 00411433
                                • OpenProcess.KERNEL32(00100000,00000000,,@,?,?,?,?,00000000), ref: 00411442
                                • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 0041144D
                                • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 00411454
                                • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000), ref: 0041145A
                                  • Part of subcall function 004128AD: RegCreateKeyA.ADVAPI32(80000001,00000000,TeF), ref: 004128BB
                                  • Part of subcall function 004128AD: RegSetValueExA.ADVAPI32(TeF,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128D6
                                  • Part of subcall function 004128AD: RegCloseKey.ADVAPI32(?,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128E1
                                • PathFileExistsW.SHLWAPI(?,?,?,?,?,00000000), ref: 0041148B
                                • GetTempPathW.KERNEL32(00000104,?,?,?,?,?,?,?,?,00000000), ref: 004114E7
                                • GetTempFileNameW.KERNEL32(?,temp_,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00411501
                                • lstrcatW.KERNEL32(?,.exe,?,?,?,?,?,?,?,00000000), ref: 00411513
                                  • Part of subcall function 0041B79A: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000004,00000000,0041B8B0,00000000,00000000), ref: 0041B7F6
                                  • Part of subcall function 0041B79A: WriteFile.KERNEL32(00000000,00000000,00000000,004061FD,00000000,?,00000004,00000000,0041B8B0,00000000,00000000), ref: 0041B80A
                                  • Part of subcall function 0041B79A: CloseHandle.KERNEL32(00000000,?,00000004,00000000,0041B8B0,00000000,00000000), ref: 0041B817
                                • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 0041155B
                                • Sleep.KERNEL32(000001F4,?,?,?,?,00000000), ref: 0041159C
                                • OpenProcess.KERNEL32(00100000,00000000,?,?,?,?,?,00000000), ref: 004115B1
                                • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 004115BC
                                • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 004115C3
                                • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000), ref: 004115C9
                                  • Part of subcall function 0041B79A: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041B8B0,00000000,00000000,00000000), ref: 0041B7D9
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: File$CloseCreateProcess$HandleOpen$CurrentObjectPathSingleTempValueWait$ExecuteExistsExitMutexNamePointerQueryShellSleepWritelstrcat
                                • String ID: ,@$.exe$0TG$PSG$WDH$exepath$open$temp_
                                • API String ID: 4250697656-4136069298
                                • Opcode ID: 8ff0da90902eb7502ec0182632f2458d5f8d34747f4bc51f50d53c48cfa77fc0
                                • Instruction ID: 17001e37a1d7cf9a3413e78a7a022695eb621cd558d1591dce66fb7483b9d66c
                                • Opcode Fuzzy Hash: 8ff0da90902eb7502ec0182632f2458d5f8d34747f4bc51f50d53c48cfa77fc0
                                • Instruction Fuzzy Hash: 7551B571A00315BBDB00A7A09C46EFE736E9B44715F10416BF906B71E2EF788E858A9D
                                Function 0041A3B1 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON
                                Download Yara Rule
                                APIs
                                • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041A4A8
                                • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041A4BC
                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,00466554), ref: 0041A4E4
                                • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00474EE0,00000000), ref: 0041A4F5
                                • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041A536
                                • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041A54E
                                • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041A563
                                • SetEvent.KERNEL32 ref: 0041A580
                                • WaitForSingleObject.KERNEL32(000001F4), ref: 0041A591
                                • CloseHandle.KERNEL32 ref: 0041A5A1
                                • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041A5C3
                                • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041A5CD
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                                • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
                                • API String ID: 738084811-2094122233
                                • Opcode ID: 941c5aba6ae374372d52031b0e7572de3a893ff214a8004139b0606186159c87
                                • Instruction ID: 23b594f260307180257043fa1e2d6aa1707bafa700398656917524c484c431be
                                • Opcode Fuzzy Hash: 941c5aba6ae374372d52031b0e7572de3a893ff214a8004139b0606186159c87
                                • Instruction Fuzzy Hash: A251B1716442046AD214BB32EC92EBF3B9DAB90758F10443FF445621E2EE789D48866F
                                Function 00401BE8 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                                Download Yara Rule
                                APIs
                                • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401C54
                                • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401C7E
                                • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401C8E
                                • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401C9E
                                • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401CAE
                                • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401CBE
                                • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401CCF
                                • WriteFile.KERNEL32(00000000,00472B02,00000002,00000000,00000000), ref: 00401CE0
                                • WriteFile.KERNEL32(00000000,00472B04,00000004,00000000,00000000), ref: 00401CF0
                                • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401D00
                                • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401D11
                                • WriteFile.KERNEL32(00000000,00472B0E,00000002,00000000,00000000), ref: 00401D22
                                • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401D32
                                • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401D42
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: File$Write$Create
                                • String ID: RIFF$WAVE$data$fmt
                                • API String ID: 1602526932-4212202414
                                • Opcode ID: d86e0a11b62900f44300c56c570c8f4c6d29e182ebfed168058ac3948617b838
                                • Instruction ID: 459023fa40bd80d73c97eac26e4027242e7445eca248bff5dcea5bec94493f3f
                                • Opcode Fuzzy Hash: d86e0a11b62900f44300c56c570c8f4c6d29e182ebfed168058ac3948617b838
                                • Instruction Fuzzy Hash: 85411C726443187AE210DE51DD86FBB7FACEB85B54F40081AF644E6080D7A5E909DBB3
                                Function 004064E0 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                                Download Yara Rule
                                APIs
                                • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Users\user\Desktop\Material Requirments.pif.exe,00000001,004068B2,C:\Users\user\Desktop\Material Requirments.pif.exe,00000003,004068DA,004752F0,00406933), ref: 004064F4
                                • GetProcAddress.KERNEL32(00000000), ref: 004064FD
                                • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 0040650E
                                • GetProcAddress.KERNEL32(00000000), ref: 00406511
                                • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 00406522
                                • GetProcAddress.KERNEL32(00000000), ref: 00406525
                                • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 00406536
                                • GetProcAddress.KERNEL32(00000000), ref: 00406539
                                • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 0040654A
                                • GetProcAddress.KERNEL32(00000000), ref: 0040654D
                                • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 0040655E
                                • GetProcAddress.KERNEL32(00000000), ref: 00406561
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: AddressHandleModuleProc
                                • String ID: C:\Users\user\Desktop\Material Requirments.pif.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                                • API String ID: 1646373207-673529708
                                • Opcode ID: ef23c6471a2b46cbb5b12a679159521cca5d22753a6c35f36816646c352fbe50
                                • Instruction ID: d8392adca69ca7380431791802c09c3f057f20abbaf47be00649cb9a46baa942
                                • Opcode Fuzzy Hash: ef23c6471a2b46cbb5b12a679159521cca5d22753a6c35f36816646c352fbe50
                                • Instruction Fuzzy Hash: D20171A4E40B1635CB206F7B7C94D17AEAC9E503503160837A406F32A1EEBCD400CD7D
                                Function 0041B3C6 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                                Download Yara Rule
                                APIs
                                • lstrlenW.KERNEL32(?), ref: 0041B3E1
                                • _memcmp.LIBVCRUNTIME ref: 0041B3F9
                                • lstrlenW.KERNEL32(?), ref: 0041B412
                                • FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 0041B44D
                                • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041B460
                                • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041B4A4
                                • lstrcmpW.KERNEL32(?,?), ref: 0041B4BF
                                • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041B4D7
                                • _wcslen.LIBCMT ref: 0041B4E6
                                • FindVolumeClose.KERNEL32(?), ref: 0041B506
                                • GetLastError.KERNEL32 ref: 0041B51E
                                • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041B54B
                                • lstrcatW.KERNEL32(?,?), ref: 0041B564
                                • lstrcpyW.KERNEL32(?,?), ref: 0041B573
                                • GetLastError.KERNEL32 ref: 0041B57B
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                                • String ID: ?
                                • API String ID: 3941738427-1684325040
                                • Opcode ID: e79c6557d7143a0add8a3d203bc3a2cd2385ec013658f048d8e2d2538e26efc1
                                • Instruction ID: f0577cbf519c1fbc76aa3138d797bbd7c283cc622b072e5c2a83b2d98bec9820
                                • Opcode Fuzzy Hash: e79c6557d7143a0add8a3d203bc3a2cd2385ec013658f048d8e2d2538e26efc1
                                • Instruction Fuzzy Hash: 8441A071504705ABC720DF61E8489EBB7E8EB48705F00482FF541D2262EF78D989CBDA
                                Function 0044E41E Relevance: 25.9, APIs: 17, Instructions: 419COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: _free$EnvironmentVariable$_wcschr
                                • String ID:
                                • API String ID: 3899193279-0
                                • Opcode ID: b761d837fea9788b9cc55b5dd406501ac601b89a85fd50388b6dac53ecc4f6c8
                                • Instruction ID: a8aac0df7486383d9a181904d39d16e24afc3d72eb934652fe50c6e09291e228
                                • Opcode Fuzzy Hash: b761d837fea9788b9cc55b5dd406501ac601b89a85fd50388b6dac53ecc4f6c8
                                • Instruction Fuzzy Hash: 5DD12771D00310AFFB21AF77888166E7BA4BF01368F45416FF945A7381EA399E418B9D
                                Function 00411D59 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 479sleepfileCOMMON
                                Download Yara Rule
                                APIs
                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00411D72
                                  • Part of subcall function 0041AD43: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,00403A40), ref: 0041AD6A
                                  • Part of subcall function 0041789C: CloseHandle.KERNEL32(00403AB9,?,?,00403AB9,00466324), ref: 004178B2
                                  • Part of subcall function 0041789C: CloseHandle.KERNEL32($cF,?,?,00403AB9,00466324), ref: 004178BB
                                • Sleep.KERNEL32(0000000A,00466324), ref: 00411EC4
                                • Sleep.KERNEL32(0000000A,00466324,00466324), ref: 00411F66
                                • Sleep.KERNEL32(0000000A,00466324,00466324,00466324), ref: 00412008
                                • DeleteFileW.KERNEL32(00000000,00466324,00466324,00466324), ref: 00412069
                                • DeleteFileW.KERNEL32(00000000,00466324,00466324,00466324), ref: 004120A0
                                • DeleteFileW.KERNEL32(00000000,00466324,00466324,00466324), ref: 004120DC
                                • Sleep.KERNEL32(000001F4,00466324,00466324,00466324), ref: 004120F6
                                • Sleep.KERNEL32(00000064), ref: 00412138
                                  • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                                • String ID: /stext "$HTG$HTG$NG$NG
                                • API String ID: 1223786279-556891652
                                • Opcode ID: c27f9da67ae8f3ffc4d0282f0e0a1910305e6a5a590b06fa1c25c5e07b69ea74
                                • Instruction ID: b666a026b41db1aee680f36e7b950d376c2ae40a85d54f66cdb5da2431d4b1f1
                                • Opcode Fuzzy Hash: c27f9da67ae8f3ffc4d0282f0e0a1910305e6a5a590b06fa1c25c5e07b69ea74
                                • Instruction Fuzzy Hash: F00224315083414AD324FB61D891BEFB7D5AFD4308F50493EF88A931E2EF785A49C69A
                                Function 00413F0F Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON
                                Download Yara Rule
                                APIs
                                • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00413F5E
                                • LoadLibraryA.KERNEL32(?), ref: 00413FA0
                                • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00413FC0
                                • FreeLibrary.KERNEL32(00000000), ref: 00413FC7
                                • LoadLibraryA.KERNEL32(?), ref: 00413FFF
                                • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414011
                                • FreeLibrary.KERNEL32(00000000), ref: 00414018
                                • GetProcAddress.KERNEL32(00000000,?), ref: 00414027
                                • FreeLibrary.KERNEL32(00000000), ref: 0041403E
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Library$AddressFreeProc$Load$DirectorySystem
                                • String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
                                • API String ID: 2490988753-744132762
                                • Opcode ID: a1ebb0e7ad90273c6050595515f5be941597b1bff8e5ee6fc120c50391cee153
                                • Instruction ID: be6955175b5ce73d91635d8a52bfbd354ab09fdd92d7e760b1966c561f7cb5d0
                                • Opcode Fuzzy Hash: a1ebb0e7ad90273c6050595515f5be941597b1bff8e5ee6fc120c50391cee153
                                • Instruction Fuzzy Hash: B33117B280131567D320EF55DC84EDB7BDCAF89745F01092AFA88A3201D73CD98587AE
                                Function 0041BA2F Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON
                                Download Yara Rule
                                APIs
                                • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041BA51
                                • RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 0041BA95
                                • RegCloseKey.ADVAPI32(?), ref: 0041BD5F
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseEnumOpen
                                • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
                                • API String ID: 1332880857-3714951968
                                • Opcode ID: 80836246da4c2b3e1d4e79ae55795e07288bc0e9679a8059a93e05b675ced405
                                • Instruction ID: 1bcbf0a3cc417a03c0c35e29071d92a42b6db1fb54f2f7a4c144fc0fa0a0a3c2
                                • Opcode Fuzzy Hash: 80836246da4c2b3e1d4e79ae55795e07288bc0e9679a8059a93e05b675ced405
                                • Instruction Fuzzy Hash: 43813F311082409FD324EB11D951AEFB7E8FFD4314F10493FB586921E1EF34AA59CA9A
                                Function 0040A3F4 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 158sleepCOMMON
                                Download Yara Rule
                                APIs
                                • __Init_thread_footer.LIBCMT ref: 0040A456
                                • Sleep.KERNEL32(000001F4), ref: 0040A461
                                • GetForegroundWindow.USER32 ref: 0040A467
                                • GetWindowTextLengthW.USER32(00000000), ref: 0040A470
                                • GetWindowTextW.USER32(00000000,00000000,00000000), ref: 0040A4A4
                                • Sleep.KERNEL32(000003E8), ref: 0040A574
                                  • Part of subcall function 00409D58: SetEvent.KERNEL32(?,?,00000000,0040A91C,00000000), ref: 00409D84
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                                • String ID: [${ User has been idle for $ minutes }$<mG$<mG$<mG$]
                                • API String ID: 911427763-3636820255
                                • Opcode ID: d1533f5841763a27614f1ccc4c58f2d4acd5bb5712b4e35f89f8969207f6e1d5
                                • Instruction ID: ab9145b4e211f5f3da3af6290e6e7a2c9d96cae7f6b46a2c86e206227f6ebbf0
                                • Opcode Fuzzy Hash: d1533f5841763a27614f1ccc4c58f2d4acd5bb5712b4e35f89f8969207f6e1d5
                                • Instruction Fuzzy Hash: 1951D0716043409BC324FB25D886AAE7795AF84718F00093FF446A32E2DF7C9E55868F
                                Function 0041CCA9 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 73windowCOMMON
                                Download Yara Rule
                                APIs
                                • DefWindowProcA.USER32(?,00000401,?,?), ref: 0041CCF4
                                • GetCursorPos.USER32(?), ref: 0041CD03
                                • SetForegroundWindow.USER32(?), ref: 0041CD0C
                                • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041CD26
                                • Shell_NotifyIconA.SHELL32(00000002,00474B50), ref: 0041CD77
                                • ExitProcess.KERNEL32 ref: 0041CD7F
                                • CreatePopupMenu.USER32 ref: 0041CD85
                                • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041CD9A
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                                • String ID: Close
                                • API String ID: 1657328048-3535843008
                                • Opcode ID: bed582d39fc96e8479943e4d89b527f8ff9ef20370aed2009df63d45acb158b0
                                • Instruction ID: 460fc807693895ecf387abb2373bcbc61375cccb84b7011694e880842115b21a
                                • Opcode Fuzzy Hash: bed582d39fc96e8479943e4d89b527f8ff9ef20370aed2009df63d45acb158b0
                                • Instruction Fuzzy Hash: F321F831140205EFDB054FA4FD4DBAA3F65EB04702F004539FA0AA41B1DBB6ED91EB59
                                Function 0044514D Relevance: 22.8, APIs: 15, Instructions: 296COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: _free$Info
                                • String ID:
                                • API String ID: 2509303402-0
                                • Opcode ID: d1d8ca3bfaab8ff34c38809097ff282998849f31a70215ee9c59cc9cd170099d
                                • Instruction ID: de18a1b700a064f56ed707831433d851a0809218b1b1d193042f08ca5b0df7c8
                                • Opcode Fuzzy Hash: d1d8ca3bfaab8ff34c38809097ff282998849f31a70215ee9c59cc9cd170099d
                                • Instruction Fuzzy Hash: 59B190719006059FEF11DF69C881BEEBBF4FF09304F14406EF895AB252DA799C459B24
                                Function 00407DEF Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 325fileCOMMON
                                Download Yara Rule
                                APIs
                                • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000000B6), ref: 00407F4C
                                • GetFileSizeEx.KERNEL32(00000000,00000000), ref: 00407FC2
                                • __aulldiv.LIBCMT ref: 00407FE9
                                • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 0040810D
                                • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408128
                                • CloseHandle.KERNEL32(00000000), ref: 00408200
                                • CloseHandle.KERNEL32(00000000,00000052,00000000,?), ref: 0040821A
                                • CloseHandle.KERNEL32(00000000), ref: 00408256
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: File$CloseHandle$CreatePointerReadSize__aulldiv
                                • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
                                • API String ID: 1884690901-2582957567
                                • Opcode ID: 70b636795d6b128b41ae01db0570d68c16746dcdaaf9af82051e377dc8abc0c6
                                • Instruction ID: fe8c5194ffe86d3827a7b181bfbb3d0fd3c62202293e6b84b2d5449ede98e066
                                • Opcode Fuzzy Hash: 70b636795d6b128b41ae01db0570d68c16746dcdaaf9af82051e377dc8abc0c6
                                • Instruction Fuzzy Hash: 73B182716083409BC614FB25C892BAFB7E5AFD4314F40492EF889632D2EF789945C79B
                                Function 0045027D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • ___free_lconv_mon.LIBCMT ref: 004502C1
                                  • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F510
                                  • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F522
                                  • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F534
                                  • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F546
                                  • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F558
                                  • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F56A
                                  • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F57C
                                  • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F58E
                                  • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F5A0
                                  • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F5B2
                                  • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F5C4
                                  • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F5D6
                                  • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F5E8
                                • _free.LIBCMT ref: 004502B6
                                  • Part of subcall function 00446CD5: HeapFree.KERNEL32(00000000,00000000,?,0044FC60,?,00000000,?,00000000,?,0044FF04,?,00000007,?,?,00450415,?), ref: 00446CEB
                                  • Part of subcall function 00446CD5: GetLastError.KERNEL32(?,?,0044FC60,?,00000000,?,00000000,?,0044FF04,?,00000007,?,?,00450415,?,?), ref: 00446CFD
                                • _free.LIBCMT ref: 004502D8
                                • _free.LIBCMT ref: 004502ED
                                • _free.LIBCMT ref: 004502F8
                                • _free.LIBCMT ref: 0045031A
                                • _free.LIBCMT ref: 0045032D
                                • _free.LIBCMT ref: 0045033B
                                • _free.LIBCMT ref: 00450346
                                • _free.LIBCMT ref: 0045037E
                                • _free.LIBCMT ref: 00450385
                                • _free.LIBCMT ref: 004503A2
                                • _free.LIBCMT ref: 004503BA
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                • String ID:
                                • API String ID: 161543041-0
                                • Opcode ID: 0aefceb04b648aea5efd53e91dec8318d050154b6956abd82aee10787160205d
                                • Instruction ID: 8d5a52dc196ca223d521196e0170462af54da78aea2ffa7a7b46d1c1532e12ca
                                • Opcode Fuzzy Hash: 0aefceb04b648aea5efd53e91dec8318d050154b6956abd82aee10787160205d
                                • Instruction Fuzzy Hash: 57316F355003009FEB20AA79D84AB5B73E9EF01365F51445FF88AD7652DF38AC48D719
                                Function 0040428C Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 147networkCOMMON
                                Download Yara Rule
                                APIs
                                • connect.WS2_32(?,?,?), ref: 004042A5
                                • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,?,?,0040192B), ref: 004043CB
                                • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,?,?,0040192B), ref: 004043D5
                                • WSAGetLastError.WS2_32(?,?,?,0040192B), ref: 004043E7
                                  • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CreateEvent$ErrorLastLocalTimeconnect
                                • String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                                • API String ID: 994465650-2151626615
                                • Opcode ID: ce6395dee173e9ff02e5a4e74d3a7a8ffb39b8ce020a8ff46a74c480c5b0fd80
                                • Instruction ID: 8d860672b69a19ae3c360ccb47b0a38bc4e99592ce22fc56bfe6acc5d0e7da0a
                                • Opcode Fuzzy Hash: ce6395dee173e9ff02e5a4e74d3a7a8ffb39b8ce020a8ff46a74c480c5b0fd80
                                • Instruction Fuzzy Hash: D54109B0B0020277CA04B77A884766E7A55AB85314B80012FE901A7AD3FE3DAD2587DF
                                Function 0040C66D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 147COMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 00411771: TerminateProcess.KERNEL32(00000000,?,0040C67D), ref: 00411781
                                  • Part of subcall function 00411771: WaitForSingleObject.KERNEL32(000000FF,?,0040C67D), ref: 00411794
                                  • Part of subcall function 00412735: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?,00000208), ref: 00412751
                                  • Part of subcall function 00412735: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 0041276A
                                  • Part of subcall function 00412735: RegCloseKey.ADVAPI32(?), ref: 00412775
                                • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040C6C7
                                • ShellExecuteW.SHELL32(00000000,open,00000000,00466900,00466900,00000000), ref: 0040C826
                                • ExitProcess.KERNEL32 ref: 0040C832
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                                • String ID: """, 0$.vbs$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$PSG$Temp$exepath$open
                                • API String ID: 1913171305-1605470806
                                • Opcode ID: 6744204509d78bf7e5f563ee8f20c271546e6cf5f606ebae6b4183cb2e41ccc9
                                • Instruction ID: 0a59ab1ac2652dc6c4b0de1f1bfb113b457f9f33def171b9a9917dadcc9857af
                                • Opcode Fuzzy Hash: 6744204509d78bf7e5f563ee8f20c271546e6cf5f606ebae6b4183cb2e41ccc9
                                • Instruction Fuzzy Hash: 2E416D329101185ACB14F761DC56DFE7779AF50708F10417FF806B31E2EE786A8ACA98
                                Function 0044F5F1 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: _free
                                • String ID:
                                • API String ID: 269201875-0
                                • Opcode ID: b030283a6c0ce51ba92dd09d555ed862ebb201d4cb761b5ee972a13664eb7e13
                                • Instruction ID: 986e8a668492dbee8f9f46891c6c86f5dcf9ebf43b9fca0c5b911ed3811bef24
                                • Opcode Fuzzy Hash: b030283a6c0ce51ba92dd09d555ed862ebb201d4cb761b5ee972a13664eb7e13
                                • Instruction Fuzzy Hash: 1FC15371D40204BBEB20EAA8CC82FEE77B89B08704F15416AFE45FB282D6749D459768
                                Function 004047EB Relevance: 18.1, APIs: 12, Instructions: 66synchronizationCOMMON
                                Download Yara Rule
                                APIs
                                • WaitForSingleObject.KERNEL32(?,000000FF,00476B98,?,?,00000000,00476B98,004017F3), ref: 004047FD
                                • SetEvent.KERNEL32(?,?,?,00000000,00476B98,004017F3), ref: 00404808
                                • CloseHandle.KERNEL32(?,?,?,00000000,00476B98,004017F3), ref: 00404811
                                • closesocket.WS2_32(?), ref: 0040481F
                                • WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00476B98,004017F3), ref: 00404856
                                • SetEvent.KERNEL32(?,?,?,00000000,00476B98,004017F3), ref: 00404867
                                • WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00476B98,004017F3), ref: 0040486E
                                • SetEvent.KERNEL32(?,?,?,00000000,00476B98,004017F3), ref: 00404880
                                • CloseHandle.KERNEL32(?,?,?,00000000,00476B98,004017F3), ref: 00404885
                                • CloseHandle.KERNEL32(?,?,?,00000000,00476B98,004017F3), ref: 0040488A
                                • SetEvent.KERNEL32(?,?,?,00000000,00476B98,004017F3), ref: 00404895
                                • CloseHandle.KERNEL32(?,?,?,00000000,00476B98,004017F3), ref: 0040489A
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseEventHandle$ObjectSingleWait$closesocket
                                • String ID:
                                • API String ID: 3658366068-0
                                • Opcode ID: c817c985d633cc122de12881bd7d9bb3d85314545a7d065039492bb8559bbf7e
                                • Instruction ID: bab6184e8302d1d457a53eef1949a11c31841f7ba2aeead181e9cd14b25d2afd
                                • Opcode Fuzzy Hash: c817c985d633cc122de12881bd7d9bb3d85314545a7d065039492bb8559bbf7e
                                • Instruction Fuzzy Hash: 21212C71100F149FC6216B26DC05A17BBE1EF40325F104A6EE2A622AF2CF35F851DB4C
                                Function 00454B92 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 00454860: CreateFileW.KERNEL32(00000000,?,?,;LE,?,?,00000000,?,00454C3B,00000000,0000000C), ref: 0045487D
                                • GetLastError.KERNEL32 ref: 00454CA6
                                • __dosmaperr.LIBCMT ref: 00454CAD
                                • GetFileType.KERNEL32(00000000), ref: 00454CB9
                                • GetLastError.KERNEL32 ref: 00454CC3
                                • __dosmaperr.LIBCMT ref: 00454CCC
                                • CloseHandle.KERNEL32(00000000), ref: 00454CEC
                                • CloseHandle.KERNEL32(?), ref: 00454E36
                                • GetLastError.KERNEL32 ref: 00454E68
                                • __dosmaperr.LIBCMT ref: 00454E6F
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                • String ID: H
                                • API String ID: 4237864984-2852464175
                                • Opcode ID: d5a11e48ff8715deaa04994f4ee12c3a6be518488385ffc1a57c91a4edd12fa7
                                • Instruction ID: a1ee14646c220e05fb339a94c39d658440f80e8cb8884f5184f0ba1168eb6fd8
                                • Opcode Fuzzy Hash: d5a11e48ff8715deaa04994f4ee12c3a6be518488385ffc1a57c91a4edd12fa7
                                • Instruction Fuzzy Hash: EBA126319045489FDF19DF68D8427AE7BB1EB46329F14015EEC01AF392CB398896CB5A
                                Function 0041931E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 174sleeptimeCOMMON
                                Download Yara Rule
                                APIs
                                • __EH_prolog.LIBCMT ref: 00419323
                                • GdiplusStartup.GDIPLUS(00474AF4,?,00000000), ref: 00419355
                                • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 004193E1
                                • Sleep.KERNEL32(000003E8), ref: 00419463
                                • GetLocalTime.KERNEL32(?), ref: 00419472
                                • Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041955B
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
                                • String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$VG$VG
                                • API String ID: 489098229-455837001
                                • Opcode ID: 3a9641ecb7aa26b7f55cb66c70656c14dee76aaaae99db37ec059e1173464e55
                                • Instruction ID: fd6a6a94d4e700b4a78141c9ee43bb9ee9cebd21b8d39b126fa21a823fd8be24
                                • Opcode Fuzzy Hash: 3a9641ecb7aa26b7f55cb66c70656c14dee76aaaae99db37ec059e1173464e55
                                • Instruction Fuzzy Hash: 9F517B71A002449ACB14BBB5C866AFE7BA9AB55308F40403FF845B71D2EF3C5E85C799
                                Function 00413D3F Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 155COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID:
                                • String ID: 65535$udp
                                • API String ID: 0-1267037602
                                • Opcode ID: ca54308d78d3c4eee7f7b8de95e44a5f1974b5ba6ce0b2e83d9cd08af329ba0f
                                • Instruction ID: c3bfc2202edcb816331f8b78e042012e01f064b481147a6b300cfea58c86e196
                                • Opcode Fuzzy Hash: ca54308d78d3c4eee7f7b8de95e44a5f1974b5ba6ce0b2e83d9cd08af329ba0f
                                • Instruction Fuzzy Hash: E241F4716093029BD7209F28D905BBB3BA4EB84742F04042FF98593391EB6DDEC1866E
                                Function 00439571 Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 004395C9
                                • GetLastError.KERNEL32(?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 004395D6
                                • __dosmaperr.LIBCMT ref: 004395DD
                                • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00439609
                                • GetLastError.KERNEL32(?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00439613
                                • __dosmaperr.LIBCMT ref: 0043961A
                                • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401AD8,?), ref: 0043965D
                                • GetLastError.KERNEL32(?,?,?,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00439667
                                • __dosmaperr.LIBCMT ref: 0043966E
                                • _free.LIBCMT ref: 0043967A
                                • _free.LIBCMT ref: 00439681
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                                • String ID:
                                • API String ID: 2441525078-0
                                • Opcode ID: dfdcad72845ff40c716263c5292f552f86d121caf0de13ecf7d4fcc5b88c2f06
                                • Instruction ID: 4e2bc3e06b1619faa1414a7a2c806c5d1514cda6e297fdc8b1054bbcfea92265
                                • Opcode Fuzzy Hash: dfdcad72845ff40c716263c5292f552f86d121caf0de13ecf7d4fcc5b88c2f06
                                • Instruction Fuzzy Hash: D431E27280560ABFDF11AFA5DC459AF3B68EF09324F10015EF81066251DB39CD50DBAA
                                Function 00404E52 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                                Download Yara Rule
                                APIs
                                • SetEvent.KERNEL32(?,?), ref: 00404E71
                                • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00404F21
                                • TranslateMessage.USER32(?), ref: 00404F30
                                • DispatchMessageA.USER32(?), ref: 00404F3B
                                • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00404FF3
                                • HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 0040502B
                                  • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                                • String ID: CloseChat$DisplayMessage$GetMessage
                                • API String ID: 2956720200-749203953
                                • Opcode ID: 689e69da84c0764fb0bda9264d674ecd6c5d8102801ff27aff4d3bccf45f87d1
                                • Instruction ID: 290a0909c372499a911e5ffd519e5407deecd3e64339803c74491ead196e324c
                                • Opcode Fuzzy Hash: 689e69da84c0764fb0bda9264d674ecd6c5d8102801ff27aff4d3bccf45f87d1
                                • Instruction Fuzzy Hash: A441B1726043016BC614FB75DC568AF7BA8ABC1714F00093EF906A31E6EF38DA05C79A
                                Function 0041700D Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 107filesynchronizationCOMMON
                                Download Yara Rule
                                APIs
                                • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,00466554), ref: 0041710A
                                • CloseHandle.KERNEL32(00000000), ref: 00417113
                                • DeleteFileA.KERNEL32(00000000), ref: 00417122
                                • ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 004170D6
                                  • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseDeleteExecuteFileHandleObjectShellSingleWaitsend
                                • String ID: <$@$HVG$HVG$Temp
                                • API String ID: 1107811701-2568817187
                                • Opcode ID: b12189bafc6eeec837ac6e67884d08df64c91a48931b583e802df8a573991e45
                                • Instruction ID: 91e4b2e714ed18abe86730f534b33d619c8c8851ecafca63038a632c75497fc1
                                • Opcode Fuzzy Hash: b12189bafc6eeec837ac6e67884d08df64c91a48931b583e802df8a573991e45
                                • Instruction Fuzzy Hash: 00319C31A00209ABCB04FBA1DC56AEE7775AF50308F40417EF506761E2EF785A89CB99
                                Function 00419E7B Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                                Download Yara Rule
                                APIs
                                • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419E8A
                                • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419EA1
                                • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419EAE
                                • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419EBD
                                • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419ECE
                                • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419ED1
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Service$CloseHandle$Open$ControlManager
                                • String ID:
                                • API String ID: 221034970-0
                                • Opcode ID: 55261a2c665e0413743554c6202175c8b7b906ba390245a70028e15af71588e6
                                • Instruction ID: 401ec45fa9dd23e1a78cca63bf6ad54db5d4c9b9326c405a7ffc92fc58cb3c60
                                • Opcode Fuzzy Hash: 55261a2c665e0413743554c6202175c8b7b906ba390245a70028e15af71588e6
                                • Instruction Fuzzy Hash: 4211A331941218BBD711AB64DC85DFF3B6CDB45BA1B05002AF902A21D2DF64CD4A9AB5
                                Function 00446FDB Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                Download Yara Rule
                                APIs
                                • _free.LIBCMT ref: 00446FEF
                                  • Part of subcall function 00446CD5: HeapFree.KERNEL32(00000000,00000000,?,0044FC60,?,00000000,?,00000000,?,0044FF04,?,00000007,?,?,00450415,?), ref: 00446CEB
                                  • Part of subcall function 00446CD5: GetLastError.KERNEL32(?,?,0044FC60,?,00000000,?,00000000,?,0044FF04,?,00000007,?,?,00450415,?,?), ref: 00446CFD
                                • _free.LIBCMT ref: 00446FFB
                                • _free.LIBCMT ref: 00447006
                                • _free.LIBCMT ref: 00447011
                                • _free.LIBCMT ref: 0044701C
                                • _free.LIBCMT ref: 00447027
                                • _free.LIBCMT ref: 00447032
                                • _free.LIBCMT ref: 0044703D
                                • _free.LIBCMT ref: 00447048
                                • _free.LIBCMT ref: 00447056
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: _free$ErrorFreeHeapLast
                                • String ID:
                                • API String ID: 776569668-0
                                • Opcode ID: 6cab9f7d569f345c7814ae43f5c160195df6b64f63ea78a6b18b8aa73aee7787
                                • Instruction ID: 9fec27c2adf71536e74eabd4120179072dbaa777ef3671cded9c13d0800a1e4b
                                • Opcode Fuzzy Hash: 6cab9f7d569f345c7814ae43f5c160195df6b64f63ea78a6b18b8aa73aee7787
                                • Instruction Fuzzy Hash: 86119B7550011CBFDB05EF55C882CDD3BB5EF05364B9240AAF9494F222DA35DE50EB49
                                Function 004103EC Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 192COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Eventinet_ntoa
                                • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
                                • API String ID: 3578746661-3604713145
                                • Opcode ID: c36c81fe7425b1b6e506086ffb2fb9161aac8932331d1d3be168e551843293dc
                                • Instruction ID: 73c74054356758d85ec5353b0407031f458931cc5dd6312d5a4dd957febfbb04
                                • Opcode Fuzzy Hash: c36c81fe7425b1b6e506086ffb2fb9161aac8932331d1d3be168e551843293dc
                                • Instruction Fuzzy Hash: 5851A4316043005BCA14FB75D95AAAE36A59B84318F00453FF809972E1DFBC9D85C78E
                                Function 00409E48 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 163sleepCOMMON
                                Download Yara Rule
                                APIs
                                • Sleep.KERNEL32(00001388), ref: 00409E62
                                  • Part of subcall function 00409D97: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00409E6F), ref: 00409DCD
                                  • Part of subcall function 00409D97: GetFileSize.KERNEL32(00000000,00000000,?,?,?,00409E6F), ref: 00409DDC
                                  • Part of subcall function 00409D97: Sleep.KERNEL32(00002710,?,?,?,00409E6F), ref: 00409E09
                                  • Part of subcall function 00409D97: CloseHandle.KERNEL32(00000000,?,?,?,00409E6F), ref: 00409E10
                                • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00409E9E
                                • GetFileAttributesW.KERNEL32(00000000), ref: 00409EAF
                                • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 00409EC6
                                • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 00409F40
                                  • Part of subcall function 0041B825: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,00403AF3,00466324), ref: 0041B83E
                                • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466900,00000000,00000000,00000000), ref: 0040A049
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                                • String ID: PSG$PSG
                                • API String ID: 3795512280-3836871860
                                • Opcode ID: 74f1a2fd00454cc227f8dfda7535959cafb6fa094380efb7548397c1c40d45e5
                                • Instruction ID: 2e46ee78bd67d64478951c63fc585b7447d0c94e1b250d5b4a4871e09aa14890
                                • Opcode Fuzzy Hash: 74f1a2fd00454cc227f8dfda7535959cafb6fa094380efb7548397c1c40d45e5
                                • Instruction Fuzzy Hash: 68517F716043005ACB05BB71C866ABF779AAF81309F00453FF886B71E2DE7D9D45C69A
                                Function 00455349 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00455FBF), ref: 0045536C
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: DecodePointer
                                • String ID: acos$asin$exp$log$log10$pow$sqrt
                                • API String ID: 3527080286-3064271455
                                • Opcode ID: 67af5dfbca39e453d379808c5bd58ad6562fbcb90b426b99781506e6fbd48065
                                • Instruction ID: 83316d2fa1d48b2f4155984bd6892a75fd3c5afb36d5e99e95f82d48d48c5a2a
                                • Opcode Fuzzy Hash: 67af5dfbca39e453d379808c5bd58ad6562fbcb90b426b99781506e6fbd48065
                                • Instruction Fuzzy Hash: 93516C70900A09DBCF10DF58D5581BDBBB0FB0A306F204197DC81A7326DB798A6C8B1E
                                Function 004167E2 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 103sleepfileCOMMON
                                Download Yara Rule
                                APIs
                                • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 00416842
                                  • Part of subcall function 0041B825: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,00403AF3,00466324), ref: 0041B83E
                                • Sleep.KERNEL32(00000064), ref: 0041686E
                                • DeleteFileW.KERNEL32(00000000), ref: 004168A2
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: File$CreateDeleteExecuteShellSleep
                                • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                                • API String ID: 1462127192-2001430897
                                • Opcode ID: 8625cb1ca7dc698eeada123c4c97a7a08d9b3343a06db9de142db9a2ef1a2ec8
                                • Instruction ID: c4be9e9118a59201799f54b99a9a171b680bb642a7e99c3b30ff6139130205e5
                                • Opcode Fuzzy Hash: 8625cb1ca7dc698eeada123c4c97a7a08d9b3343a06db9de142db9a2ef1a2ec8
                                • Instruction Fuzzy Hash: 1B313E719001189ADB04FBA1DC96EEE7764AF50708F00417FF946730D2EF786A8ACA9D
                                Function 00406616 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 98COMMON
                                Download Yara Rule
                                APIs
                                • GetCurrentProcess.KERNEL32(00475A50,00000000,004752F0,00003000,00000004,00000000,00000001), ref: 00406647
                                • GetCurrentProcess.KERNEL32(00475A50,00000000,00008000,?,00000000,00000001,00000000,004068BB,C:\Users\user\Desktop\Material Requirments.pif.exe), ref: 00406705
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CurrentProcess
                                • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
                                • API String ID: 2050909247-4242073005
                                • Opcode ID: ada4beff3b074d502f863bbfc19964383e0eb104899283a90b78ad76c4b125e9
                                • Instruction ID: 2a8ac338152687dbadce55b3d6de3572d7837fd421bef744f3a625c24d449dc1
                                • Opcode Fuzzy Hash: ada4beff3b074d502f863bbfc19964383e0eb104899283a90b78ad76c4b125e9
                                • Instruction Fuzzy Hash: B231B671600700AFD300AF65DC8AF5677A8FB44709F11053EF50ABB6E1EBB9A8548B6D
                                Function 00401A8E Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON
                                Download Yara Rule
                                APIs
                                • _strftime.LIBCMT ref: 00401AD3
                                  • Part of subcall function 00401BE8: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401C54
                                • waveInUnprepareHeader.WINMM(00472AC0,00000020,00000000,?), ref: 00401B85
                                • waveInPrepareHeader.WINMM(00472AC0,00000020), ref: 00401BC3
                                • waveInAddBuffer.WINMM(00472AC0,00000020), ref: 00401BD2
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                                • String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
                                • API String ID: 3809562944-243156785
                                • Opcode ID: 6b69dc639707c8cc5ddd676b602b89ce5084f8f5404443e4235f0b723ae7c06e
                                • Instruction ID: b0e15ff03f11dcb3e5bfd7c1448581b7ace3962aa9bffbd159c0990beee9d81b
                                • Opcode Fuzzy Hash: 6b69dc639707c8cc5ddd676b602b89ce5084f8f5404443e4235f0b723ae7c06e
                                • Instruction Fuzzy Hash: 7E315E315043019FC324EB21DC56A9E77A4FB94314F00493EF559A21F1EFB8AA89CB9A
                                Function 0041CB7A Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47windowstringCOMMON
                                Download Yara Rule
                                APIs
                                • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041CB93
                                  • Part of subcall function 0041CC2A: RegisterClassExA.USER32(00000030), ref: 0041CC77
                                  • Part of subcall function 0041CC2A: CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041CC92
                                  • Part of subcall function 0041CC2A: GetLastError.KERNEL32 ref: 0041CC9C
                                • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041CBCA
                                • lstrcpynA.KERNEL32(00474B68,Remcos,00000080), ref: 0041CBE4
                                • Shell_NotifyIconA.SHELL32(00000000,00474B50), ref: 0041CBFA
                                • TranslateMessage.USER32(?), ref: 0041CC06
                                • DispatchMessageA.USER32(?), ref: 0041CC10
                                • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0041CC1D
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                                • String ID: Remcos
                                • API String ID: 1970332568-165870891
                                • Opcode ID: 7a949f86bc247f3cbdd076edfe2cda77560b6c3ffe772df9fdb29a851d56ec4a
                                • Instruction ID: 6591afd7fea275f101bd811abb8745f55115b26a2df550b070e187602390ba30
                                • Opcode Fuzzy Hash: 7a949f86bc247f3cbdd076edfe2cda77560b6c3ffe772df9fdb29a851d56ec4a
                                • Instruction Fuzzy Hash: 130112B1940344ABD7109BA5EC4DFEABBBCA7C5B05F004029E615A2061EFB8E585CB6D
                                Function 0044B660 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 80a326afad967a93ce1a86f0dca2320a27418518a6ffaef50bf88bbe380ec4bc
                                • Instruction ID: 8081305e108bfff8a8e14cd18a234b42858a69a1a1930647e7f2335dd99175ec
                                • Opcode Fuzzy Hash: 80a326afad967a93ce1a86f0dca2320a27418518a6ffaef50bf88bbe380ec4bc
                                • Instruction Fuzzy Hash: 44C105B0D04249AFEF11DFA9C8417BEBBB4EF09314F04415AE544A7392C738D941CBA9
                                Function 00452D3A Relevance: 13.8, APIs: 9, Instructions: 268COMMON
                                Download Yara Rule
                                APIs
                                • GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,00453013,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00452DE6
                                • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,00453013,00000000,00000000,?,00000001,?,?,?,?), ref: 00452E69
                                • __alloca_probe_16.LIBCMT ref: 00452EA1
                                • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000001,00000000,00453013,?,00453013,00000000,00000000,?,00000001,?,?,?,?), ref: 00452EFC
                                • __alloca_probe_16.LIBCMT ref: 00452F4B
                                • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00453013,00000000,00000000,?,00000001,?,?,?,?), ref: 00452F13
                                  • Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434633,?,?,00437437,?,?,00000000,00476B98,?,0040CD5A,00434633,?,?,?,?), ref: 00446D41
                                • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00453013,00000000,00000000,?,00000001,?,?,?,?), ref: 00452F8F
                                • __freea.LIBCMT ref: 00452FBA
                                • __freea.LIBCMT ref: 00452FC6
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                                • String ID:
                                • API String ID: 201697637-0
                                • Opcode ID: 9d34413ba10ee56f0e89107094f6b20c3bdbe294d8798654877fad6b0a87a615
                                • Instruction ID: e285173fe66e9ab68cc8b5f7bb46492c032c90826bba7407019ac45f59d87ef3
                                • Opcode Fuzzy Hash: 9d34413ba10ee56f0e89107094f6b20c3bdbe294d8798654877fad6b0a87a615
                                • Instruction Fuzzy Hash: E991D572E002169BDF208E64DA41AEFBBB5AF0A312F14055BFC05E7242D778DC48C768
                                Function 00444609 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,?,?,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B), ref: 004470D3
                                  • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                  • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B,?,00000041,00000000,00000000), ref: 00447147
                                  • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                • _memcmp.LIBVCRUNTIME ref: 004448B3
                                • _free.LIBCMT ref: 00444924
                                • _free.LIBCMT ref: 0044493D
                                • _free.LIBCMT ref: 0044496F
                                • _free.LIBCMT ref: 00444978
                                • _free.LIBCMT ref: 00444984
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: _free$ErrorLast$_abort_memcmp
                                • String ID: C
                                • API String ID: 1679612858-1037565863
                                • Opcode ID: ace96769a188c4860cb04bdc22887ceb3694fc1a2cebb165a32311ad42cdc0a0
                                • Instruction ID: ce46d41f1d9e01bafc0896c2bb0d2adb680072b6a59d341745b23d3028246374
                                • Opcode Fuzzy Hash: ace96769a188c4860cb04bdc22887ceb3694fc1a2cebb165a32311ad42cdc0a0
                                • Instruction Fuzzy Hash: 24B14975A012199FEB24DF18C884BAEB7B4FF49314F1045AEE849A7351D738AE90CF48
                                Function 00413A9F Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 228COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID:
                                • String ID: tcp$udp
                                • API String ID: 0-3725065008
                                • Opcode ID: af4d639371690cb8637a3a63659cf8324f890a8ac4b6ebd8bb2dc9423f2fa13d
                                • Instruction ID: 641150f3fd0ea6af627c79cdc5c75230aa36f57d28899e04d0661f3c05bf373f
                                • Opcode Fuzzy Hash: af4d639371690cb8637a3a63659cf8324f890a8ac4b6ebd8bb2dc9423f2fa13d
                                • Instruction Fuzzy Hash: 0D71D1716083528FDB24CF1994846ABB7E0AF84746F14442FF885A7352E77CDE81CB8A
                                Function 00406BE9 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97fileCOMMON
                                Download Yara Rule
                                APIs
                                • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00466454,?,?,00000000,00407273,00000000,?,0000000A,00000000), ref: 00406C38
                                • WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,000186A0,?,?,?,00000000,00407273,00000000,?,0000000A,00000000), ref: 00406C80
                                  • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                • CloseHandle.KERNEL32(00000000,?,?,00000000,00407273,00000000,?,0000000A,00000000,00000000), ref: 00406CC0
                                • MoveFileW.KERNEL32(00000000,00000000), ref: 00406CDD
                                • CloseHandle.KERNEL32(00000000,00000057,?,00000008,?,?,?,?,?,?,0000000A,00000000,00000000), ref: 00406D08
                                • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,0000000A,00000000,00000000), ref: 00406D18
                                  • Part of subcall function 0040455B: WaitForSingleObject.KERNEL32(?,000000FF,?,?,0040460E,00000000,?,?), ref: 0040456A
                                  • Part of subcall function 0040455B: SetEvent.KERNEL32(?,?,?,0040460E,00000000,?,?), ref: 00404588
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                                • String ID: .part
                                • API String ID: 1303771098-3499674018
                                • Opcode ID: f18d6b1355a217ddce088d013cfbc187bf0019b35b43659bee9caf0cbeccb15e
                                • Instruction ID: 7eae26b3d9efd85ab9a821acf87acbbc445967fcd6ce231ca79d13f55b5b668b
                                • Opcode Fuzzy Hash: f18d6b1355a217ddce088d013cfbc187bf0019b35b43659bee9caf0cbeccb15e
                                • Instruction Fuzzy Hash: C631A4715083019FD210EF21DD459AFB7A8FB84755F40093EF9C6B21A1DF38AA48CB9A
                                Function 0040196B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 72COMMON
                                Download Yara Rule
                                APIs
                                • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040197B
                                • waveInOpen.WINMM(00472AF8,000000FF,00472B00,Function_00001A8E,00000000,00000000,00000024), ref: 00401A11
                                • waveInPrepareHeader.WINMM(00472AC0,00000020,00000000), ref: 00401A66
                                • waveInAddBuffer.WINMM(00472AC0,00000020), ref: 00401A75
                                • waveInStart.WINMM ref: 00401A81
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                                • String ID: dMG$|MG
                                • API String ID: 1356121797-1683252805
                                • Opcode ID: 4937013f493247ba6914b0f03507a401bc9571348850a09f8035cce8d0c89fed
                                • Instruction ID: 140f40b68b7a2e7574469051551963e155d477b90c1392cdc23a62cf20397fe9
                                • Opcode Fuzzy Hash: 4937013f493247ba6914b0f03507a401bc9571348850a09f8035cce8d0c89fed
                                • Instruction Fuzzy Hash: 52215C316002019BC725DF66EE1996A7BA6FB84710B00883EF50DE76B0DBF898C0CB5C
                                Function 00449B60 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,0042D05E,?,?,?,00449DB1,00000001,00000001,?), ref: 00449BBA
                                • __alloca_probe_16.LIBCMT ref: 00449BF2
                                • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,0042D05E,?,?,?,00449DB1,00000001,00000001,?), ref: 00449C40
                                • __alloca_probe_16.LIBCMT ref: 00449CD7
                                • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00449D3A
                                • __freea.LIBCMT ref: 00449D47
                                  • Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434633,?,?,00437437,?,?,00000000,00476B98,?,0040CD5A,00434633,?,?,?,?), ref: 00446D41
                                • __freea.LIBCMT ref: 00449D50
                                • __freea.LIBCMT ref: 00449D75
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                                • String ID:
                                • API String ID: 3864826663-0
                                • Opcode ID: 9488091ed0690e9528d6d9f5056237cc7d555ada16fd7aae5416fb14e5981086
                                • Instruction ID: b9264d00d576e3e69c3e593975f72d59ef517f4fd458bc34bb1ef2c80a576446
                                • Opcode Fuzzy Hash: 9488091ed0690e9528d6d9f5056237cc7d555ada16fd7aae5416fb14e5981086
                                • Instruction Fuzzy Hash: 3651F8B2A10206AFFB258F65DC82EBF77A9EB44754F15462EFC05DB240EB38DC409658
                                Function 00418CB4 Relevance: 12.1, APIs: 8, Instructions: 117keyboardCOMMON
                                Download Yara Rule
                                APIs
                                • SendInput.USER32 ref: 00418CFE
                                • SendInput.USER32(00000001,?,0000001C), ref: 00418D26
                                • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418D4D
                                • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418D6B
                                • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418D8B
                                • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418DB0
                                • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418DD2
                                • SendInput.USER32(00000001,?,0000001C), ref: 00418DF5
                                  • Part of subcall function 00418CA7: MapVirtualKeyA.USER32(00000000,00000000), ref: 00418CAD
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: InputSend$Virtual
                                • String ID:
                                • API String ID: 1167301434-0
                                • Opcode ID: 03d106074c487e793b96b2f05eb270ad55284c326fdeb905245ef2a17d2a5417
                                • Instruction ID: 141eef32e971302722b3407f09031bac5ba220a7556c2b6a6b809b2d6bbc12e7
                                • Opcode Fuzzy Hash: 03d106074c487e793b96b2f05eb270ad55284c326fdeb905245ef2a17d2a5417
                                • Instruction Fuzzy Hash: 2D318031258349A9E210DF65DC41FDFBBECAFC9B08F04080FB58457191EAA4858C87AB
                                Function 00415BDD Relevance: 12.0, APIs: 8, Instructions: 46clipboardCOMMON
                                Download Yara Rule
                                APIs
                                • OpenClipboard.USER32 ref: 00415BDE
                                • EmptyClipboard.USER32 ref: 00415BEC
                                • CloseClipboard.USER32 ref: 00415BF2
                                • OpenClipboard.USER32 ref: 00415BF9
                                • GetClipboardData.USER32(0000000D), ref: 00415C09
                                • GlobalLock.KERNEL32(00000000), ref: 00415C12
                                • GlobalUnlock.KERNEL32(00000000), ref: 00415C1B
                                • CloseClipboard.USER32 ref: 00415C21
                                  • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                                • String ID:
                                • API String ID: 2172192267-0
                                • Opcode ID: edefb58358ce8cdc395ddf65d295bda4e7696c52f81b48ab4f4ea0c50fd55db1
                                • Instruction ID: 369576e1793333014f6cd695595c81a654a0099a6e7e621b1e9fba3c04e1709a
                                • Opcode Fuzzy Hash: edefb58358ce8cdc395ddf65d295bda4e7696c52f81b48ab4f4ea0c50fd55db1
                                • Instruction Fuzzy Hash: EE0152322003009FC350BF71DC59AAE77A5AF80B42F00443FFD06A61A2EF35C949C659
                                Function 00446369 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: __freea$__alloca_probe_16
                                • String ID: a/p$am/pm$hD
                                • API String ID: 3509577899-3668228793
                                • Opcode ID: 43b5460f30cb545d9519724a85422a684a0db1a6e28bfa0e4ba62eb2b8b26617
                                • Instruction ID: deb853d5fd6adf3918d69246e21912660bd894b39407ab32d9d7da7685977c7a
                                • Opcode Fuzzy Hash: 43b5460f30cb545d9519724a85422a684a0db1a6e28bfa0e4ba62eb2b8b26617
                                • Instruction Fuzzy Hash: 1CD111719002069AFB289F68C9857BBB7B0FF06708F26415BE9019B355D33D9D81CB6B
                                Function 0044FA16 Relevance: 10.7, APIs: 7, Instructions: 204COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: _free
                                • String ID:
                                • API String ID: 269201875-0
                                • Opcode ID: f077d4d3131d38a916efa4b29297581a907ccab8f6a0855f0926686422bcb0fe
                                • Instruction ID: 0b2e84c71dbf843dbcc2e99f9f8dbab27ea7d8a4e4ef3fbdb467abc62f582456
                                • Opcode Fuzzy Hash: f077d4d3131d38a916efa4b29297581a907ccab8f6a0855f0926686422bcb0fe
                                • Instruction Fuzzy Hash: E061E271D00244AFEB20DF69C842BAABBF4EB4A320F24407BED45EB251D734AD45DB58
                                Function 0044418B Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434633,?,?,00437437,?,?,00000000,00476B98,?,0040CD5A,00434633,?,?,?,?), ref: 00446D41
                                • _free.LIBCMT ref: 00444296
                                • _free.LIBCMT ref: 004442AD
                                • _free.LIBCMT ref: 004442CC
                                • _free.LIBCMT ref: 004442E7
                                • _free.LIBCMT ref: 004442FE
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: _free$AllocateHeap
                                • String ID: Z9D
                                • API String ID: 3033488037-3781130823
                                • Opcode ID: 420af0d7deb978fd4f09b31180e64015ef713b7cbfcfc07d9ef747e1ca08c7aa
                                • Instruction ID: 86c8eacfe83d9672290f1135950403671a27bde0e5aa55c461cabd1b4ee88ac5
                                • Opcode Fuzzy Hash: 420af0d7deb978fd4f09b31180e64015ef713b7cbfcfc07d9ef747e1ca08c7aa
                                • Instruction Fuzzy Hash: D551B171A00304AFEB20DF6AC881B6A77F4FF95724B1446AEF809D7650E779DA01CB48
                                Function 0044821F Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 171timeCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045E478), ref: 00448289
                                • WideCharToMultiByte.KERNEL32(00000000,00000000,0047279C,000000FF,00000000,0000003F,00000000,?,?), ref: 00448301
                                • WideCharToMultiByte.KERNEL32(00000000,00000000,004727F0,000000FF,?,0000003F,00000000,?), ref: 0044832E
                                • _free.LIBCMT ref: 00448277
                                  • Part of subcall function 00446CD5: HeapFree.KERNEL32(00000000,00000000,?,0044FC60,?,00000000,?,00000000,?,0044FF04,?,00000007,?,?,00450415,?), ref: 00446CEB
                                  • Part of subcall function 00446CD5: GetLastError.KERNEL32(?,?,0044FC60,?,00000000,?,00000000,?,0044FF04,?,00000007,?,?,00450415,?,?), ref: 00446CFD
                                • _free.LIBCMT ref: 00448443
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                                • String ID: xE
                                • API String ID: 1286116820-407097786
                                • Opcode ID: 1f630aa574f8f032912558e332746922b811222e22d4e5e5c8fa9a473f36de46
                                • Instruction ID: 82a604bb7294b81f3f73b5ad664ce4632eb81d562d18d3de5c52697f85b56542
                                • Opcode Fuzzy Hash: 1f630aa574f8f032912558e332746922b811222e22d4e5e5c8fa9a473f36de46
                                • Instruction Fuzzy Hash: 43510871900219ABEB14EF698D819AE77BCEF44B14F1002AFF854A3291EF788D418B5C
                                Function 0044A2D3 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0044AA48,?,00000000,00000000,00000000,00000000,0000000C), ref: 0044A315
                                • __fassign.LIBCMT ref: 0044A390
                                • __fassign.LIBCMT ref: 0044A3AB
                                • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0044A3D1
                                • WriteFile.KERNEL32(?,00000000,00000000,0044AA48,00000000,?,?,?,?,?,?,?,?,?,0044AA48,?), ref: 0044A3F0
                                • WriteFile.KERNEL32(?,?,00000001,0044AA48,00000000,?,?,?,?,?,?,?,?,?,0044AA48,?), ref: 0044A429
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                • String ID:
                                • API String ID: 1324828854-0
                                • Opcode ID: 19793b4b6baa09b5fac30a83039e1f9c1b1fc09f5707b87a30c95e6118fc2717
                                • Instruction ID: 781c03a50f1c813746d4e14bf3c61566c92396d5579059589c4d950ed669b936
                                • Opcode Fuzzy Hash: 19793b4b6baa09b5fac30a83039e1f9c1b1fc09f5707b87a30c95e6118fc2717
                                • Instruction Fuzzy Hash: 6551C474E002499FDB10CFA8D845AEEBBF4EF09300F14412BE955E7291E774A951CB6A
                                Function 00401768 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 142threadCOMMON
                                Download Yara Rule
                                APIs
                                • ExitThread.KERNEL32 ref: 004017F4
                                  • Part of subcall function 00433724: EnterCriticalSection.KERNEL32(00471D18,00476B98,00476C18,?,0040179E,00476C18), ref: 0043372F
                                  • Part of subcall function 00433724: LeaveCriticalSection.KERNEL32(00471D18,?,0040179E,00476C18), ref: 0043376C
                                • waveInUnprepareHeader.WINMM(?,00000020,00000000,?,00000020,00474EE0,00000000), ref: 00401902
                                  • Part of subcall function 00433AB0: __onexit.LIBCMT ref: 00433AB6
                                • __Init_thread_footer.LIBCMT ref: 004017BC
                                  • Part of subcall function 004336DA: EnterCriticalSection.KERNEL32(00471D18,00476C18,?,004017C1,00476C18,00000000), ref: 004336E4
                                  • Part of subcall function 004336DA: LeaveCriticalSection.KERNEL32(00471D18,?,004017C1,00476C18,00000000), ref: 00433717
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CriticalSection$EnterLeave$ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
                                • String ID: XMG$NG$NG
                                • API String ID: 1596592924-1283814050
                                • Opcode ID: 049ea5e99301cc38dcf3b8d8204034d1c34195053c1413973ec808052a68a742
                                • Instruction ID: a5e0bc9ac4bbc073a85812dd1d3adb1d2a3c84d0b98f0a89840e4e641ba94373
                                • Opcode Fuzzy Hash: 049ea5e99301cc38dcf3b8d8204034d1c34195053c1413973ec808052a68a742
                                • Instruction Fuzzy Hash: 5341B4712042008BC329FB65DD96AAE7395EB94318F10453FF54AA31F2DF389986CB5E
                                Function 00412D60 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON
                                Download Yara Rule
                                APIs
                                • RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00020019,?), ref: 00412D99
                                  • Part of subcall function 00412A82: RegQueryInfoKeyW.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00412AF5
                                  • Part of subcall function 00412A82: RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?,?,00000000,?,?,?,?), ref: 00412B24
                                  • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                • RegCloseKey.ADVAPI32(TeFTeF,00466554,00466554,00466900,00466900,00000071), ref: 00412F09
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseEnumInfoOpenQuerysend
                                • String ID: TeFTeF$NG$TG$TG
                                • API String ID: 3114080316-826076573
                                • Opcode ID: ef3d715ac45e846cf293c7095df0ecaaeadf93ac868802e0404002ad93d2dcb7
                                • Instruction ID: 217e792c851e8857c64f97df11b7492b8bc11e7bd79a931969a0b124146415da
                                • Opcode Fuzzy Hash: ef3d715ac45e846cf293c7095df0ecaaeadf93ac868802e0404002ad93d2dcb7
                                • Instruction Fuzzy Hash: ED41A1316042005BD224F725D8A2AEF7395AFD0308F50843FF94A671E2EF7C5D4986AE
                                Function 00437C90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                Download Yara Rule
                                APIs
                                • _ValidateLocalCookies.LIBCMT ref: 00437CBB
                                • ___except_validate_context_record.LIBVCRUNTIME ref: 00437CC3
                                • _ValidateLocalCookies.LIBCMT ref: 00437D51
                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00437D7C
                                • _ValidateLocalCookies.LIBCMT ref: 00437DD1
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                • String ID: csm
                                • API String ID: 1170836740-1018135373
                                • Opcode ID: aa3d4919f1f4f4d80e89904e4371bf405584d61001c3cef2fa7c5d8f818954ed
                                • Instruction ID: 1103995f59bc857a00dd0af833384e4a9f5f4a2e3f3cb1d3a3c35a3a433dd29e
                                • Opcode Fuzzy Hash: aa3d4919f1f4f4d80e89904e4371bf405584d61001c3cef2fa7c5d8f818954ed
                                • Instruction Fuzzy Hash: 4E410674A042099BCF20DF29C844AAE7BA5AF4C328F14905AEC55AB392D739DD45CF98
                                Function 0040B6EA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 85COMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 004125EB: RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 0041260F
                                  • Part of subcall function 004125EB: RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 0041262C
                                  • Part of subcall function 004125EB: RegCloseKey.KERNELBASE(?), ref: 00412637
                                • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040B76C
                                • PathFileExistsA.SHLWAPI(?), ref: 0040B779
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                                • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                                • API String ID: 1133728706-4073444585
                                • Opcode ID: 6cd08e79fec9498d8f67f87e1687e8f69eb0f754fe9d9fadae2f0cf12171c3c7
                                • Instruction ID: 7ed93d3ebd4d115a7197ccd8f2df160251767479400bef64a6787df62d4369c8
                                • Opcode Fuzzy Hash: 6cd08e79fec9498d8f67f87e1687e8f69eb0f754fe9d9fadae2f0cf12171c3c7
                                • Instruction Fuzzy Hash: 29215C31A1410966CB04F7B2CCA69EE7764AE94318F40013FA902771D2EF789A4986DE
                                Function 00455B13 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 396a34441b2c9a9a7814c24407a38ab4a494b32591bfb8fd78392877a88cf185
                                • Instruction ID: 890753aa9dfb888b2a1585f98a5e225511b13b718af609ae416a1884f745cca0
                                • Opcode Fuzzy Hash: 396a34441b2c9a9a7814c24407a38ab4a494b32591bfb8fd78392877a88cf185
                                • Instruction Fuzzy Hash: 3A112472504A15BFDB206F729C08D3B3AACEB82736F20016EFC15D7282DE38C800C669
                                Function 0040FCC7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON
                                Download Yara Rule
                                APIs
                                • std::_Lockit::_Lockit.LIBCPMT ref: 0040FCD4
                                • int.LIBCPMT ref: 0040FCE7
                                  • Part of subcall function 0040CFB3: std::_Lockit::_Lockit.LIBCPMT ref: 0040CFC4
                                  • Part of subcall function 0040CFB3: std::_Lockit::~_Lockit.LIBCPMT ref: 0040CFDE
                                • std::_Facet_Register.LIBCPMT ref: 0040FD23
                                • std::_Lockit::~_Lockit.LIBCPMT ref: 0040FD49
                                • __CxxThrowException@8.LIBVCRUNTIME ref: 0040FD65
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                • String ID: xkG
                                • API String ID: 2536120697-3406988965
                                • Opcode ID: 745172001c34bd9b9eb19fc62288704ab19ca1116009169556603c3d400c35e8
                                • Instruction ID: 7cf641d0f45d7e480cf6c67891cb53e845b1d2cd586d61112ae60f6436568b55
                                • Opcode Fuzzy Hash: 745172001c34bd9b9eb19fc62288704ab19ca1116009169556603c3d400c35e8
                                • Instruction Fuzzy Hash: 3B11F032900119A7CB14FBA5D8429DEB7689E55358F10013BF809B72D1EB3CAF49C7D9
                                Function 0041A726 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68networkfileCOMMON
                                Download Yara Rule
                                APIs
                                • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041A749
                                • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041A75F
                                • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041A778
                                • InternetCloseHandle.WININET(00000000), ref: 0041A7BE
                                • InternetCloseHandle.WININET(00000000), ref: 0041A7C1
                                Strings
                                • http://geoplugin.net/json.gp, xrefs: 0041A759
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Internet$CloseHandleOpen$FileRead
                                • String ID: http://geoplugin.net/json.gp
                                • API String ID: 3121278467-91888290
                                • Opcode ID: 077458e59a231b2074e876f872657da35922cc2e78b033784f3861cce5f011bb
                                • Instruction ID: dd066ffe0ad47051801ff1a9504fa95a24023bf504f9cdcf24902ddc36d2e50e
                                • Opcode Fuzzy Hash: 077458e59a231b2074e876f872657da35922cc2e78b033784f3861cce5f011bb
                                • Instruction Fuzzy Hash: C311947110A3126BD624EB169C85DBF7BECEF86765F00043EF845A2191DF68D848C6BA
                                Function 0044FEEB Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 0044FC32: _free.LIBCMT ref: 0044FC5B
                                • _free.LIBCMT ref: 0044FF39
                                  • Part of subcall function 00446CD5: HeapFree.KERNEL32(00000000,00000000,?,0044FC60,?,00000000,?,00000000,?,0044FF04,?,00000007,?,?,00450415,?), ref: 00446CEB
                                  • Part of subcall function 00446CD5: GetLastError.KERNEL32(?,?,0044FC60,?,00000000,?,00000000,?,0044FF04,?,00000007,?,?,00450415,?,?), ref: 00446CFD
                                • _free.LIBCMT ref: 0044FF44
                                • _free.LIBCMT ref: 0044FF4F
                                • _free.LIBCMT ref: 0044FFA3
                                • _free.LIBCMT ref: 0044FFAE
                                • _free.LIBCMT ref: 0044FFB9
                                • _free.LIBCMT ref: 0044FFC4
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: _free$ErrorFreeHeapLast
                                • String ID:
                                • API String ID: 776569668-0
                                • Opcode ID: 7c29d87e7d6a666a6374703866dd42c53a280d6db8acc668fe4e1522d65ba280
                                • Instruction ID: 7d3bb130547cbd64d3bc6acdbb054c191a8682768e3bc5df2cfa43195c7f437f
                                • Opcode Fuzzy Hash: 7c29d87e7d6a666a6374703866dd42c53a280d6db8acc668fe4e1522d65ba280
                                • Instruction Fuzzy Hash: 3611603158175CAAE930B7B2CC87FCB779CFF01744F804C2EB69B66052DA2CB90A5655
                                Function 00406815 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                                Download Yara Rule
                                APIs
                                • CoInitializeEx.OLE32(00000000,00000002,00000000,C:\Users\user\Desktop\Material Requirments.pif.exe), ref: 00406835
                                  • Part of subcall function 00406764: _wcslen.LIBCMT ref: 00406788
                                  • Part of subcall function 00406764: CoGetObject.OLE32(?,00000024,004669B0,00000000), ref: 004067E9
                                • CoUninitialize.OLE32 ref: 0040688E
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: InitializeObjectUninitialize_wcslen
                                • String ID: C:\Users\user\Desktop\Material Requirments.pif.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                                • API String ID: 3851391207-2666340809
                                • Opcode ID: f62f8ea22737c4132ff5b3dac93a03cf3a5d885852b0606909ed978fbfad8032
                                • Instruction ID: bf5204b976fdd256b066cceb308157ad377b3c08e3874fea13dbf5f4dff6080c
                                • Opcode Fuzzy Hash: f62f8ea22737c4132ff5b3dac93a03cf3a5d885852b0606909ed978fbfad8032
                                • Instruction Fuzzy Hash: F20180722023117FE2287B21DC0EF7B6658DB4176AF12413FF946A71C1EAA9AC014679
                                Function 0040FFAA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59COMMON
                                Download Yara Rule
                                APIs
                                • std::_Lockit::_Lockit.LIBCPMT ref: 0040FFB7
                                • int.LIBCPMT ref: 0040FFCA
                                  • Part of subcall function 0040CFB3: std::_Lockit::_Lockit.LIBCPMT ref: 0040CFC4
                                  • Part of subcall function 0040CFB3: std::_Lockit::~_Lockit.LIBCPMT ref: 0040CFDE
                                • std::_Facet_Register.LIBCPMT ref: 00410006
                                • std::_Lockit::~_Lockit.LIBCPMT ref: 0041002C
                                • __CxxThrowException@8.LIBVCRUNTIME ref: 00410048
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                • String ID: pmG
                                • API String ID: 2536120697-2472243355
                                • Opcode ID: 4f6bc15c8702302aaf3e33896adc2ba0184b2b91d9f53c7c64f28aa4f60572c7
                                • Instruction ID: 7757f8b08a06b45aa46d7f93aac2e311949306114fe400d1b3bff67def6a62fd
                                • Opcode Fuzzy Hash: 4f6bc15c8702302aaf3e33896adc2ba0184b2b91d9f53c7c64f28aa4f60572c7
                                • Instruction Fuzzy Hash: D911B231900419EBCB14FBA5D9429DD7B689E58358F10016FF40567191EB78AF86C789
                                Function 0040B2A8 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48fileCOMMON
                                Download Yara Rule
                                APIs
                                • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040B2E4
                                • GetLastError.KERNEL32 ref: 0040B2EE
                                Strings
                                • UserProfile, xrefs: 0040B2B4
                                • [Chrome Cookies found, cleared!], xrefs: 0040B314
                                • [Chrome Cookies not found], xrefs: 0040B308
                                • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040B2AF
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: DeleteErrorFileLast
                                • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                                • API String ID: 2018770650-304995407
                                • Opcode ID: e5f85b3b939c5db4f545af9093b474aac00542f85bfaa8cb994e63b1acc3a09a
                                • Instruction ID: 9d7a183bab8cffc7e176200adf3036985cfece21d6991fc3b8afe8d0fe8b9813
                                • Opcode Fuzzy Hash: e5f85b3b939c5db4f545af9093b474aac00542f85bfaa8cb994e63b1acc3a09a
                                • Instruction Fuzzy Hash: AB01623565010557CB0477B6DD6B9AF3628ED51718B60013FF802771E2FE3A990586DE
                                Function 0041C0BB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47memoryCOMMON
                                Download Yara Rule
                                APIs
                                • AllocConsole.KERNEL32(004750FC), ref: 0041C0C4
                                • ShowWindow.USER32(00000000,00000000), ref: 0041C0DD
                                • SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041C102
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Console$AllocOutputShowWindow
                                • String ID: Remcos v$6.0.0 Pro$CONOUT$
                                • API String ID: 2425139147-3561919337
                                • Opcode ID: 51f71f4df576cdb042b408fdcee2c306aad9b55f4cf694b49fe88f2f6d88a06c
                                • Instruction ID: 9cd6404a4583bb7861016a5e8077681a34a6ce6b29b6da971a73374578d830bb
                                • Opcode Fuzzy Hash: 51f71f4df576cdb042b408fdcee2c306aad9b55f4cf694b49fe88f2f6d88a06c
                                • Instruction Fuzzy Hash: 750121B1A80304BADA10F7F19D4BF9976AC6B14B09F500426BA05A70C2EEB8A554462D
                                Function 0041A128 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30sleepCOMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                • GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041A15A
                                • PlaySoundW.WINMM(00000000,00000000), ref: 0041A168
                                • Sleep.KERNEL32(00002710), ref: 0041A16F
                                • PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041A178
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: PlaySound$HandleLocalModuleSleepTime
                                • String ID: Alarm triggered$`#v
                                • API String ID: 614609389-3049340936
                                • Opcode ID: 224ded81f484124a95ac86677f3d4cb807273b88d112512e79d01104f451d68d
                                • Instruction ID: 198adcd2ac8b5b4b9acde76a755fda1533c143b191b85f9fe5233f4cbfc21951
                                • Opcode Fuzzy Hash: 224ded81f484124a95ac86677f3d4cb807273b88d112512e79d01104f451d68d
                                • Instruction Fuzzy Hash: 79E01A22A04261379520337B7D0FD6F3D28EAC7B65741006FF905A6192EE580811C6FB
                                Function 0043980C Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                                Download Yara Rule
                                APIs
                                • __allrem.LIBCMT ref: 00439999
                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004399B5
                                • __allrem.LIBCMT ref: 004399CC
                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004399EA
                                • __allrem.LIBCMT ref: 00439A01
                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00439A1F
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                • String ID:
                                • API String ID: 1992179935-0
                                • Opcode ID: 0ae614c173eb78e86b7740a0af62e3ed2d95487e4201ebb1b393f3e720c8905d
                                • Instruction ID: 5399b0f9a6461ae69e9bde9777a653eaf6085cdcce353b40ae7049a42401d5b7
                                • Opcode Fuzzy Hash: 0ae614c173eb78e86b7740a0af62e3ed2d95487e4201ebb1b393f3e720c8905d
                                • Instruction Fuzzy Hash: 15810B72A00706ABE724BA79CC41B6B73E89F89768F24522FF411D7781E7B8DD008758
                                Function 00444D4D Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: __cftoe
                                • String ID:
                                • API String ID: 4189289331-0
                                • Opcode ID: ed4c2069ac0ffc91df81197354b47f6ed5574271ff05b931a06937d95d85a4e1
                                • Instruction ID: 890c16c57639ce4616fdae23c1b2cf08611ffd87950db76db0bf4773250d0152
                                • Opcode Fuzzy Hash: ed4c2069ac0ffc91df81197354b47f6ed5574271ff05b931a06937d95d85a4e1
                                • Instruction Fuzzy Hash: 2C512972900205ABFB249BA98C41FAF77A9EFC8324F24411FF815D6292DB3DDD11966C
                                Function 00403DE7 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 135sleepCOMMON
                                Download Yara Rule
                                APIs
                                • Sleep.KERNEL32(00000000), ref: 00403E8A
                                  • Part of subcall function 00403FCD: __EH_prolog.LIBCMT ref: 00403FD2
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: H_prologSleep
                                • String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
                                • API String ID: 3469354165-3054508432
                                • Opcode ID: 66793f8b6132c61a45b0e58eea8312f11c3bef8f76c871069c2479bb9e415dcc
                                • Instruction ID: 0fabaa65846f565374d927adde4572b2cc1454b627dc53539f04e4ca1ee376cc
                                • Opcode Fuzzy Hash: 66793f8b6132c61a45b0e58eea8312f11c3bef8f76c871069c2479bb9e415dcc
                                • Instruction Fuzzy Hash: 4641B031A0420196C614FF75C956AAD3BA59B81708F00453FF809A72E6DF7C9A85C7CF
                                Function 00419FE2 Relevance: 9.1, APIs: 6, Instructions: 66serviceCOMMON
                                Download Yara Rule
                                APIs
                                • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,?,00000000,?,?,004196FD,00000000,00000000), ref: 00419FF2
                                • OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,00000000,?,?,004196FD,00000000,00000000), ref: 0041A006
                                • CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,004196FD,00000000,00000000), ref: 0041A013
                                • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,004196FD), ref: 0041A048
                                • CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,004196FD,00000000,00000000), ref: 0041A05A
                                • CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,004196FD,00000000,00000000), ref: 0041A05D
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Service$CloseHandle$Open$ChangeConfigManager
                                • String ID:
                                • API String ID: 493672254-0
                                • Opcode ID: b46dce82581a2f7b88cac3f7832bc52f1439873322d40ebe50cc19c448b70ea5
                                • Instruction ID: 3721d8981427c9c50277447f2eb78ca90bee9705940f35750f03ddb94c099399
                                • Opcode Fuzzy Hash: b46dce82581a2f7b88cac3f7832bc52f1439873322d40ebe50cc19c448b70ea5
                                • Instruction Fuzzy Hash: 28016D315062107ED2111F349C0EEBF3E1CDF567B1F00022FF522A22D2DE69CE8981AA
                                Function 00438016 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • GetLastError.KERNEL32(?,?,0043800D,004379C1), ref: 00438024
                                • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00438032
                                • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043804B
                                • SetLastError.KERNEL32(00000000,?,0043800D,004379C1), ref: 0043809D
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ErrorLastValue___vcrt_
                                • String ID:
                                • API String ID: 3852720340-0
                                • Opcode ID: 38d24d1e7ef4a0202574c8ec5187cf39076f8d2e51220313e93c30632868403e
                                • Instruction ID: c897193d57ecee64636fe05851fbd3cadc70b6e754ca2b2668497838eaebe06c
                                • Opcode Fuzzy Hash: 38d24d1e7ef4a0202574c8ec5187cf39076f8d2e51220313e93c30632868403e
                                • Instruction Fuzzy Hash: DC0190321083416DFB2823756C465377B68E709378F21123FF328515F1EF994C44514C
                                Function 004470CF Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • GetLastError.KERNEL32(?,?,0043952C,?,?,?,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B), ref: 004470D3
                                • _free.LIBCMT ref: 00447106
                                • _free.LIBCMT ref: 0044712E
                                • SetLastError.KERNEL32(00000000,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B,?,00000041,00000000,00000000), ref: 0044713B
                                • SetLastError.KERNEL32(00000000,0043E6DD,?,?,?,?,00000000,?,?,0042D05E,0000003B,?,00000041,00000000,00000000), ref: 00447147
                                • _abort.LIBCMT ref: 0044714D
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ErrorLast$_free$_abort
                                • String ID:
                                • API String ID: 3160817290-0
                                • Opcode ID: ae40a63e46beb22daa4956e078090859b5f7183b7e2bf3c5c9b8e84b2b7f2479
                                • Instruction ID: 03a1e9305cc52ab1e573739f72da4c843e3c1f7cd4612cbd08a2c6f68691a865
                                • Opcode Fuzzy Hash: ae40a63e46beb22daa4956e078090859b5f7183b7e2bf3c5c9b8e84b2b7f2479
                                • Instruction Fuzzy Hash: F2F0F931508B1027F612777A6C46E1B15269BC17B6B26002FF509A6392EF2C8C07911D
                                Function 00419E16 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON
                                Download Yara Rule
                                APIs
                                • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E25
                                • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E39
                                • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E46
                                • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E55
                                • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E67
                                • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E6A
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Service$CloseHandle$Open$ControlManager
                                • String ID:
                                • API String ID: 221034970-0
                                • Opcode ID: 6cffee77b9f779f0a9d40924c8a8f449cfc65dce83fe416e78e534f836937cf2
                                • Instruction ID: 47980c42e9b022aba05d73d81e1ae7aa31c0ed05cef52b60765f03c540efa169
                                • Opcode Fuzzy Hash: 6cffee77b9f779f0a9d40924c8a8f449cfc65dce83fe416e78e534f836937cf2
                                • Instruction Fuzzy Hash: 44F062319003186BD611AB65DC89EBF3B6CDB45BA1F01002AF906A21D2DF78DD4A95F5
                                Function 00419F7D Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON
                                Download Yara Rule
                                APIs
                                • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419F8C
                                • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419FA0
                                • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419FAD
                                • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419FBC
                                • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419FCE
                                • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419FD1
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Service$CloseHandle$Open$ControlManager
                                • String ID:
                                • API String ID: 221034970-0
                                • Opcode ID: 7c32428509ca320cd591c44b1795e2662844b10ed5f95448141cb1e23587b604
                                • Instruction ID: cbb6f8d25e78bf3f904679f952f169c6c08018e661e4ba535c0ca8fa304c3d8e
                                • Opcode Fuzzy Hash: 7c32428509ca320cd591c44b1795e2662844b10ed5f95448141cb1e23587b604
                                • Instruction Fuzzy Hash: 68F0C2315002147BD2116B24DC49EBF3A6CDB45BA1B01002AFA06A2192DF78CE4A85B8
                                Function 00419F18 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON
                                Download Yara Rule
                                APIs
                                • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F27
                                • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F3B
                                • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F48
                                • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F57
                                • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F69
                                • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F6C
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Service$CloseHandle$Open$ControlManager
                                • String ID:
                                • API String ID: 221034970-0
                                • Opcode ID: a17f75a1f740233528e2008b57e250a9a65abdcdfcc5519bffe83f2b646a764e
                                • Instruction ID: 95d7f5aa039a93820bb4883d7663946178ed8a5ec9cf590f88e81ba893971d89
                                • Opcode Fuzzy Hash: a17f75a1f740233528e2008b57e250a9a65abdcdfcc5519bffe83f2b646a764e
                                • Instruction Fuzzy Hash: 7EF062715003147BD2116B65DC4AEBF3B6CDB45BA1B01002AFA06B2192DF78DD4A96B9
                                Function 00412A82 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 173registryCOMMON
                                Download Yara Rule
                                APIs
                                • RegQueryInfoKeyW.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00412AF5
                                • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?,?,00000000,?,?,?,?), ref: 00412B24
                                • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,?,?,00002710,?,?,?,00000000,?,?,?,?), ref: 00412BC5
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Enum$InfoQueryValue
                                • String ID: [regsplt]$TG
                                • API String ID: 3554306468-170812940
                                • Opcode ID: 34d6c8e2acd3d59fb8885f4b8f970c4f98dccc6af5c320b0ccc238c7c972e81b
                                • Instruction ID: eeb20da9b05a32976bf12a6402f5e40020a9f6991e42d7db5c0f7bae6a1218cc
                                • Opcode Fuzzy Hash: 34d6c8e2acd3d59fb8885f4b8f970c4f98dccc6af5c320b0ccc238c7c972e81b
                                • Instruction Fuzzy Hash: C5511E72108345AED310EF61D985DEFB7ECEF84704F00492EB585D2191EB74EA088BAA
                                Function 0041AA28 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 90COMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 0041265C: RegOpenKeyExW.ADVAPI32(80000001,00000400,00000000,00020019,?), ref: 0041267E
                                  • Part of subcall function 0041265C: RegQueryValueExW.ADVAPI32(?,0040E18D,00000000,00000000,?,00000400), ref: 0041269D
                                  • Part of subcall function 0041265C: RegCloseKey.ADVAPI32(?), ref: 004126A6
                                  • Part of subcall function 0041B366: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B377
                                • _wcslen.LIBCMT ref: 0041AB01
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseCurrentOpenProcessQueryValue_wcslen
                                • String ID: .exe$http\shell\open\command$program files (x86)\$program files\
                                • API String ID: 37874593-4246244872
                                • Opcode ID: a5749c8956b77a318f1d95c765604c41d6cfc3eef250b538589407e4e8b7ac6d
                                • Instruction ID: 944f249e3467cd2310196e71108a033bc811508d99a3a404dc4e3305fa2889c9
                                • Opcode Fuzzy Hash: a5749c8956b77a318f1d95c765604c41d6cfc3eef250b538589407e4e8b7ac6d
                                • Instruction Fuzzy Hash: 8621A772B001042BDB04B6B58C96EFE366D9B84318B10087FF452B71D3EE3C9D554269
                                Function 0040AE58 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 87COMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 00433724: EnterCriticalSection.KERNEL32(00471D18,00476B98,00476C18,?,0040179E,00476C18), ref: 0043372F
                                  • Part of subcall function 00433724: LeaveCriticalSection.KERNEL32(00471D18,?,0040179E,00476C18), ref: 0043376C
                                  • Part of subcall function 00433AB0: __onexit.LIBCMT ref: 00433AB6
                                • __Init_thread_footer.LIBCMT ref: 0040AEA7
                                  • Part of subcall function 004336DA: EnterCriticalSection.KERNEL32(00471D18,00476C18,?,004017C1,00476C18,00000000), ref: 004336E4
                                  • Part of subcall function 004336DA: LeaveCriticalSection.KERNEL32(00471D18,?,004017C1,00476C18,00000000), ref: 00433717
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit
                                • String ID: [End of clipboard]$[Text copied to clipboard]$TmG$XmG
                                • API String ID: 2974294136-1855599884
                                • Opcode ID: 4d35a61380fbb57a5e3a9ab5923bfdef1273c8ee5c187e8356d8de487304bc42
                                • Instruction ID: 2623299308dd9d50029d580546b1e3590cd03a5acc49d0be8ee118f943746456
                                • Opcode Fuzzy Hash: 4d35a61380fbb57a5e3a9ab5923bfdef1273c8ee5c187e8356d8de487304bc42
                                • Instruction Fuzzy Hash: FB216131A102155ACB24FB65D8929EE7775AF54318F10403FF506772E2EF3C6E4A868D
                                Function 0040A876 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67timeCOMMON
                                Download Yara Rule
                                APIs
                                • GetLocalTime.KERNEL32(?,Offline Keylogger Started,00475108), ref: 0040A884
                                • wsprintfW.USER32 ref: 0040A905
                                  • Part of subcall function 00409D58: SetEvent.KERNEL32(?,?,00000000,0040A91C,00000000), ref: 00409D84
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: EventLocalTimewsprintf
                                • String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
                                • API String ID: 1497725170-248792730
                                • Opcode ID: 4b6b049d2de0873e728e7f1e3b8e95fd399117c76be52b43ac04eee48d18b53a
                                • Instruction ID: eacaba0d290b76b22f399a57737f65b18f8a023abca8575ba11697f47f6457b1
                                • Opcode Fuzzy Hash: 4b6b049d2de0873e728e7f1e3b8e95fd399117c76be52b43ac04eee48d18b53a
                                • Instruction Fuzzy Hash: F1115172500118AACB18FB96EC56CFF77B8AE48715B00013FF542621D1EF7C5A86C6E9
                                Function 00409D97 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                                Download Yara Rule
                                APIs
                                • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00409E6F), ref: 00409DCD
                                • GetFileSize.KERNEL32(00000000,00000000,?,?,?,00409E6F), ref: 00409DDC
                                • Sleep.KERNEL32(00002710,?,?,?,00409E6F), ref: 00409E09
                                • CloseHandle.KERNEL32(00000000,?,?,?,00409E6F), ref: 00409E10
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: File$CloseCreateHandleSizeSleep
                                • String ID: pQG
                                • API String ID: 1958988193-3769108836
                                • Opcode ID: 5dce2fd936a20e8e102229ef206476f07ca7b553fea7baf7bdbde2be5fdf884a
                                • Instruction ID: 007c54a35b5ab6fada7f5b2b4f31fda992404cc28ee9ac254c5285dcec39f6dc
                                • Opcode Fuzzy Hash: 5dce2fd936a20e8e102229ef206476f07ca7b553fea7baf7bdbde2be5fdf884a
                                • Instruction Fuzzy Hash: 0911E730640B406AE720E724D88972F7B9AAB81316F44047EF18566AE3CA799CD5C29D
                                Function 0041CC2A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54registryCOMMON
                                Download Yara Rule
                                APIs
                                • RegisterClassExA.USER32(00000030), ref: 0041CC77
                                • CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041CC92
                                • GetLastError.KERNEL32 ref: 0041CC9C
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ClassCreateErrorLastRegisterWindow
                                • String ID: 0$MsgWindowClass
                                • API String ID: 2877667751-2410386613
                                • Opcode ID: 2bfcb1dee2ed81dd37ad325623522de50802513b554cdfc95296743f6fff5b81
                                • Instruction ID: c9edb97a89f7ec8dfbaa779d36c224b53f51aa00da94833f787b12e8c600820c
                                • Opcode Fuzzy Hash: 2bfcb1dee2ed81dd37ad325623522de50802513b554cdfc95296743f6fff5b81
                                • Instruction Fuzzy Hash: 2001E9B1D1021DAF8B00DF9ADCC49EFFBBDBE49355B50452AE414B6100EB708A458AA5
                                Function 004069BA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42processCOMMON
                                Download Yara Rule
                                APIs
                                • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 00406A00
                                • CloseHandle.KERNEL32(?), ref: 00406A0F
                                • CloseHandle.KERNEL32(?), ref: 00406A14
                                Strings
                                • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 004069F6
                                • C:\Windows\System32\cmd.exe, xrefs: 004069FB
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseHandle$CreateProcess
                                • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                                • API String ID: 2922976086-4183131282
                                • Opcode ID: 76fab65495b0fd8f7af94722782b38f5ec20939b495d63d65361185c7f15ad50
                                • Instruction ID: 0865c4136dfbb59e32125d892e445ee09242962a1e3dc4bc305b740a121ed375
                                • Opcode Fuzzy Hash: 76fab65495b0fd8f7af94722782b38f5ec20939b495d63d65361185c7f15ad50
                                • Instruction Fuzzy Hash: 68F090B690029D7ACB20ABD69C0EECF7F3CEBC5B11F01046ABA04A2051DA706104CAB8
                                Function 004064D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                                Download Yara Rule
                                Strings
                                • 8SG, xrefs: 0040693F
                                • C:\Users\user\Desktop\Material Requirments.pif.exe, xrefs: 00406927
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID:
                                • String ID: 8SG$C:\Users\user\Desktop\Material Requirments.pif.exe
                                • API String ID: 0-223660685
                                • Opcode ID: f60ababe8ad369c153f0051bffe9553d65e8225cf88651c1e7be23108c4affbd
                                • Instruction ID: ac3f053366391772af188fc274efb03f25e4c049f181d6a95d7665767018bac5
                                • Opcode Fuzzy Hash: f60ababe8ad369c153f0051bffe9553d65e8225cf88651c1e7be23108c4affbd
                                • Instruction Fuzzy Hash: 4FF0F6B17022109BDB103B34AD1966A3A45DB40346F01807BF98BFA6E2DF7C8851C68C
                                Function 004427E9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0044279A,?,?,0044273A,?), ref: 00442809
                                • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044281C
                                • FreeLibrary.KERNEL32(00000000,?,?,?,0044279A,?,?,0044273A,?), ref: 0044283F
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: AddressFreeHandleLibraryModuleProc
                                • String ID: CorExitProcess$mscoree.dll
                                • API String ID: 4061214504-1276376045
                                • Opcode ID: 263cd25904221f4c100099ecbb428eb8354416072efb1e7fc04c1483da550fa7
                                • Instruction ID: e557d05a47d06e8d32a7f66c2c4e22cdfb14d47a79db446b90f8ad9ee3cbc836
                                • Opcode Fuzzy Hash: 263cd25904221f4c100099ecbb428eb8354416072efb1e7fc04c1483da550fa7
                                • Instruction Fuzzy Hash: 8CF0A430900309FBDB119F94DD09B9EBFB4EB08753F4041B9F805A2261DF789D44CA98
                                Function 00404AB1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                                Download Yara Rule
                                APIs
                                • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00476B98,0040483F,00000001,?,?,00000000,00476B98,004017F3), ref: 00404AED
                                • SetEvent.KERNEL32(?,?,?,00000000,00476B98,004017F3), ref: 00404AF9
                                • WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00476B98,004017F3), ref: 00404B04
                                • CloseHandle.KERNEL32(?,?,?,00000000,00476B98,004017F3), ref: 00404B0D
                                  • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                                • String ID: KeepAlive | Disabled
                                • API String ID: 2993684571-305739064
                                • Opcode ID: 409410e2ccf60630bcedbcef110c430914652ea83618af4c5fd3081a7e748f4a
                                • Instruction ID: 7c4d48bbaa8a7164c3353f7df4ad5523490a6ea0f3ebe4e46dcacb08dafaa92a
                                • Opcode Fuzzy Hash: 409410e2ccf60630bcedbcef110c430914652ea83618af4c5fd3081a7e748f4a
                                • Instruction Fuzzy Hash: 31F096B19047007BDB1137759D0B66B7F58AB46325F00096FF492A26F2DE39D8508B5E
                                Function 0041C07A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26COMMON
                                Download Yara Rule
                                APIs
                                • GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041C10D), ref: 0041C084
                                • GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?,?,?,?,?,?,0041C10D), ref: 0041C091
                                • SetConsoleTextAttribute.KERNEL32(00000000,0000000C,?,?,?,?,?,?,0041C10D), ref: 0041C09E
                                • SetConsoleTextAttribute.KERNEL32(00000000,?,?,?,?,?,?,?,0041C10D), ref: 0041C0B1
                                Strings
                                • ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041C0A4
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Console$AttributeText$BufferHandleInfoScreen
                                • String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
                                • API String ID: 3024135584-2418719853
                                • Opcode ID: 1559ced9db44309d12e9096fc874ef99716f3117c459c374921cc59209bdbdc6
                                • Instruction ID: f27d36e20d2a67c690befc106ea5cafab99e09d075a2dfca7d32a9b7008c9529
                                • Opcode Fuzzy Hash: 1559ced9db44309d12e9096fc874ef99716f3117c459c374921cc59209bdbdc6
                                • Instruction Fuzzy Hash: 57E04F62604348BBD30037F6AC4EDAB3B7CE784617B10092AF612A01D3ED7484468B79
                                Function 00401430 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 7libraryloaderCOMMON
                                Download Yara Rule
                                APIs
                                • GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 0040143A
                                • GetProcAddress.KERNEL32(00000000), ref: 00401441
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: AddressHandleModuleProc
                                • String ID: GetCursorInfo$User32.dll$`#v
                                • API String ID: 1646373207-1032071883
                                • Opcode ID: 0df56b3ea47fb749bec4bd55cc4ccf0acac8e18c0c6121f5027aebd44438a81f
                                • Instruction ID: d22651b824a9dcc27ed8a3983426188770e59c2792dec55b339c490717ece8d0
                                • Opcode Fuzzy Hash: 0df56b3ea47fb749bec4bd55cc4ccf0acac8e18c0c6121f5027aebd44438a81f
                                • Instruction Fuzzy Hash: 54B09B705457459BC600DBE15C4D7143D14A544703B104069F04791151DE7450008F1E
                                Function 004403AA Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: e7d596bc3d0421bf9cac477d4620df9db07248d82884fbf927ed0635f37dc7e5
                                • Instruction ID: 7c1105064789ab48ae90d42f937b6a9cbc34ac1ed42c20d541c6d1c3f1a57216
                                • Opcode Fuzzy Hash: e7d596bc3d0421bf9cac477d4620df9db07248d82884fbf927ed0635f37dc7e5
                                • Instruction Fuzzy Hash: 7671D371900216AFEF20CF54C884ABFBB75EF45310F14422BEA15A7281DB788C61CFA9
                                Function 00410BF1 Relevance: 7.7, APIs: 5, Instructions: 198memoryCOMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 00410691: SetLastError.KERNEL32(0000000D,00410C10,?,00000000), ref: 00410697
                                • GetNativeSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00410BED), ref: 00410C9C
                                • GetProcessHeap.KERNEL32(00000008,00000040,?,?,00000000), ref: 00410D02
                                • HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410D09
                                • SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00410E17
                                • SetLastError.KERNEL32(000000C1,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00410BED), ref: 00410E41
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ErrorLast$Heap$AllocInfoNativeProcessSystem
                                • String ID:
                                • API String ID: 3525466593-0
                                • Opcode ID: 5b761030cf84cfef50a77e8f1fc708b710696a941d42968a3fbf92de24ca1f36
                                • Instruction ID: e2f64966b18619331c3eea81ef564f6afd9e4387f8ea08f62d3b86939114ae32
                                • Opcode Fuzzy Hash: 5b761030cf84cfef50a77e8f1fc708b710696a941d42968a3fbf92de24ca1f36
                                • Instruction Fuzzy Hash: 8E61E570200305ABD710AF56C981BA77BA5BF84308F04451EF909CB382DBF8E8D5CB99
                                Function 0040E77B Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 0041B366: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B377
                                • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040E799
                                • Process32FirstW.KERNEL32(00000000,?), ref: 0040E7BD
                                • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E7CC
                                • CloseHandle.KERNEL32(00000000), ref: 0040E983
                                  • Part of subcall function 0041B392: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040E5A8,00000000,?,?,004750FC), ref: 0041B3A7
                                  • Part of subcall function 0041B588: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B5A0
                                  • Part of subcall function 0041B588: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B5B3
                                • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E974
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Process$OpenProcess32$Next$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                                • String ID:
                                • API String ID: 4269425633-0
                                • Opcode ID: c61dee4f57b21999593d720d4306505fc28c556769e0a9eb58b2de2ad4e15806
                                • Instruction ID: eccf11dc20c1a31a83cdfd33956dcb3d749eb3f266b118f2c15681f5292a9231
                                • Opcode Fuzzy Hash: c61dee4f57b21999593d720d4306505fc28c556769e0a9eb58b2de2ad4e15806
                                • Instruction Fuzzy Hash: F741CF311083455BC225FB61D891AEFB7E5AFA4304F50453EF849531E1EF389A49C65A
                                Function 004432A8 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: _free
                                • String ID:
                                • API String ID: 269201875-0
                                • Opcode ID: c6d5326bb826bef7d4312f682f8fd03de73532d4ef60da68ba97a8c78ea7af64
                                • Instruction ID: 036c3dfb054a6f01566e3cd8d28730a68c174e79056a6e67996f15c63748089b
                                • Opcode Fuzzy Hash: c6d5326bb826bef7d4312f682f8fd03de73532d4ef60da68ba97a8c78ea7af64
                                • Instruction Fuzzy Hash: F341D636A002049FEB20DF79C881A5EB7B5FF88718F1545AEE915EB351DA35EE01CB84
                                Function 004500E3 Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,0042D05E,?,?,?,00000001,?,?,00000001,0042D05E,0042D05E), ref: 00450130
                                • __alloca_probe_16.LIBCMT ref: 00450168
                                • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,0042D05E,?,?,?,00000001,?,?,00000001,0042D05E,0042D05E,?), ref: 004501B9
                                • GetStringTypeW.KERNEL32(00000001,00000000,00000000,00000001,?,?,?,00000001,?,?,00000001,0042D05E,0042D05E,?,00000002,?), ref: 004501CB
                                • __freea.LIBCMT ref: 004501D4
                                  • Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434633,?,?,00437437,?,?,00000000,00476B98,?,0040CD5A,00434633,?,?,?,?), ref: 00446D41
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                                • String ID:
                                • API String ID: 313313983-0
                                • Opcode ID: a35a8782e67536d42813ea0b7ba3d9e4ce30fcbba079d7384691d7d4bc2becc9
                                • Instruction ID: d7464a72994917abc30d80f71ec8451e4cba9cf5435b4dea42e63c5c2bdc5daf
                                • Opcode Fuzzy Hash: a35a8782e67536d42813ea0b7ba3d9e4ce30fcbba079d7384691d7d4bc2becc9
                                • Instruction Fuzzy Hash: 9631E132A0060AABDF249F65DC41DAF7BA5EB00311F05416AFC04E7252EB3ACD54CBA5
                                Function 0044E34B Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                Download Yara Rule
                                APIs
                                • GetEnvironmentStringsW.KERNEL32 ref: 0044E354
                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044E377
                                  • Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434633,?,?,00437437,?,?,00000000,00476B98,?,0040CD5A,00434633,?,?,?,?), ref: 00446D41
                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044E39D
                                • _free.LIBCMT ref: 0044E3B0
                                • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044E3BF
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                • String ID:
                                • API String ID: 336800556-0
                                • Opcode ID: acf4a8b8e0c6a284642e719f33289b9d1406958fd1c16c4e096d94de03d4fc8c
                                • Instruction ID: 5f1b7bba735f2dc00ee4e6ee14e94985e19ed078b50b1d1b699098eccd63c47a
                                • Opcode Fuzzy Hash: acf4a8b8e0c6a284642e719f33289b9d1406958fd1c16c4e096d94de03d4fc8c
                                • Instruction Fuzzy Hash: D50171726017157F73221A776C88C7B6A6DEAC2F65315012EFD05D3241DE698C0291B9
                                Function 00447153 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • GetLastError.KERNEL32(?,00000000,00000000,0043A9D2,00000000,?,?,0043AA56,00000000,00000000,00000000,00000000,00000000,00000000,00402C08,?), ref: 00447158
                                • _free.LIBCMT ref: 0044718D
                                • _free.LIBCMT ref: 004471B4
                                • SetLastError.KERNEL32(00000000), ref: 004471C1
                                • SetLastError.KERNEL32(00000000), ref: 004471CA
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ErrorLast$_free
                                • String ID:
                                • API String ID: 3170660625-0
                                • Opcode ID: c73b76ca02ce190c9082a6036dde6ca48763b4b9e088bcde2ec0a65c3a46cc10
                                • Instruction ID: 9627307c59aa3692a64de8377ee3c20019e30fe80ec8d82769d3f9bfdfbdb6fb
                                • Opcode Fuzzy Hash: c73b76ca02ce190c9082a6036dde6ca48763b4b9e088bcde2ec0a65c3a46cc10
                                • Instruction Fuzzy Hash: 3E01F97624CB102BB30267B95C85D2B2A29DBC17B6726012FF509A6392EF2C8C07515D
                                Function 0044F9AD Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • _free.LIBCMT ref: 0044F9C5
                                  • Part of subcall function 00446CD5: HeapFree.KERNEL32(00000000,00000000,?,0044FC60,?,00000000,?,00000000,?,0044FF04,?,00000007,?,?,00450415,?), ref: 00446CEB
                                  • Part of subcall function 00446CD5: GetLastError.KERNEL32(?,?,0044FC60,?,00000000,?,00000000,?,0044FF04,?,00000007,?,?,00450415,?,?), ref: 00446CFD
                                • _free.LIBCMT ref: 0044F9D7
                                • _free.LIBCMT ref: 0044F9E9
                                • _free.LIBCMT ref: 0044F9FB
                                • _free.LIBCMT ref: 0044FA0D
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: _free$ErrorFreeHeapLast
                                • String ID:
                                • API String ID: 776569668-0
                                • Opcode ID: 8a0a0e5e94a0327d1776c165067cf9b9603f8d21362122b3839296c578ae3d6e
                                • Instruction ID: 2de1f51a18cc7960585f1cc37bbb46b0208bdbaa703fd0d38dd13c161260ee8b
                                • Opcode Fuzzy Hash: 8a0a0e5e94a0327d1776c165067cf9b9603f8d21362122b3839296c578ae3d6e
                                • Instruction Fuzzy Hash: B5F012725042107BA620DF59FAC6D1773E9EA457247A5482BF18DEBA51C738FCC0865C
                                Function 004434F7 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                Download Yara Rule
                                APIs
                                • _free.LIBCMT ref: 00443515
                                  • Part of subcall function 00446CD5: HeapFree.KERNEL32(00000000,00000000,?,0044FC60,?,00000000,?,00000000,?,0044FF04,?,00000007,?,?,00450415,?), ref: 00446CEB
                                  • Part of subcall function 00446CD5: GetLastError.KERNEL32(?,?,0044FC60,?,00000000,?,00000000,?,0044FF04,?,00000007,?,?,00450415,?,?), ref: 00446CFD
                                • _free.LIBCMT ref: 00443527
                                • _free.LIBCMT ref: 0044353A
                                • _free.LIBCMT ref: 0044354B
                                • _free.LIBCMT ref: 0044355C
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: _free$ErrorFreeHeapLast
                                • String ID:
                                • API String ID: 776569668-0
                                • Opcode ID: 5455ce8706e3ca66a7bad791c73c4693f29d9b457f563819123ce72749b06e66
                                • Instruction ID: bf08c2b723e6da78e2f9a692d3f9dcffc94df7bb1312aea5ebb3a1bf48e2a6b8
                                • Opcode Fuzzy Hash: 5455ce8706e3ca66a7bad791c73c4693f29d9b457f563819123ce72749b06e66
                                • Instruction Fuzzy Hash: 4EF0FEB08011219FD726AF69BE414063BA0F709764346113BF45E66B71E7790982EB8E
                                Function 00416937 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 182threadwindowCOMMON
                                Download Yara Rule
                                APIs
                                • GetWindowThreadProcessId.USER32(?,?), ref: 0041694E
                                • GetWindowTextW.USER32(?,?,0000012C), ref: 00416980
                                • IsWindowVisible.USER32(?), ref: 00416987
                                  • Part of subcall function 0041B588: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B5A0
                                  • Part of subcall function 0041B588: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B5B3
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ProcessWindow$Open$TextThreadVisible
                                • String ID: 0VG
                                • API String ID: 3142014140-3748860515
                                • Opcode ID: a8703e7d4d6bf3501c9f468cbb6904cf6e8690617db06ea3ec6d2061fdd3fabc
                                • Instruction ID: a92d2c2722018a5f2df8734f3a85bf91d45912e01cb50305def5a483f7f9536a
                                • Opcode Fuzzy Hash: a8703e7d4d6bf3501c9f468cbb6904cf6e8690617db06ea3ec6d2061fdd3fabc
                                • Instruction Fuzzy Hash: FE71C3311082415AC335FB61D8A5ADFB3E4EFD4308F50493EB58A530E1EF74AA49CB9A
                                Function 0044D669 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                                Download Yara Rule
                                APIs
                                • _strpbrk.LIBCMT ref: 0044D6B8
                                • _free.LIBCMT ref: 0044D7D5
                                  • Part of subcall function 0043AA64: IsProcessorFeaturePresent.KERNEL32(00000017,0043AA36,?,?,00401962,?,?,00000000,?,?,0043AA56,00000000,00000000,00000000,00000000,00000000), ref: 0043AA66
                                  • Part of subcall function 0043AA64: GetCurrentProcess.KERNEL32(C0000417), ref: 0043AA88
                                  • Part of subcall function 0043AA64: TerminateProcess.KERNEL32(00000000), ref: 0043AA8F
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                                • String ID: *?$.
                                • API String ID: 2812119850-3972193922
                                • Opcode ID: 1e36796f2d45f2993e4ffcd96e44755c76a55d841708743db3b897d52c5181f8
                                • Instruction ID: 04f9c45711fae47bd805a28d6c684d852fff3551aaaea8338e0504d4b1d9eb7e
                                • Opcode Fuzzy Hash: 1e36796f2d45f2993e4ffcd96e44755c76a55d841708743db3b897d52c5181f8
                                • Instruction Fuzzy Hash: C251B175E00209AFEF14DFA9C881AAEBBB5EF58314F25416FE854E7301E6399E01CB54
                                Function 004428E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                Download Yara Rule
                                APIs
                                • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Material Requirments.pif.exe,00000104), ref: 00442924
                                • _free.LIBCMT ref: 004429EF
                                • _free.LIBCMT ref: 004429F9
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: _free$FileModuleName
                                • String ID: C:\Users\user\Desktop\Material Requirments.pif.exe
                                • API String ID: 2506810119-4084103714
                                • Opcode ID: db9d1aa85dcea3b1c8ddfa31d3e584e3ee6d315319dcc4eeb83d15cf894f1be9
                                • Instruction ID: 08a660f2d8e46f51ee0862092f41265a48d7a3eaa7bec75f040af8368b354bfd
                                • Opcode Fuzzy Hash: db9d1aa85dcea3b1c8ddfa31d3e584e3ee6d315319dcc4eeb83d15cf894f1be9
                                • Instruction Fuzzy Hash: E53193B1A00258AFEB21DF999E8199EBBBCEB85314F50406BF805A7311D6F84A41CB59
                                Function 00403A10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92sleepCOMMON
                                Download Yara Rule
                                APIs
                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00403A2A
                                  • Part of subcall function 0041AD43: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,00403A40), ref: 0041AD6A
                                  • Part of subcall function 0041789C: CloseHandle.KERNEL32(00403AB9,?,?,00403AB9,00466324), ref: 004178B2
                                  • Part of subcall function 0041789C: CloseHandle.KERNEL32($cF,?,?,00403AB9,00466324), ref: 004178BB
                                  • Part of subcall function 0041B825: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,00403AF3,00466324), ref: 0041B83E
                                • Sleep.KERNEL32(000000FA,00466324), ref: 00403AFC
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                                • String ID: /sort "Visit Time" /stext "$0NG
                                • API String ID: 368326130-3219657780
                                • Opcode ID: 7a973221d5641f562d52fb7b04ff48b5d8dbc95538142523317db5b8b23068d5
                                • Instruction ID: 03df4c4d2d4284c33795d9a7a6d048d6c9d09091ba23d5cef523323604a75e49
                                • Opcode Fuzzy Hash: 7a973221d5641f562d52fb7b04ff48b5d8dbc95538142523317db5b8b23068d5
                                • Instruction Fuzzy Hash: 88319531A0011456CB14FB76DC969EE7779AF80318F00007FF906B31D2EF385A4AC699
                                Function 004098A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                                Download Yara Rule
                                APIs
                                • CreateThread.KERNEL32(00000000,00000000,004099A9,00475108,00000000,00000000), ref: 0040992A
                                • CreateThread.KERNEL32(00000000,00000000,00409993,00475108,00000000,00000000), ref: 0040993A
                                • CreateThread.KERNEL32(00000000,00000000,004099B5,00475108,00000000,00000000), ref: 00409946
                                  • Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,Offline Keylogger Started,00475108), ref: 0040A884
                                  • Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CreateThread$LocalTimewsprintf
                                • String ID: Offline Keylogger Started
                                • API String ID: 465354869-4114347211
                                • Opcode ID: c1e66f0c11ae8ab3dfc6a8e7222d84969033f21af3559fcfcf1e44a48a48cc01
                                • Instruction ID: 15e43fcc554e39227c644a0273f32637653ac1eeca6ef832bd6c9a92d0497390
                                • Opcode Fuzzy Hash: c1e66f0c11ae8ab3dfc6a8e7222d84969033f21af3559fcfcf1e44a48a48cc01
                                • Instruction Fuzzy Hash: 0A1198B15003097AD224BA36CC86DBF7A5CDA813A8B40053EB845622D3EA785E14C6FB
                                Function 0040A611 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64threadCOMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,Offline Keylogger Started,00475108), ref: 0040A884
                                  • Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905
                                  • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                • CreateThread.KERNEL32(00000000,00000000,00409993,?,00000000,00000000), ref: 0040A691
                                • CreateThread.KERNEL32(00000000,00000000,004099B5,?,00000000,00000000), ref: 0040A69D
                                • CreateThread.KERNEL32(00000000,00000000,004099C1,?,00000000,00000000), ref: 0040A6A9
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CreateThread$LocalTime$wsprintf
                                • String ID: Online Keylogger Started
                                • API String ID: 112202259-1258561607
                                • Opcode ID: 615d195fca7a0605138569534ba1bf8f7e37ca07573ffd716c582b30c2906b12
                                • Instruction ID: 13545b77b67cc4507d33d8d8c8ff512a749ba16b8a43449315e0da64450a8124
                                • Opcode Fuzzy Hash: 615d195fca7a0605138569534ba1bf8f7e37ca07573ffd716c582b30c2906b12
                                • Instruction Fuzzy Hash: E80161A1A003193AE62076768C86DBF7A6DCA813A8F41043EF541662C3EA7D5D5582FA
                                Function 0044AC83 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • CloseHandle.KERNEL32(00000000,00000000,8@,?,0044ABA1,8@,0046ED38,0000000C), ref: 0044ACD9
                                • GetLastError.KERNEL32(?,0044ABA1,8@,0046ED38,0000000C), ref: 0044ACE3
                                • __dosmaperr.LIBCMT ref: 0044AD0E
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseErrorHandleLast__dosmaperr
                                • String ID: 8@
                                • API String ID: 2583163307-819625340
                                • Opcode ID: f11388ad4d481d826d75519938a9a20661ac3afaecb278e3b0e3570ed3326013
                                • Instruction ID: 727ae4bd5dc399200e14d16721253afac520870d53d00e52bc8525c117eb1139
                                • Opcode Fuzzy Hash: f11388ad4d481d826d75519938a9a20661ac3afaecb278e3b0e3570ed3326013
                                • Instruction Fuzzy Hash: 6F018836640A100BF3212634688573F67498B91B39F29022FF804872D2CE2D8CC1919F
                                Function 00404915 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60timethreadCOMMON
                                Download Yara Rule
                                APIs
                                • GetLocalTime.KERNEL32(?), ref: 00404946
                                • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00404994
                                • CreateThread.KERNEL32(00000000,00000000,00404B1D,?,00000000,00000000), ref: 004049A7
                                Strings
                                • KeepAlive | Enabled | Timeout: , xrefs: 0040495C
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Create$EventLocalThreadTime
                                • String ID: KeepAlive | Enabled | Timeout:
                                • API String ID: 2532271599-1507639952
                                • Opcode ID: 0c6cac375153df3ea685316185a18e015cdf0bae4e64619a5b2a5503804c885f
                                • Instruction ID: 334fa9fd2124ebc6c4f40b6d461b17bc354faf393a4ed588a06a33f3771f6744
                                • Opcode Fuzzy Hash: 0c6cac375153df3ea685316185a18e015cdf0bae4e64619a5b2a5503804c885f
                                • Instruction Fuzzy Hash: 1611E3B19052547ACB10A7BA8849BDB7F9CAB86364F00007FF50462292DA789845CBFA
                                Function 00404B29 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47synchronizationCOMMON
                                Download Yara Rule
                                APIs
                                • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00404B26), ref: 00404B40
                                • CloseHandle.KERNEL32(?,?,?,?,00404B26), ref: 00404B98
                                • SetEvent.KERNEL32(?,?,?,?,00404B26), ref: 00404BA7
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseEventHandleObjectSingleWait
                                • String ID: Connection Timeout
                                • API String ID: 2055531096-499159329
                                • Opcode ID: 8f00a22efd279b910ee5e0315c8226cbf74945d37ddc1598f27f0c2b500d48e6
                                • Instruction ID: 3c9b6871d48b6b3111a672927d5bafc1cfd46058a166b60e959a8cf6be3f516d
                                • Opcode Fuzzy Hash: 8f00a22efd279b910ee5e0315c8226cbf74945d37ddc1598f27f0c2b500d48e6
                                • Instruction Fuzzy Hash: 1601F5B1900B41AFD325BB3A8C4255ABFE4AB45315740053FE293A2BA2DE38E440CB5E
                                Function 0040CE91 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON
                                Download Yara Rule
                                APIs
                                • std::_Lockit::_Lockit.LIBCPMT ref: 0040CE9C
                                • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040CEDB
                                  • Part of subcall function 004349CD: _Yarn.LIBCPMT ref: 004349EC
                                  • Part of subcall function 004349CD: _Yarn.LIBCPMT ref: 00434A10
                                • __CxxThrowException@8.LIBVCRUNTIME ref: 0040CEFF
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                                • String ID: bad locale name
                                • API String ID: 3628047217-1405518554
                                • Opcode ID: f07e7f955b01dc7e73450b40a16554f1385631f8dcfa89179a55129e3d4d963f
                                • Instruction ID: d3fe92e39fe1a76843bdcbebe92e6b3b15f8dcb0f99b50ce5c9cc2ba4b618b17
                                • Opcode Fuzzy Hash: f07e7f955b01dc7e73450b40a16554f1385631f8dcfa89179a55129e3d4d963f
                                • Instruction Fuzzy Hash: FEF03171004214AAC768FB62D853ADE77A4AF14758F504B3FF046224D2AF7CB619C688
                                Function 004127AA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37registryCOMMON
                                Download Yara Rule
                                APIs
                                • RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,004665B0), ref: 004127B9
                                • RegSetValueExA.ADVAPI32(004665B0,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0041BE51,WallpaperStyle,004665B0,00000001,00474EE0,00000000), ref: 004127E1
                                • RegCloseKey.ADVAPI32(004665B0,?,?,0041BE51,WallpaperStyle,004665B0,00000001,00474EE0,00000000,?,004079DD,00000001), ref: 004127EC
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseCreateValue
                                • String ID: Control Panel\Desktop
                                • API String ID: 1818849710-27424756
                                • Opcode ID: 922c5c9a969635fcdd6c568c5590d65cbd5d0949c5d7e49bcc58507ee08c6b06
                                • Instruction ID: b42ea712bc7a6ff48bd64609183fdbccf638e423d93a2202917fd6756948167f
                                • Opcode Fuzzy Hash: 922c5c9a969635fcdd6c568c5590d65cbd5d0949c5d7e49bcc58507ee08c6b06
                                • Instruction Fuzzy Hash: 27F06D32140204BBCB00AFA1DD45AEF3768EF00751B108169B916B60A1EE759E04EBA4
                                Function 004128AD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31registryCOMMON
                                Download Yara Rule
                                APIs
                                • RegCreateKeyA.ADVAPI32(80000001,00000000,TeF), ref: 004128BB
                                • RegSetValueExA.ADVAPI32(TeF,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128D6
                                • RegCloseKey.ADVAPI32(?,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128E1
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseCreateValue
                                • String ID: TeF
                                • API String ID: 1818849710-331424825
                                • Opcode ID: 69388a3f5ca785ef31159ee28a7932d701a8b17d3c2adace4bd37096d90c6bf5
                                • Instruction ID: 5082c9e4fe043c0a9a82c1e0a3a4def458545ef8caf92c2e29ea1f35f3ad8a86
                                • Opcode Fuzzy Hash: 69388a3f5ca785ef31159ee28a7932d701a8b17d3c2adace4bd37096d90c6bf5
                                • Instruction Fuzzy Hash: C9E03971640308BFDF119B919C05FDB3BA8EB04B95F004165FA05F61A1DAB1DE18EBA8
                                Function 0041534A Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                                Download Yara Rule
                                APIs
                                • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 0041538C
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ExecuteShell
                                • String ID: /C $cmd.exe$open
                                • API String ID: 587946157-3896048727
                                • Opcode ID: 07420ee8e79e5663e1d45f516f796ead781a4dcb3e4b8ad4c8c61540ce38a9fc
                                • Instruction ID: 200bce0b0309f38ec9064e519a9a4578f5a600b3ca3b701a036ea6d1077247ba
                                • Opcode Fuzzy Hash: 07420ee8e79e5663e1d45f516f796ead781a4dcb3e4b8ad4c8c61540ce38a9fc
                                • Instruction Fuzzy Hash: F1E0C0B11043406AC708FB65DC96DBF77AC9A90749F10483FB582621E2EE78A949865E
                                Function 004014D5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                Download Yara Rule
                                APIs
                                • LoadLibraryA.KERNEL32(User32.dll,GetLastInputInfo), ref: 004014DF
                                • GetProcAddress.KERNEL32(00000000), ref: 004014E6
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: AddressLibraryLoadProc
                                • String ID: GetLastInputInfo$User32.dll
                                • API String ID: 2574300362-1519888992
                                • Opcode ID: dda8da8e992a33b18976b493c6326eaa7f3d62003a83836ab2f58572c3d9c97a
                                • Instruction ID: 0ec815453ed4bd5b2a0753acad69ff197eebc14e76dec883dd33c8fab126b773
                                • Opcode Fuzzy Hash: dda8da8e992a33b18976b493c6326eaa7f3d62003a83836ab2f58572c3d9c97a
                                • Instruction Fuzzy Hash: EDB092B19827449FC7006BE0AD8DA263A64B654B43729006BF04BE51A1EEB890009A1F
                                Function 00448F1B Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: __alldvrm$_strrchr
                                • String ID:
                                • API String ID: 1036877536-0
                                • Opcode ID: 8b5edcb35c4d2941fa8222b1b1eb9a42678d347e2afed710556c4f4af04459e9
                                • Instruction ID: 0b1f6a9dfc50a2d3a5cef35921af3bd2f2baba9a31ad448e356136b6fbdd55d0
                                • Opcode Fuzzy Hash: 8b5edcb35c4d2941fa8222b1b1eb9a42678d347e2afed710556c4f4af04459e9
                                • Instruction Fuzzy Hash: 3AA14532A042869FFB258E18C8817AFBBA1EF15354F1841AFE8859B382C67C8D41D758
                                Function 00455BDA Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: _free
                                • String ID:
                                • API String ID: 269201875-0
                                • Opcode ID: afa3ecda25d51cd9aff2c85c123cae5c644baf28adaaccaf2d202ab809e86d36
                                • Instruction ID: 0bd1fcef5d7791e57e96aa6a4775832058b0444fd7bffa6098b49987863132bf
                                • Opcode Fuzzy Hash: afa3ecda25d51cd9aff2c85c123cae5c644baf28adaaccaf2d202ab809e86d36
                                • Instruction Fuzzy Hash: 64415D31900F00ABEF227AB98C9667F3A75DF01775F14411FFC1896293D63C890986AA
                                Function 00441C91 Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: f2513360f8fa909a868ea7f4e9218e069f9b1f8c5ae366e09b131aa5c638458b
                                • Instruction ID: 88518833c1d7008d36d723bd78668d328a40e80baed6ee8e3f57c0ed0377fbed
                                • Opcode Fuzzy Hash: f2513360f8fa909a868ea7f4e9218e069f9b1f8c5ae366e09b131aa5c638458b
                                • Instruction Fuzzy Hash: FE413AB1A00704BFE7249F39CC41BAABBA8EB84718F10412FF405DB291D379A9418788
                                Function 00404688 Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON
                                Download Yara Rule
                                APIs
                                • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,?), ref: 00404778
                                • CreateThread.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 0040478C
                                • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,?,?,00000000), ref: 00404797
                                • CloseHandle.KERNEL32(?,?,00000000,00000000,?,?,00000000), ref: 004047A0
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Create$CloseEventHandleObjectSingleThreadWait
                                • String ID:
                                • API String ID: 3360349984-0
                                • Opcode ID: 0ba9d3c0c413f9634211e94ee5d95a5eac2d9f08348ded62179f267a813d7d34
                                • Instruction ID: 5371640f48c6a0368c7cea64887978d4ac2a240c02499e3407376e9d4191e8ff
                                • Opcode Fuzzy Hash: 0ba9d3c0c413f9634211e94ee5d95a5eac2d9f08348ded62179f267a813d7d34
                                • Instruction Fuzzy Hash: 10417171504301ABC700FB61CC55D7FBBE9AFD5315F00093EF892A32E2EE389909866A
                                Function 0040B806 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                • [Cleared browsers logins and cookies.], xrefs: 0040B8DE
                                • Cleared browsers logins and cookies., xrefs: 0040B8EF
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Sleep
                                • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                                • API String ID: 3472027048-1236744412
                                • Opcode ID: ca0448f6081381088826e392521b04ab80529ecd6393088ba05f8e516b2986df
                                • Instruction ID: 247d09dce9e3c977c7e86e48a76dae703d52755688f8fe644b587970fcea700c
                                • Opcode Fuzzy Hash: ca0448f6081381088826e392521b04ab80529ecd6393088ba05f8e516b2986df
                                • Instruction Fuzzy Hash: FE31A81124C38069CA117B7514167AB6F958A93754F08847FE8C4273E3DB7A480883EF
                                Function 00409C4B Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 0041B8F1: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041B901
                                  • Part of subcall function 0041B8F1: GetWindowTextLengthW.USER32(00000000), ref: 0041B90A
                                  • Part of subcall function 0041B8F1: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0041B934
                                • Sleep.KERNEL32(000001F4), ref: 00409C95
                                • Sleep.KERNEL32(00000064), ref: 00409D1F
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Window$SleepText$ForegroundLength
                                • String ID: [ $ ]
                                • API String ID: 3309952895-93608704
                                • Opcode ID: 25c9c0f8766f8d053462b825598a9d81f0525ea32e2d71e5a23d211656131157
                                • Instruction ID: 7bed66d096a43dd94c2219bc8d3cdd3a5a7df98386a17a5ae9bf36b343ab91a8
                                • Opcode Fuzzy Hash: 25c9c0f8766f8d053462b825598a9d81f0525ea32e2d71e5a23d211656131157
                                • Instruction Fuzzy Hash: AF119F315042009BD218BB26DC17AAEBBA8AF41708F40047FF542621D3EF79AA1986DE
                                Function 0041B79A Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON
                                Download Yara Rule
                                APIs
                                • CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041B8B0,00000000,00000000,00000000), ref: 0041B7D9
                                • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000004,00000000,0041B8B0,00000000,00000000), ref: 0041B7F6
                                • WriteFile.KERNEL32(00000000,00000000,00000000,004061FD,00000000,?,00000004,00000000,0041B8B0,00000000,00000000), ref: 0041B80A
                                • CloseHandle.KERNEL32(00000000,?,00000004,00000000,0041B8B0,00000000,00000000), ref: 0041B817
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: File$CloseCreateHandlePointerWrite
                                • String ID:
                                • API String ID: 3604237281-0
                                • Opcode ID: 801f75d00fac8da0c66411ebabb5881698d5c73b15829ac97cd3568d121a9cb6
                                • Instruction ID: fca0af3f27241acfb9d15a16a542bc487c24adb9e916811621f81636ea96e045
                                • Opcode Fuzzy Hash: 801f75d00fac8da0c66411ebabb5881698d5c73b15829ac97cd3568d121a9cb6
                                • Instruction Fuzzy Hash: 1501F5712052057FE6105E249CC9EBB739CEB82B75F10063EF662D23C1DB25CC8686B9
                                Function 00442EE2 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 0179cd47eff8c75336d676f059f6bc7958f0419c29ca715f1c911511461a8d64
                                • Instruction ID: b58c8eca075ef28bddc965f0bc4d2171c3ec1f8ef65ef5096018edf4bb449d44
                                • Opcode Fuzzy Hash: 0179cd47eff8c75336d676f059f6bc7958f0419c29ca715f1c911511461a8d64
                                • Instruction Fuzzy Hash: 2501F2B26093163EF61016796CC1F27671CEF417B8BB1032BB626612D2EEA88C46606D
                                Function 00442F61 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 112e7316d96929b625426bf143e83baabee3255260599eba4999be5de9cde10c
                                • Instruction ID: 7fe3e8edc5bbc175eb6928fc2517c3e9b6b95ea9c4057c88a91cd5d3c4beb3ed
                                • Opcode Fuzzy Hash: 112e7316d96929b625426bf143e83baabee3255260599eba4999be5de9cde10c
                                • Instruction Fuzzy Hash: F201F9B22096167EB61016796DC4D27676DEF813B83F1033BF421612D1EEA8CC44A179
                                Function 00438305 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • ___BuildCatchObject.LIBVCRUNTIME ref: 0043831F
                                  • Part of subcall function 0043826C: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 0043829B
                                  • Part of subcall function 0043826C: ___AdjustPointer.LIBCMT ref: 004382B6
                                • _UnwindNestedFrames.LIBCMT ref: 00438334
                                • __FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00438345
                                • CallCatchBlock.LIBVCRUNTIME ref: 0043836D
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
                                • String ID:
                                • API String ID: 737400349-0
                                • Opcode ID: c8370f5f766c88f9b882548d03e746073a9763e8d7037f7b78bb80a5d64990c6
                                • Instruction ID: 0bcd00d322a0ad7a372b2cc4a74953bc209b0d499cbe7a3061e5fba3b10c2df3
                                • Opcode Fuzzy Hash: c8370f5f766c88f9b882548d03e746073a9763e8d7037f7b78bb80a5d64990c6
                                • Instruction Fuzzy Hash: 3E014072100248BBDF126E96CC41DEF7B69EF4C758F04501DFE4866221D73AE861DBA4
                                Function 00447420 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,004473C7,?,00000000,00000000,00000000,?,004476F3,00000006,FlsSetValue), ref: 00447452
                                • GetLastError.KERNEL32(?,004473C7,?,00000000,00000000,00000000,?,004476F3,00000006,FlsSetValue,0045E328,FlsSetValue,00000000,00000364,?,004471A1), ref: 0044745E
                                • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,004473C7,?,00000000,00000000,00000000,?,004476F3,00000006,FlsSetValue,0045E328,FlsSetValue,00000000), ref: 0044746C
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: LibraryLoad$ErrorLast
                                • String ID:
                                • API String ID: 3177248105-0
                                • Opcode ID: bca6965db1f65f3d9859255c05e5b0128703451981dee5a4eba808798ce175cf
                                • Instruction ID: 55721a836d87515a1eea2a56d4c7bce34062b93f94d6470a2cb527c4f3a692dc
                                • Opcode Fuzzy Hash: bca6965db1f65f3d9859255c05e5b0128703451981dee5a4eba808798ce175cf
                                • Instruction Fuzzy Hash: 6D01FC326497366BD7314F789C44A777FD8AF047617114535F906E3241DF28D802C6E8
                                Function 0041B825 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                                Download Yara Rule
                                APIs
                                • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,00403AF3,00466324), ref: 0041B83E
                                • GetFileSize.KERNEL32(00000000,00000000,00000000,?,?,00000000,00403AF3,00466324), ref: 0041B852
                                • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00403AF3,00466324), ref: 0041B877
                                • CloseHandle.KERNEL32(00000000,?,00000000,00403AF3,00466324), ref: 0041B885
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: File$CloseCreateHandleReadSize
                                • String ID:
                                • API String ID: 3919263394-0
                                • Opcode ID: ed58f78054f3304a0e571c39d56cdde4fa23284483a9ae65eff7322f5774d552
                                • Instruction ID: 2a104a3335fe37b36386f9496d9e2b25d881a91c22a4f34d2042fa75e5cfbfce
                                • Opcode Fuzzy Hash: ed58f78054f3304a0e571c39d56cdde4fa23284483a9ae65eff7322f5774d552
                                • Instruction Fuzzy Hash: 47F0C2B12422047FE6102F25AC89FBF3A5CDB86BA9F10023EF801A2291DE258C0581B9
                                Function 00418702 Relevance: 6.0, APIs: 4, Instructions: 49COMMON
                                Download Yara Rule
                                APIs
                                • GetSystemMetrics.USER32(0000004C), ref: 0041870F
                                • GetSystemMetrics.USER32(0000004D), ref: 00418715
                                • GetSystemMetrics.USER32(0000004E), ref: 0041871B
                                • GetSystemMetrics.USER32(0000004F), ref: 00418721
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: MetricsSystem
                                • String ID:
                                • API String ID: 4116985748-0
                                • Opcode ID: 0409876626ed8831e64dc81abc3b09ac1b97839c455807a5cfaaf12ce600e90b
                                • Instruction ID: 0d34e4fe417a410293abd419840fb627d3fd172a5f9f2d4f3f0ee0adad43daa0
                                • Opcode Fuzzy Hash: 0409876626ed8831e64dc81abc3b09ac1b97839c455807a5cfaaf12ce600e90b
                                • Instruction Fuzzy Hash: 26F0D672B043215BCB00AB754C4596EBB969FC03A4F25083FFA159B381EE78EC4687D9
                                Function 0041B588 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                Download Yara Rule
                                APIs
                                • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B5A0
                                • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B5B3
                                • CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041B5DE
                                • CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041B5E6
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CloseHandleOpenProcess
                                • String ID:
                                • API String ID: 39102293-0
                                • Opcode ID: 919f7b896ae6c8a80204132ffcf4e3671810b5915a4e0ecfb3e5b12bf128b858
                                • Instruction ID: 5d23c8c1f4703883972a4236376900cac23e2486f01e1b2fafccabe2f4d6955e
                                • Opcode Fuzzy Hash: 919f7b896ae6c8a80204132ffcf4e3671810b5915a4e0ecfb3e5b12bf128b858
                                • Instruction Fuzzy Hash: D5F049712003167BD31167558C4AFABB66ECF40B9AF01002BF611E21A2EF74DDC146BD
                                Function 00421179 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 178COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: _memcmp
                                • String ID: <kG$<kG
                                • API String ID: 2931989736-383723866
                                • Opcode ID: 58c4fa67fcc1ef55b25e11fe25224a60e8cc80dd1f406c27b0d1804dfa06d578
                                • Instruction ID: 841d78c923fca9e627808cf77cab3bf97fcfd39527adbe47470f5cf9fadca134
                                • Opcode Fuzzy Hash: 58c4fa67fcc1ef55b25e11fe25224a60e8cc80dd1f406c27b0d1804dfa06d578
                                • Instruction Fuzzy Hash: 9F613471604B0A9ED710DF28D8806A6B7A5FF18304F440A3FEC5CCF656E3B8A955C7A9
                                Function 00414D2D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CountEventTick
                                • String ID: NG
                                • API String ID: 180926312-1651712548
                                • Opcode ID: a768b16090f9c4b1faa76a112e48dd6aa020c4632dee722d57b5d808e9b45d88
                                • Instruction ID: 085b2f02be9ab0868ba51c73fb921716b1faa5b055701b3286f453889ed4f7a0
                                • Opcode Fuzzy Hash: a768b16090f9c4b1faa76a112e48dd6aa020c4632dee722d57b5d808e9b45d88
                                • Instruction Fuzzy Hash: C85182321042409AC624FB71D8A2AEF73E5AFD0304F00453FB94A671E2EF789949C69E
                                Function 004095D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158COMMON
                                Download Yara Rule
                                APIs
                                • GetKeyboardLayoutNameA.USER32(?), ref: 00409601
                                  • Part of subcall function 004041F1: socket.WS2_32(?,00000001,00000006), ref: 00404212
                                  • Part of subcall function 0040428C: connect.WS2_32(?,?,?), ref: 004042A5
                                  • Part of subcall function 0041B8B5: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00409689,00474EE0,?,00474EE0,00000000,00474EE0,00000000), ref: 0041B8CA
                                  • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: CreateFileKeyboardLayoutNameconnectsendsocket
                                • String ID: pQG$NG
                                • API String ID: 2334542088-921107917
                                • Opcode ID: 8a2cfdd9182e1b951ccd8cf57b1a0a888c1ebf455cd3f190b6372d704db266c6
                                • Instruction ID: 713adcd63a50277e86c853b9c7bd1a900ae8bd87492a3ad9f31fb308660c5d8e
                                • Opcode Fuzzy Hash: 8a2cfdd9182e1b951ccd8cf57b1a0a888c1ebf455cd3f190b6372d704db266c6
                                • Instruction Fuzzy Hash: BB5141321082405AC365F775D8A2AEF73E5AFD4308F50483FF84A671E2EE789949C69D
                                Function 0044DD44 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON
                                Download Yara Rule
                                APIs
                                • GetCPInfo.KERNEL32(?,?,00000005,?,00000000), ref: 0044DD69
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: Info
                                • String ID: $vD
                                • API String ID: 1807457897-3636070802
                                • Opcode ID: 93903f92fe2fb0ed0337dde64186c6a748e8e2785b4d3c371d891558e8e27b72
                                • Instruction ID: 6a53932102cf2f29093c464eb4c67803ff3648b28b3ba8b7d074bec3f8911faa
                                • Opcode Fuzzy Hash: 93903f92fe2fb0ed0337dde64186c6a748e8e2785b4d3c371d891558e8e27b72
                                • Instruction Fuzzy Hash: D0415DB0D047489BEF218E24CC84AF6BBF9DF55708F2404EEE58A87142D239AD45DF65
                                Function 00450AEE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00450D49,?,00000050,?,?,?,?,?), ref: 00450BC9
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID:
                                • String ID: ACP$OCP
                                • API String ID: 0-711371036
                                • Opcode ID: 6fd782f53c9633299fe98566c4ec68ed2bffd726811d49864d22e4fe4dac6dcd
                                • Instruction ID: d29bb87f3b47b124c8bd6c760bb86eb4cd4ec0f84f402c6b2e0ab732353f73f5
                                • Opcode Fuzzy Hash: 6fd782f53c9633299fe98566c4ec68ed2bffd726811d49864d22e4fe4dac6dcd
                                • Instruction Fuzzy Hash: 4021F72AA00105A6E7308FD48C82B977396AB50B1BF564467ED09D7303F73AFD09C358
                                Function 004049BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON
                                Download Yara Rule
                                APIs
                                • GetLocalTime.KERNEL32(?,00474EE0,004755B0,?,?,?,?,?,?,?,00414F0F,?,00000001,0000004C,00000000), ref: 004049F1
                                  • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                • GetLocalTime.KERNEL32(?,00474EE0,004755B0,?,?,?,?,?,?,?,00414F0F,?,00000001,0000004C,00000000), ref: 00404A4E
                                Strings
                                • KeepAlive | Enabled | Timeout: , xrefs: 004049E5
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: LocalTime
                                • String ID: KeepAlive | Enabled | Timeout:
                                • API String ID: 481472006-1507639952
                                • Opcode ID: d320fc96529179610a65d58ffc6e446b5a8076bb2ddfdc1c779629b15366c376
                                • Instruction ID: 07f09c1926c096f578aeb4a964dedba27d52497869334d5e310e707c12b0f234
                                • Opcode Fuzzy Hash: d320fc96529179610a65d58ffc6e446b5a8076bb2ddfdc1c779629b15366c376
                                • Instruction Fuzzy Hash: 932131B1A042806BD600F77A980635B7B9497C4314F84043FE90C562E2EEBD59898BAF
                                Function 0041A891 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON
                                Download Yara Rule
                                APIs
                                • GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: LocalTime
                                • String ID: | $%02i:%02i:%02i:%03i
                                • API String ID: 481472006-2430845779
                                • Opcode ID: 95370d8a82184c57a121af5101c01bac985aae3a63a2ae0874a17256be4c8778
                                • Instruction ID: bea5c42f2d95e84a76b62dfc34e9438b8882b4e2d456746f57979f9b7964cbe7
                                • Opcode Fuzzy Hash: 95370d8a82184c57a121af5101c01bac985aae3a63a2ae0874a17256be4c8778
                                • Instruction Fuzzy Hash: 0F114C725082405BC704EBA5D8969BF77E8AB94708F10093FF885A31E1EF38DA44C69E
                                Function 0040A767 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,Offline Keylogger Started,00475108), ref: 0040A884
                                  • Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905
                                  • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                • CloseHandle.KERNEL32(?), ref: 0040A7CA
                                • UnhookWindowsHookEx.USER32 ref: 0040A7DD
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                                • String ID: Online Keylogger Stopped
                                • API String ID: 1623830855-1496645233
                                • Opcode ID: 3c0b951b3782cbc24e38172759b50ba32964c5f8137923c244d68ff772a7f5b8
                                • Instruction ID: da65c2120251a34d34924486d515db36f90714a8cba0a7d82e96ebed52376b78
                                • Opcode Fuzzy Hash: 3c0b951b3782cbc24e38172759b50ba32964c5f8137923c244d68ff772a7f5b8
                                • Instruction Fuzzy Hash: 5901F131A043019BCB25BB35C80B7AEBBB19B45314F40406EE441225D2EB7999A6C3DF
                                Function 004016E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                Download Yara Rule
                                APIs
                                • waveInPrepareHeader.WINMM(?,00000020,?,?,00000000,00476B98,00474EE0,?,00000000,00401913), ref: 00401747
                                • waveInAddBuffer.WINMM(?,00000020,?,00000000,00401913), ref: 0040175D
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: wave$BufferHeaderPrepare
                                • String ID: XMG
                                • API String ID: 2315374483-813777761
                                • Opcode ID: 620c8429846d9d472bb74b0b690090328b51b047c9fc1556c206adb706f1508e
                                • Instruction ID: 26799fbdff8c3ec01ad48014b311b0d3f370155dffc0330205344997a7b0d52a
                                • Opcode Fuzzy Hash: 620c8429846d9d472bb74b0b690090328b51b047c9fc1556c206adb706f1508e
                                • Instruction Fuzzy Hash: 6501AD71300300AFD7209F39ED45A69BBB5EF89315B00413EB808E33A2EB74AC50CB98
                                Function 004479A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • IsValidLocale.KERNEL32(00000000,z?D,00000000,00000001,?,?,00443F7A,?,?,?,?,00000004), ref: 004479EC
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: LocaleValid
                                • String ID: IsValidLocaleName$z?D
                                • API String ID: 1901932003-2490211753
                                • Opcode ID: 030ca6b5b062e3e6eb463140e6e5805cf12db518d0019a9c378278714199a4d0
                                • Instruction ID: 892bc6e93789200f6c95030ba230210178196c8f1f686432b442ac7872abfc60
                                • Opcode Fuzzy Hash: 030ca6b5b062e3e6eb463140e6e5805cf12db518d0019a9c378278714199a4d0
                                • Instruction Fuzzy Hash: 06F0E930645218B7DB186F258C06F5E7B95CB05716F50807BFC047A293DE794E0295DD
                                Function 00401D91 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: H_prolog
                                • String ID: XMG$XMG
                                • API String ID: 3519838083-886261599
                                • Opcode ID: 94d942c2b9cd7cd452367b65107360caec8e392a141153fe325b9bee2a1bda9b
                                • Instruction ID: 0a877421dfc5135a28098138b17ad9f721677e320a6d1c8a6a2adbe775497da7
                                • Opcode Fuzzy Hash: 94d942c2b9cd7cd452367b65107360caec8e392a141153fe325b9bee2a1bda9b
                                • Instruction Fuzzy Hash: D4F0E9B1B00211ABC715BB65880569EB768EF41369F01827FB416772E1CFBD5D04975C
                                Function 0040AD56 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                                Download Yara Rule
                                APIs
                                • GetKeyState.USER32(00000011), ref: 0040AD5B
                                  • Part of subcall function 00409B10: GetForegroundWindow.USER32 ref: 00409B3F
                                  • Part of subcall function 00409B10: GetWindowThreadProcessId.USER32(00000000,?), ref: 00409B4B
                                  • Part of subcall function 00409B10: GetKeyboardLayout.USER32(00000000), ref: 00409B52
                                  • Part of subcall function 00409B10: GetKeyState.USER32(00000010), ref: 00409B5C
                                  • Part of subcall function 00409B10: GetKeyboardState.USER32(?), ref: 00409B67
                                  • Part of subcall function 00409B10: ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 00409B8A
                                  • Part of subcall function 00409B10: ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 00409BE3
                                  • Part of subcall function 00409D58: SetEvent.KERNEL32(?,?,00000000,0040A91C,00000000), ref: 00409D84
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
                                • String ID: [AltL]$[AltR]
                                • API String ID: 2738857842-2658077756
                                • Opcode ID: 6710da868b1f6278d5dc389c5162eb5958231a9bdcc45db2be29289886d9909f
                                • Instruction ID: 4c389cf0edc94a27bb3bc0fddc987b72c0da48b50f0a0a77cbfc03dd010ffeca
                                • Opcode Fuzzy Hash: 6710da868b1f6278d5dc389c5162eb5958231a9bdcc45db2be29289886d9909f
                                • Instruction Fuzzy Hash: 9AE09B2134032117C898323EA91B6EE3A218F82F65B80016FF8427BADADD7D4D5043CF
                                Function 00448A13 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON
                                Download Yara Rule
                                APIs
                                • _free.LIBCMT ref: 00448A35
                                  • Part of subcall function 00446CD5: HeapFree.KERNEL32(00000000,00000000,?,0044FC60,?,00000000,?,00000000,?,0044FF04,?,00000007,?,?,00450415,?), ref: 00446CEB
                                  • Part of subcall function 00446CD5: GetLastError.KERNEL32(?,?,0044FC60,?,00000000,?,00000000,?,0044FF04,?,00000007,?,?,00450415,?,?), ref: 00446CFD
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ErrorFreeHeapLast_free
                                • String ID: 8@$8@
                                • API String ID: 1353095263-3408345419
                                • Opcode ID: 9a963da6b0d453c70d37714207bd95daf40472698ea915a46c6a843fe12f4396
                                • Instruction ID: 8fe4af4b93ebf6b2b13329648f525de20a5552277f2be9521e73d3219e6c2dc0
                                • Opcode Fuzzy Hash: 9a963da6b0d453c70d37714207bd95daf40472698ea915a46c6a843fe12f4396
                                • Instruction Fuzzy Hash: 01E092361003059F8720CF6DD400A86B7F4EF95720720852FE89EE3710D731E812CB40
                                Function 0040ADB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                                Download Yara Rule
                                APIs
                                • GetKeyState.USER32(00000012), ref: 0040ADB5
                                Strings
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: State
                                • String ID: [CtrlL]$[CtrlR]
                                • API String ID: 1649606143-2446555240
                                • Opcode ID: 1e09bfb53d021ea1c866fde6c19d11564262c1f0807fce03e138d30dae2d8efb
                                • Instruction ID: c178b64a75e50e2fccb38c9379e001e6e5e0f6b670105b82eaba8ba361dc1658
                                • Opcode Fuzzy Hash: 1e09bfb53d021ea1c866fde6c19d11564262c1f0807fce03e138d30dae2d8efb
                                • Instruction Fuzzy Hash: 59E0866170031517C514363DD61B67F39128F41B66F80012FF842A7AC6ED7E8D6423CB
                                Function 00412A52 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                                Download Yara Rule
                                APIs
                                • RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,00000000,00000002,?,80000002,80000002,0040C33C,00000000,?,00000000), ref: 00412A60
                                • RegDeleteValueW.ADVAPI32(?,?,?,00000000), ref: 00412A70
                                Strings
                                • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00412A5E
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: DeleteOpenValue
                                • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                • API String ID: 2654517830-1051519024
                                • Opcode ID: 3a238ae8f5602ce2402de7cae663a0db3b4178bc362611f3100633d001d48757
                                • Instruction ID: 27182704b7fa20b5ed2a2764b3d23dc9a6b68b829b0f6622ee10c7d45645f89b
                                • Opcode Fuzzy Hash: 3a238ae8f5602ce2402de7cae663a0db3b4178bc362611f3100633d001d48757
                                • Instruction Fuzzy Hash: F1E01270200308BAEF204FA19E06FEB37ACAB40BC9F004169F601F5191EAB6DD54A658
                                Function 0043FCA1 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401AD8), ref: 0043FD37
                                • GetLastError.KERNEL32 ref: 0043FD45
                                • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0043FDA0
                                Memory Dump Source
                                • Source File: 00000003.00000002.2159277572.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_3_2_400000_Material Requirments.jbxd
                                Yara matches
                                Similarity
                                • API ID: ByteCharMultiWide$ErrorLast
                                • String ID:
                                • API String ID: 1717984340-0
                                • Opcode ID: 089979a15875112d8f5d5fa26b2ef27e5113d3ed2beea9922f5d947ec53c8576
                                • Instruction ID: a8021b2984f9c2011c4d4eba480f75da6e6c35d7fa760b83b06315d7a0ea6bca
                                • Opcode Fuzzy Hash: 089979a15875112d8f5d5fa26b2ef27e5113d3ed2beea9922f5d947ec53c8576
                                • Instruction Fuzzy Hash: E1410A30E00246AFCF218F65C84867B7BA5EF09310F14517EFC5A9B2A2DB398D05C759

                                Execution Graph

                                Execution Coverage:10.9%
                                Dynamic/Decrypted Code Coverage:100%
                                Signature Coverage:0%
                                Total number of Nodes:237
                                Total number of Limit Nodes:14
                                execution_graph 28624 697cfd7 28625 697cff5 28624->28625 28629 697fb18 28625->28629 28633 697fb28 28625->28633 28626 697d028 28630 697fb5b 28629->28630 28631 697fbc9 28630->28631 28637 697ff11 28630->28637 28631->28626 28634 697fb5b 28633->28634 28635 697fbc9 28634->28635 28636 697ff11 ResumeThread 28634->28636 28635->28626 28636->28635 28638 697ff17 ResumeThread 28637->28638 28639 697feea 28637->28639 28641 697ff89 28638->28641 28639->28631 28641->28631 28652 6a52930 28653 6a52abb 28652->28653 28654 6a52956 28652->28654 28654->28653 28656 6a50450 28654->28656 28657 6a52bb0 PostMessageW 28656->28657 28658 6a52c1c 28657->28658 28658->28654 28664 6a51080 28665 6a50c7c 28664->28665 28670 6a516a6 28665->28670 28690 6a51609 28665->28690 28710 6a51640 28665->28710 28729 6a51630 28665->28729 28671 6a51634 28670->28671 28673 6a516a9 28670->28673 28672 6a51662 28671->28672 28748 6a51b24 28671->28748 28753 6a522fa 28671->28753 28759 6a51e19 28671->28759 28764 6a51c3f 28671->28764 28769 6a51abd 28671->28769 28774 6a51d56 28671->28774 28779 6a51d17 28671->28779 28784 6a51e75 28671->28784 28792 6a5224a 28671->28792 28797 6a51be8 28671->28797 28802 6a5214e 28671->28802 28806 6a51baf 28671->28806 28810 6a51eac 28671->28810 28815 6a5222d 28671->28815 28820 6a52260 28671->28820 28829 6a51f20 28671->28829 28672->28665 28673->28665 28691 6a51612 28690->28691 28692 6a51649 28690->28692 28691->28665 28693 6a51662 28692->28693 28694 6a51b24 2 API calls 28692->28694 28695 6a51f20 3 API calls 28692->28695 28696 6a52260 3 API calls 28692->28696 28697 6a5222d 2 API calls 28692->28697 28698 6a51eac 2 API calls 28692->28698 28699 6a51baf 2 API calls 28692->28699 28700 6a5214e 2 API calls 28692->28700 28701 6a51be8 2 API calls 28692->28701 28702 6a5224a 3 API calls 28692->28702 28703 6a51e75 4 API calls 28692->28703 28704 6a51d17 3 API calls 28692->28704 28705 6a51d56 2 API calls 28692->28705 28706 6a51abd 2 API calls 28692->28706 28707 6a51c3f 3 API calls 28692->28707 28708 6a51e19 2 API calls 28692->28708 28709 6a522fa 2 API calls 28692->28709 28693->28665 28694->28693 28695->28693 28696->28693 28697->28693 28698->28693 28699->28693 28700->28693 28701->28693 28702->28693 28703->28693 28704->28693 28705->28693 28706->28693 28707->28693 28708->28693 28709->28693 28711 6a5165a 28710->28711 28712 6a51662 28711->28712 28713 6a51b24 2 API calls 28711->28713 28714 6a51f20 3 API calls 28711->28714 28715 6a52260 3 API calls 28711->28715 28716 6a5222d 2 API calls 28711->28716 28717 6a51eac 2 API calls 28711->28717 28718 6a51baf 2 API calls 28711->28718 28719 6a5214e 2 API calls 28711->28719 28720 6a51be8 2 API calls 28711->28720 28721 6a5224a 3 API calls 28711->28721 28722 6a51e75 4 API calls 28711->28722 28723 6a51d17 3 API calls 28711->28723 28724 6a51d56 2 API calls 28711->28724 28725 6a51abd 2 API calls 28711->28725 28726 6a51c3f 3 API calls 28711->28726 28727 6a51e19 2 API calls 28711->28727 28728 6a522fa 2 API calls 28711->28728 28712->28665 28713->28712 28714->28712 28715->28712 28716->28712 28717->28712 28718->28712 28719->28712 28720->28712 28721->28712 28722->28712 28723->28712 28724->28712 28725->28712 28726->28712 28727->28712 28728->28712 28730 6a51634 28729->28730 28731 6a51662 28730->28731 28732 6a51b24 2 API calls 28730->28732 28733 6a51f20 3 API calls 28730->28733 28734 6a52260 3 API calls 28730->28734 28735 6a5222d 2 API calls 28730->28735 28736 6a51eac 2 API calls 28730->28736 28737 6a51baf 2 API calls 28730->28737 28738 6a5214e 2 API calls 28730->28738 28739 6a51be8 2 API calls 28730->28739 28740 6a5224a 3 API calls 28730->28740 28741 6a51e75 4 API calls 28730->28741 28742 6a51d17 3 API calls 28730->28742 28743 6a51d56 2 API calls 28730->28743 28744 6a51abd 2 API calls 28730->28744 28745 6a51c3f 3 API calls 28730->28745 28746 6a51e19 2 API calls 28730->28746 28747 6a522fa 2 API calls 28730->28747 28731->28665 28732->28731 28733->28731 28734->28731 28735->28731 28736->28731 28737->28731 28738->28731 28739->28731 28740->28731 28741->28731 28742->28731 28743->28731 28744->28731 28745->28731 28746->28731 28747->28731 28749 6a51b2a 28748->28749 28750 6a51b58 28749->28750 28834 6a50860 28749->28834 28838 6a50854 28749->28838 28754 6a51bff 28753->28754 28755 6a5231b 28754->28755 28843 6a501d0 28754->28843 28848 6a501d8 28754->28848 28756 6a51c20 28756->28672 28760 6a51e1c 28759->28760 28762 6a501d0 WriteProcessMemory 28760->28762 28763 6a501d8 WriteProcessMemory 28760->28763 28761 6a51e47 28762->28761 28763->28761 28765 6a51c45 28764->28765 28852 6a502c8 28765->28852 28856 6a502c1 28765->28856 28860 6a50394 28765->28860 28770 6a51ac7 28769->28770 28772 6a50854 CreateProcessA 28770->28772 28773 6a50860 CreateProcessA 28770->28773 28771 6a51b58 28772->28771 28773->28771 28776 6a51d63 28774->28776 28775 6a5234b 28865 6a50007 28776->28865 28869 6a50040 28776->28869 28780 6a51d1d 28779->28780 28781 6a50394 ReadProcessMemory 28780->28781 28782 6a502c1 ReadProcessMemory 28780->28782 28783 6a502c8 ReadProcessMemory 28780->28783 28781->28780 28782->28780 28783->28780 28785 6a51e1c 28784->28785 28786 6a51e7c 28784->28786 28788 6a501d0 WriteProcessMemory 28785->28788 28789 6a501d8 WriteProcessMemory 28785->28789 28873 6a50110 28786->28873 28878 6a50118 28786->28878 28787 6a51e47 28787->28672 28788->28787 28789->28787 28793 6a51c56 28792->28793 28794 6a50394 ReadProcessMemory 28793->28794 28795 6a502c1 ReadProcessMemory 28793->28795 28796 6a502c8 ReadProcessMemory 28793->28796 28794->28793 28795->28793 28796->28793 28798 6a51bee 28797->28798 28800 6a501d0 WriteProcessMemory 28798->28800 28801 6a501d8 WriteProcessMemory 28798->28801 28799 6a51c20 28799->28672 28800->28799 28801->28799 28804 6a501d0 WriteProcessMemory 28802->28804 28805 6a501d8 WriteProcessMemory 28802->28805 28803 6a52172 28804->28803 28805->28803 28808 6a50007 Wow64SetThreadContext 28806->28808 28809 6a50040 Wow64SetThreadContext 28806->28809 28807 6a51b83 28807->28672 28808->28807 28809->28807 28811 6a51eb2 28810->28811 28813 697ff11 ResumeThread 28811->28813 28882 697ff18 28811->28882 28812 6a51dae 28812->28672 28813->28812 28816 6a51ec3 28815->28816 28817 6a51dae 28815->28817 28818 697ff11 ResumeThread 28816->28818 28819 697ff18 ResumeThread 28816->28819 28817->28672 28818->28817 28819->28817 28821 6a5226d 28820->28821 28822 6a5227a 28821->28822 28823 6a50394 ReadProcessMemory 28821->28823 28824 6a502c1 ReadProcessMemory 28821->28824 28825 6a502c8 ReadProcessMemory 28821->28825 28826 6a50394 ReadProcessMemory 28822->28826 28827 6a502c1 ReadProcessMemory 28822->28827 28828 6a502c8 ReadProcessMemory 28822->28828 28823->28822 28824->28822 28825->28822 28826->28822 28827->28822 28828->28822 28830 6a51d1e 28829->28830 28831 6a50394 ReadProcessMemory 28830->28831 28832 6a502c1 ReadProcessMemory 28830->28832 28833 6a502c8 ReadProcessMemory 28830->28833 28831->28830 28832->28830 28833->28830 28835 6a508e9 CreateProcessA 28834->28835 28837 6a50aab 28835->28837 28839 6a5085e CreateProcessA 28838->28839 28840 6a507df 28838->28840 28842 6a50aab 28839->28842 28840->28750 28844 6a501d7 WriteProcessMemory 28843->28844 28845 6a501aa 28843->28845 28847 6a50277 28844->28847 28845->28756 28847->28756 28849 6a50220 WriteProcessMemory 28848->28849 28851 6a50277 28849->28851 28851->28756 28853 6a50313 ReadProcessMemory 28852->28853 28855 6a50357 28853->28855 28855->28765 28857 6a50313 ReadProcessMemory 28856->28857 28859 6a50357 28857->28859 28859->28765 28861 6a5039d 28860->28861 28862 6a50333 ReadProcessMemory 28861->28862 28863 6a503b2 28861->28863 28864 6a50357 28862->28864 28864->28765 28866 6a50012 Wow64SetThreadContext 28865->28866 28868 6a500cd 28866->28868 28868->28775 28870 6a50085 Wow64SetThreadContext 28869->28870 28872 6a500cd 28870->28872 28872->28775 28874 6a50117 VirtualAllocEx 28873->28874 28875 6a500ea 28873->28875 28877 6a50195 28874->28877 28875->28787 28877->28787 28879 6a50158 VirtualAllocEx 28878->28879 28881 6a50195 28879->28881 28881->28787 28883 697ff58 ResumeThread 28882->28883 28885 697ff89 28883->28885 28885->28812 28886 9ebdf8 28887 9ebe3a 28886->28887 28888 9ebe40 GetModuleHandleW 28886->28888 28887->28888 28889 9ebe6d 28888->28889 28892 9e4668 28893 9e467a 28892->28893 28894 9e4686 28893->28894 28896 9e4779 28893->28896 28897 9e479d 28896->28897 28901 9e4888 28897->28901 28905 9e4878 28897->28905 28902 9e48af 28901->28902 28903 9e498c 28902->28903 28909 9e448c 28902->28909 28906 9e4888 28905->28906 28907 9e498c 28906->28907 28908 9e448c CreateActCtxA 28906->28908 28907->28907 28908->28907 28910 9e5918 CreateActCtxA 28909->28910 28912 9e59db 28910->28912 28913 69708a0 28914 69708e3 28913->28914 28915 6970901 MonitorFromPoint 28914->28915 28916 6970932 28914->28916 28915->28916 28647 697d25b 28648 697d26b 28647->28648 28650 697fb18 ResumeThread 28648->28650 28651 697fb28 ResumeThread 28648->28651 28649 697d29e 28650->28649 28651->28649 28890 9ee4f0 DuplicateHandle 28891 9ee586 28890->28891 28917 9edea0 28918 9edee6 GetCurrentProcess 28917->28918 28920 9edf38 GetCurrentThread 28918->28920 28921 9edf31 28918->28921 28922 9edf6e 28920->28922 28923 9edf75 GetCurrentProcess 28920->28923 28921->28920 28922->28923 28924 9edfab GetCurrentThreadId 28923->28924 28926 9ee004 28924->28926

                                Executed Functions

                                Function 009EDEA0 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                • GetCurrentProcess.KERNEL32 ref: 009EDF1E
                                • GetCurrentThread.KERNEL32 ref: 009EDF5B
                                • GetCurrentProcess.KERNEL32 ref: 009EDF98
                                • GetCurrentThreadId.KERNEL32 ref: 009EDFF1
                                Memory Dump Source
                                • Source File: 00000004.00000002.2172434228.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_9e0000_remcos.jbxd
                                Similarity
                                • API ID: Current$ProcessThread
                                • String ID:
                                • API String ID: 2063062207-0
                                • Opcode ID: 1369e7828a9c71804454daaa64697b7a3df49fdfba1ee76dae6832bf4157b41b
                                • Instruction ID: 67994573aa696f93c3104f7c605e9d812d4c7f40adabd747183a76ef3b843ffa
                                • Opcode Fuzzy Hash: 1369e7828a9c71804454daaa64697b7a3df49fdfba1ee76dae6832bf4157b41b
                                • Instruction Fuzzy Hash: 6C5157B0911349DFEB24CFAAD548B9EBBF1EF88304F208459E009A7350D775A948CF65
                                Function 06A50854 Relevance: 1.8, APIs: 1, Instructions: 279processCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 194 6a50854-6a5085c 195 6a507df-6a5081a 194->195 196 6a5085e-6a508f5 194->196 215 6a50823-6a50848 195->215 216 6a5081c-6a50822 195->216 199 6a508f7-6a50901 196->199 200 6a5092e-6a5094e 196->200 199->200 201 6a50903-6a50905 199->201 206 6a50987-6a509b6 200->206 207 6a50950-6a5095a 200->207 204 6a50907-6a50911 201->204 205 6a50928-6a5092b 201->205 208 6a50915-6a50924 204->208 209 6a50913 204->209 205->200 220 6a509ef-6a50aa9 CreateProcessA 206->220 221 6a509b8-6a509c2 206->221 207->206 211 6a5095c-6a5095e 207->211 208->208 210 6a50926 208->210 209->208 210->205 213 6a50981-6a50984 211->213 214 6a50960-6a5096a 211->214 213->206 218 6a5096c 214->218 219 6a5096e-6a5097d 214->219 216->215 218->219 219->219 223 6a5097f 219->223 235 6a50ab2-6a50b38 220->235 236 6a50aab-6a50ab1 220->236 221->220 222 6a509c4-6a509c6 221->222 226 6a509e9-6a509ec 222->226 227 6a509c8-6a509d2 222->227 223->213 226->220 230 6a509d4 227->230 231 6a509d6-6a509e5 227->231 230->231 231->231 232 6a509e7 231->232 232->226 246 6a50b48-6a50b4c 235->246 247 6a50b3a-6a50b3e 235->247 236->235 249 6a50b5c-6a50b60 246->249 250 6a50b4e-6a50b52 246->250 247->246 248 6a50b40 247->248 248->246 252 6a50b70-6a50b74 249->252 253 6a50b62-6a50b66 249->253 250->249 251 6a50b54 250->251 251->249 254 6a50b86-6a50b8d 252->254 255 6a50b76-6a50b7c 252->255 253->252 256 6a50b68 253->256 257 6a50ba4 254->257 258 6a50b8f-6a50b9e 254->258 255->254 256->252 260 6a50ba5 257->260 258->257 260->260
                                APIs
                                • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06A50A96
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179718481.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6a50000_remcos.jbxd
                                Similarity
                                • API ID: CreateProcess
                                • String ID:
                                • API String ID: 963392458-0
                                • Opcode ID: 4fb7794aafcd6dbe749ac59756335ad5dd0fefd55e08e4fe75fac39c992d2a9a
                                • Instruction ID: fb9a5698bba81a78aacb9db5f2bbfb90e314b0b5f2ae61524e1f2ccf36c7ec05
                                • Opcode Fuzzy Hash: 4fb7794aafcd6dbe749ac59756335ad5dd0fefd55e08e4fe75fac39c992d2a9a
                                • Instruction Fuzzy Hash: 65B18C71D00219CFEF50EFA9C8417EEBBB2BF48304F15856AE848A7244DB759985CF91
                                Function 06A50860 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 261 6a50860-6a508f5 263 6a508f7-6a50901 261->263 264 6a5092e-6a5094e 261->264 263->264 265 6a50903-6a50905 263->265 269 6a50987-6a509b6 264->269 270 6a50950-6a5095a 264->270 267 6a50907-6a50911 265->267 268 6a50928-6a5092b 265->268 271 6a50915-6a50924 267->271 272 6a50913 267->272 268->264 280 6a509ef-6a50aa9 CreateProcessA 269->280 281 6a509b8-6a509c2 269->281 270->269 274 6a5095c-6a5095e 270->274 271->271 273 6a50926 271->273 272->271 273->268 275 6a50981-6a50984 274->275 276 6a50960-6a5096a 274->276 275->269 278 6a5096c 276->278 279 6a5096e-6a5097d 276->279 278->279 279->279 283 6a5097f 279->283 292 6a50ab2-6a50b38 280->292 293 6a50aab-6a50ab1 280->293 281->280 282 6a509c4-6a509c6 281->282 284 6a509e9-6a509ec 282->284 285 6a509c8-6a509d2 282->285 283->275 284->280 287 6a509d4 285->287 288 6a509d6-6a509e5 285->288 287->288 288->288 289 6a509e7 288->289 289->284 303 6a50b48-6a50b4c 292->303 304 6a50b3a-6a50b3e 292->304 293->292 306 6a50b5c-6a50b60 303->306 307 6a50b4e-6a50b52 303->307 304->303 305 6a50b40 304->305 305->303 309 6a50b70-6a50b74 306->309 310 6a50b62-6a50b66 306->310 307->306 308 6a50b54 307->308 308->306 311 6a50b86-6a50b8d 309->311 312 6a50b76-6a50b7c 309->312 310->309 313 6a50b68 310->313 314 6a50ba4 311->314 315 6a50b8f-6a50b9e 311->315 312->311 313->309 317 6a50ba5 314->317 315->314 317->317
                                APIs
                                • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06A50A96
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179718481.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6a50000_remcos.jbxd
                                Similarity
                                • API ID: CreateProcess
                                • String ID:
                                • API String ID: 963392458-0
                                • Opcode ID: 42f2e7e11a82c66001b309a82ba96175c9f480c8a403b82e8b3ced2839faeaf1
                                • Instruction ID: 241acf54e6924c29e7f1beb4bf46205c4a0940b3f5ae07fc9c0db873a2e24074
                                • Opcode Fuzzy Hash: 42f2e7e11a82c66001b309a82ba96175c9f480c8a403b82e8b3ced2839faeaf1
                                • Instruction Fuzzy Hash: 72917C71D00219DFEF60EF69C8817EEBBB2BF48304F15856AE848A7244DB749985CF91
                                Function 009E590D Relevance: 1.6, APIs: 1, Instructions: 98COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 318 9e590d-9e59d9 CreateActCtxA 320 9e59db-9e59e1 318->320 321 9e59e2-9e5a3c 318->321 320->321 328 9e5a3e-9e5a41 321->328 329 9e5a4b-9e5a4f 321->329 328->329 330 9e5a60 329->330 331 9e5a51-9e5a5d 329->331 333 9e5a61 330->333 331->330 333->333
                                APIs
                                • CreateActCtxA.KERNEL32(?), ref: 009E59C9
                                Memory Dump Source
                                • Source File: 00000004.00000002.2172434228.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_9e0000_remcos.jbxd
                                Similarity
                                • API ID: Create
                                • String ID:
                                • API String ID: 2289755597-0
                                • Opcode ID: b11219d84dc88bde40ca5ea626d790d052155d821dba87ef4756ffd3c2633417
                                • Instruction ID: c164461c52520408474277753edd8196ed9e3dbde286c4b91a69912789455754
                                • Opcode Fuzzy Hash: b11219d84dc88bde40ca5ea626d790d052155d821dba87ef4756ffd3c2633417
                                • Instruction Fuzzy Hash: FA410271C01719CBEB25CFAAC8847DEBBF5BF49308F20816AD008AB255DB756945CF50
                                Function 009E448C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 334 9e448c-9e59d9 CreateActCtxA 337 9e59db-9e59e1 334->337 338 9e59e2-9e5a3c 334->338 337->338 345 9e5a3e-9e5a41 338->345 346 9e5a4b-9e5a4f 338->346 345->346 347 9e5a60 346->347 348 9e5a51-9e5a5d 346->348 350 9e5a61 347->350 348->347 350->350
                                APIs
                                • CreateActCtxA.KERNEL32(?), ref: 009E59C9
                                Memory Dump Source
                                • Source File: 00000004.00000002.2172434228.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_9e0000_remcos.jbxd
                                Similarity
                                • API ID: Create
                                • String ID:
                                • API String ID: 2289755597-0
                                • Opcode ID: 0c30bfce336c7330297d9c279ee188f344ae53995a66e5b999c0ff13f2c6fc7d
                                • Instruction ID: 9c70c2e3f814dca76e2897fcf5dd6aa3b9f78f7faf0832aa9d7c18ce0cdd7c0b
                                • Opcode Fuzzy Hash: 0c30bfce336c7330297d9c279ee188f344ae53995a66e5b999c0ff13f2c6fc7d
                                • Instruction Fuzzy Hash: 94410270C00B1DCBEB24DFAAC88479EBBF5BF49304F20816AD408AB255DB756945CF90
                                Function 06A50007 Relevance: 1.6, APIs: 1, Instructions: 90threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 351 6a50007-6a50010 352 6a50012-6a5003c 351->352 352->352 353 6a5003f-6a5008b 352->353 355 6a5008d-6a50099 353->355 356 6a5009b-6a500cb Wow64SetThreadContext 353->356 355->356 358 6a500d4-6a50104 356->358 359 6a500cd-6a500d3 356->359 359->358
                                APIs
                                • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06A500BE
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179718481.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6a50000_remcos.jbxd
                                Similarity
                                • API ID: ContextThreadWow64
                                • String ID:
                                • API String ID: 983334009-0
                                • Opcode ID: e194cdcbe96f291d3308cfde8eb776ebd194d9c0f3652c064495976c4c318e66
                                • Instruction ID: bf338ffecee12fd4bfc244597084fca327d192b1427d830f012c13b956124d01
                                • Opcode Fuzzy Hash: e194cdcbe96f291d3308cfde8eb776ebd194d9c0f3652c064495976c4c318e66
                                • Instruction Fuzzy Hash: D631BC71C043498FDB51DFA9C8407EEBFF4AF4A320F16806AD458AB242D7389A45CBA1
                                Function 06A501D0 Relevance: 1.6, APIs: 1, Instructions: 84injectionCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 363 6a501d0-6a501d5 364 6a501d7-6a50226 363->364 365 6a501aa-6a501c1 363->365 368 6a50236-6a50275 WriteProcessMemory 364->368 369 6a50228-6a50234 364->369 371 6a50277-6a5027d 368->371 372 6a5027e-6a502ae 368->372 369->368 371->372
                                APIs
                                • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06A50268
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179718481.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6a50000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessWrite
                                • String ID:
                                • API String ID: 3559483778-0
                                • Opcode ID: 452a6d7ac3905b05cf237d30f4574e392a00c50080c08e5232f80395e124679e
                                • Instruction ID: e23a98026cd8177a975cc1fbd575b97a40bb4e20cbbcc4f2441003b44dc25fc0
                                • Opcode Fuzzy Hash: 452a6d7ac3905b05cf237d30f4574e392a00c50080c08e5232f80395e124679e
                                • Instruction Fuzzy Hash: 43314672D003499FDB10DFA9D881BDEBBF5FF88320F10842AE919A7240D7799951CBA0
                                Function 06A501D8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 386 6a501d8-6a50226 388 6a50236-6a50275 WriteProcessMemory 386->388 389 6a50228-6a50234 386->389 391 6a50277-6a5027d 388->391 392 6a5027e-6a502ae 388->392 389->388 391->392
                                APIs
                                • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06A50268
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179718481.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6a50000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessWrite
                                • String ID:
                                • API String ID: 3559483778-0
                                • Opcode ID: c3c6477446ca70d1a8f71b1dc975f5756d274d97ef4e7e9bf0843c89730c8d6f
                                • Instruction ID: 415e72753c06dcf3c2906b1601aae15583f15f2a4e7e969c7e20ea26c31f78cd
                                • Opcode Fuzzy Hash: c3c6477446ca70d1a8f71b1dc975f5756d274d97ef4e7e9bf0843c89730c8d6f
                                • Instruction Fuzzy Hash: 7721F4719003499FDF10DFAAC985BDEBBF5FF48310F10842AEA19A7240D7789954CBA4
                                Function 06A50110 Relevance: 1.6, APIs: 1, Instructions: 69memoryCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 376 6a50110-6a50115 377 6a50117-6a50193 VirtualAllocEx 376->377 378 6a500ea-6a50104 376->378 381 6a50195-6a5019b 377->381 382 6a5019c-6a501c1 377->382 381->382
                                APIs
                                • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06A50186
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179718481.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6a50000_remcos.jbxd
                                Similarity
                                • API ID: AllocVirtual
                                • String ID:
                                • API String ID: 4275171209-0
                                • Opcode ID: 42c3c51b8e777aa809be012df4a3d8bb82f0c62d6ff4425099eab7591a3031fc
                                • Instruction ID: 7268ddb65122e58ef3f35fa70aa2fa678c3684673e549df40415ae88febf141f
                                • Opcode Fuzzy Hash: 42c3c51b8e777aa809be012df4a3d8bb82f0c62d6ff4425099eab7591a3031fc
                                • Instruction Fuzzy Hash: DF215972C002099FDB10DFAAD8416EEFBF5EF88324F14842AE519A7240C739A551CFA5
                                Function 06970890 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 396 6970890-69708ec 398 6970952-697096d 396->398 399 69708ee-6970930 MonitorFromPoint 396->399 405 697096f-697097c 398->405 402 6970932-6970938 399->402 403 6970939-6970944 399->403 402->403 408 6970947 call 6970a59 403->408 409 6970947 call 6970a68 403->409 407 697094d-6970950 407->405 408->407 409->407
                                APIs
                                • MonitorFromPoint.USER32(?,?,00000002), ref: 0697091F
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179615048.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6970000_remcos.jbxd
                                Similarity
                                • API ID: FromMonitorPoint
                                • String ID:
                                • API String ID: 1566494148-0
                                • Opcode ID: 526321660ea351c6d03048c3248e17a77342294c30dd74275540a7087b935212
                                • Instruction ID: 2f52b64c80b2439dab8c1a68478791420bff73dde9ad844c51a7c41b9e8bd804
                                • Opcode Fuzzy Hash: 526321660ea351c6d03048c3248e17a77342294c30dd74275540a7087b935212
                                • Instruction Fuzzy Hash: E52157B5D043499FEB10DFA9D455BDEBFB4EB49310F10801AE995AB381C734AA05CFA1
                                Function 069708A0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 410 69708a0-69708ec 412 6970952-697096d 410->412 413 69708ee-6970930 MonitorFromPoint 410->413 419 697096f-697097c 412->419 416 6970932-6970938 413->416 417 6970939-6970944 413->417 416->417 422 6970947 call 6970a59 417->422 423 6970947 call 6970a68 417->423 421 697094d-6970950 421->419 422->421 423->421
                                APIs
                                • MonitorFromPoint.USER32(?,?,00000002), ref: 0697091F
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179615048.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6970000_remcos.jbxd
                                Similarity
                                • API ID: FromMonitorPoint
                                • String ID:
                                • API String ID: 1566494148-0
                                • Opcode ID: 3e3574e860d8099e5a62b5c0ee8cc78a54b9400762c470add3f95022b528dc79
                                • Instruction ID: 113f944c14b756b4124e5abd578c877fa47028b83010b5d483c33415e590fb71
                                • Opcode Fuzzy Hash: 3e3574e860d8099e5a62b5c0ee8cc78a54b9400762c470add3f95022b528dc79
                                • Instruction Fuzzy Hash: B8214AB5A042099FEB10DFAAD415BAEFBF5EB89310F108019E955A7384C775A904CFA1
                                Function 06A502C1 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 424 6a502c1-6a50355 ReadProcessMemory 428 6a50357-6a5035d 424->428 429 6a5035e-6a5038e 424->429 428->429
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06A50348
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179718481.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6a50000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: f2a2c732ff6fadcc9a37b72fffd6a9f277e91832373a29620d75ec03e3413a78
                                • Instruction ID: 98612dc941dd03deaf24e406b4c279e31564fe323535231f0ef062528c650d2a
                                • Opcode Fuzzy Hash: f2a2c732ff6fadcc9a37b72fffd6a9f277e91832373a29620d75ec03e3413a78
                                • Instruction Fuzzy Hash: 952105B18003499FDB10DFAAC885AEEFBF5BF48310F14842AE519A7250C7399545CBA4
                                Function 06A502C8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 443 6a502c8-6a50355 ReadProcessMemory 447 6a50357-6a5035d 443->447 448 6a5035e-6a5038e 443->448 447->448
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06A50348
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179718481.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6a50000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: 34bfc909c92058cdad3e321f8d0d7acf1e217e7218e04897de9800628130e33c
                                • Instruction ID: fde27166bf47d63f053694a5ccd89adbee133c675f5f552511c49340d1058044
                                • Opcode Fuzzy Hash: 34bfc909c92058cdad3e321f8d0d7acf1e217e7218e04897de9800628130e33c
                                • Instruction Fuzzy Hash: F22114718003499FDB10DFAAC885AEEFBF5FF48320F10842AE918A7240C7399944CBA4
                                Function 06A50040 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 433 6a50040-6a5008b 435 6a5008d-6a50099 433->435 436 6a5009b-6a500cb Wow64SetThreadContext 433->436 435->436 438 6a500d4-6a50104 436->438 439 6a500cd-6a500d3 436->439 439->438
                                APIs
                                • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06A500BE
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179718481.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6a50000_remcos.jbxd
                                Similarity
                                • API ID: ContextThreadWow64
                                • String ID:
                                • API String ID: 983334009-0
                                • Opcode ID: 94c25be5723d7d5b68124c3b86e04c0ae50327a42e0783d5613bd78eac8352d7
                                • Instruction ID: 78176e35d2ded7c34bed90fd29a3d988e0452c2002ac1227b7c8e939134b58d4
                                • Opcode Fuzzy Hash: 94c25be5723d7d5b68124c3b86e04c0ae50327a42e0783d5613bd78eac8352d7
                                • Instruction Fuzzy Hash: B6213571D003098FDB50DFAAC4857AEBBF4EF88324F15842AD919A7240CB78A944CFA4
                                Function 0697FF11 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179615048.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6970000_remcos.jbxd
                                Similarity
                                • API ID: ResumeThread
                                • String ID:
                                • API String ID: 947044025-0
                                • Opcode ID: edb8bb48b317ad0e441714a2668599d5fbaf4a299589df4abe9d8ab677f889b9
                                • Instruction ID: f853fcca547d937a09f5fd27f9d7b761b078543e60a56bbe6bbfde776065490e
                                • Opcode Fuzzy Hash: edb8bb48b317ad0e441714a2668599d5fbaf4a299589df4abe9d8ab677f889b9
                                • Instruction Fuzzy Hash: B4213371D002498FDB10DFAAD8816AEFBF5EB89324F20846AD519A7640CB35A941CB94
                                Function 009EE4F0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                Download Yara Rule
                                APIs
                                • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 009EE577
                                Memory Dump Source
                                • Source File: 00000004.00000002.2172434228.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_9e0000_remcos.jbxd
                                Similarity
                                • API ID: DuplicateHandle
                                • String ID:
                                • API String ID: 3793708945-0
                                • Opcode ID: a6f4e76998665e607a9704937aae4416fa39555785ea0f88c95dd8f7960d8dd3
                                • Instruction ID: 802049d483e288f377da76bc8ac526559dfd858ccdf5106013e48c1e0f2b98dc
                                • Opcode Fuzzy Hash: a6f4e76998665e607a9704937aae4416fa39555785ea0f88c95dd8f7960d8dd3
                                • Instruction Fuzzy Hash: 4521E4B5900348EFDB10CFAAD884ADEFBF8EB48310F14801AE914A3310D378A954CFA5
                                Function 06A50118 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                Download Yara Rule
                                APIs
                                • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06A50186
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179718481.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6a50000_remcos.jbxd
                                Similarity
                                • API ID: AllocVirtual
                                • String ID:
                                • API String ID: 4275171209-0
                                • Opcode ID: 3435a299ca87b837185bc6014216c787a28f13029aae44d87bc90d43306a6c3d
                                • Instruction ID: 2864a273a6669ab0672b38f3e605fc623982fcfa9b6c0d7414025a3cbcf4e0a7
                                • Opcode Fuzzy Hash: 3435a299ca87b837185bc6014216c787a28f13029aae44d87bc90d43306a6c3d
                                • Instruction Fuzzy Hash: 201126718003499FDB10DFAAC845BDFBBF5AF88314F248419E519A7250CB75A940CBA5
                                Function 0697FF18 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179615048.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6970000_remcos.jbxd
                                Similarity
                                • API ID: ResumeThread
                                • String ID:
                                • API String ID: 947044025-0
                                • Opcode ID: ddfff8ae551c9ffb8a3cff3ee8cd1267bb66bb54b29023c2818393425c447101
                                • Instruction ID: c566620fba748e95ed981f8fe968ea751a98b44de50da8afd28eeffc11b37758
                                • Opcode Fuzzy Hash: ddfff8ae551c9ffb8a3cff3ee8cd1267bb66bb54b29023c2818393425c447101
                                • Instruction Fuzzy Hash: 55113671D003498FDB10DFAAC84579FFBF8AF89724F24841AD519A7240CB79A944CBA4
                                Function 06A52BA9 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON
                                Download Yara Rule
                                APIs
                                • PostMessageW.USER32(?,00000010,00000000,?), ref: 06A52C0D
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179718481.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6a50000_remcos.jbxd
                                Similarity
                                • API ID: MessagePost
                                • String ID:
                                • API String ID: 410705778-0
                                • Opcode ID: b433d1710f8272ee35f9d2cd48726d083db2a496ff3b7fcfed9ff3874cba0ffa
                                • Instruction ID: 1c3250cb0955c54b145084c6472605549b4ae0251d418cfb61960dce95fe7d7d
                                • Opcode Fuzzy Hash: b433d1710f8272ee35f9d2cd48726d083db2a496ff3b7fcfed9ff3874cba0ffa
                                • Instruction Fuzzy Hash: 8F11F2B5800349DFDB10DF9AD885BDEFBF8EB48324F20841AE958A7200C375A644CFA5
                                Function 06A50450 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                Download Yara Rule
                                APIs
                                • PostMessageW.USER32(?,00000010,00000000,?), ref: 06A52C0D
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179718481.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6a50000_remcos.jbxd
                                Similarity
                                • API ID: MessagePost
                                • String ID:
                                • API String ID: 410705778-0
                                • Opcode ID: 6811b79c5090cc0026a2975978df645dbc0ed4167ae031c8b143086ad284ea0f
                                • Instruction ID: 828281bbb80277c1fe448fd864b435803d1eb5bca8ce14b8a0eba462930d03d4
                                • Opcode Fuzzy Hash: 6811b79c5090cc0026a2975978df645dbc0ed4167ae031c8b143086ad284ea0f
                                • Instruction Fuzzy Hash: C71122B5800308DFDB10DF8AC844BEEFBF8EB48310F10841AE918A7200C375AA44CFA5
                                Function 009EBDF8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                Download Yara Rule
                                APIs
                                • GetModuleHandleW.KERNELBASE(00000000), ref: 009EBE5E
                                Memory Dump Source
                                • Source File: 00000004.00000002.2172434228.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_9e0000_remcos.jbxd
                                Similarity
                                • API ID: HandleModule
                                • String ID:
                                • API String ID: 4139908857-0
                                • Opcode ID: 484865f22f2b23fbfd7fcb026d0a4c612464f56cd5f61ec38f71c1d8088f1667
                                • Instruction ID: bca926e04d07aff9e8b18805a2bd7df62e0a560856244eb139271ef50458539c
                                • Opcode Fuzzy Hash: 484865f22f2b23fbfd7fcb026d0a4c612464f56cd5f61ec38f71c1d8088f1667
                                • Instruction Fuzzy Hash: C011DFB6C00749CFDB10CF9AD444ADFFBF9AB88714F10842AD519A7210D379A945CFA5
                                Function 06A50394 Relevance: 1.5, APIs: 1, Instructions: 45COMMON
                                Download Yara Rule
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06A50348
                                Memory Dump Source
                                • Source File: 00000004.00000002.2179718481.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_6a50000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: 6e8b5efa730728f3d0f8c8d72bcd1fb7c841e1fa99a4d6de3dae9e79382dea92
                                • Instruction ID: ac154f2875c02116d8ef3f5c7c4595e01b71e72882a12e86a19b9c7b42eeca66
                                • Opcode Fuzzy Hash: 6e8b5efa730728f3d0f8c8d72bcd1fb7c841e1fa99a4d6de3dae9e79382dea92
                                • Instruction Fuzzy Hash: E70192328093948FDB12DF78D8643CDBFF09F46324F1A449AC194AB192C738844DC766
                                Function 0094D4C4 Relevance: .1, Instructions: 75COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000004.00000002.2171954298.000000000094D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_94d000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: a4dc1145636b5fbd2ce43a969a27376e7016e60f84ce0f452ff96367febd7d90
                                • Instruction ID: bde1debd96a70cf7464bc96318ecf78397f2ce4e1234c9d3f0af40881afb19b4
                                • Opcode Fuzzy Hash: a4dc1145636b5fbd2ce43a969a27376e7016e60f84ce0f452ff96367febd7d90
                                • Instruction Fuzzy Hash: AC212576604240EFDB15DF14D9C0F26BF65FB88318F20C56DE9090B25AC73AD856CAA2
                                Function 0095D1D4 Relevance: .1, Instructions: 72COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000004.00000002.2172071527.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_95d000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 0b0ae7a648d68f8ec6d7bcbe782ab556e9138753f66b212335eddfb6db00ca3f
                                • Instruction ID: 4d018bfa4c5484c250ef7e893e939b0b5c804194836a875715d4620bc4662111
                                • Opcode Fuzzy Hash: 0b0ae7a648d68f8ec6d7bcbe782ab556e9138753f66b212335eddfb6db00ca3f
                                • Instruction Fuzzy Hash: 68210471605304EFDB25DF25D9C0B26BBA5FB84315F20C96DED094B292C37AD84ACB61
                                Function 0095D01C Relevance: .1, Instructions: 72COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000004.00000002.2172071527.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_95d000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: be211bb2023549cd737c55f45b74898f6abc9975a60e7863c03cedbd3d48cc59
                                • Instruction ID: 961449c017a772c3562e088fd9fbddf61612d8b6a932687c7fbc0b4774c2c07a
                                • Opcode Fuzzy Hash: be211bb2023549cd737c55f45b74898f6abc9975a60e7863c03cedbd3d48cc59
                                • Instruction Fuzzy Hash: 8D21F271604204EFDB24DF25D9C0B26BB65FB84315F20C96DDD0A4B296C33AD84BCB62
                                Function 0095D005 Relevance: .1, Instructions: 60COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000004.00000002.2172071527.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_95d000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 1aeae649d9b58a7aea0dfa45041e66cb964c02dcf2673faec3fad8bc1bfa2688
                                • Instruction ID: a753c105fe1593e9b25607385287487a2e7dc7da20a99adfc26f6753f4f91ade
                                • Opcode Fuzzy Hash: 1aeae649d9b58a7aea0dfa45041e66cb964c02dcf2673faec3fad8bc1bfa2688
                                • Instruction Fuzzy Hash: 11219F75509380DFDB12CF20D990B15BF71EB46314F28C5EAD8498B6A7C33A980ACB62
                                Function 0094D4BF Relevance: .1, Instructions: 56COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000004.00000002.2171954298.000000000094D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_94d000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                                • Instruction ID: 441eebda45851e4f043b197b84ae792f979f9d7bbcf37dd4cfac5f416d4e0db0
                                • Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                                • Instruction Fuzzy Hash: 5211E676504280DFCB15CF10D5C4F16BF71FB94314F24C6A9E8494B65AC33AD85ACBA2
                                Function 0095D1CF Relevance: .1, Instructions: 53COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000004.00000002.2172071527.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_4_2_95d000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                                • Instruction ID: 96db352471851f39fd6035c722e89fd67a47a1a5c55fff6beee24bb43408a8c1
                                • Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                                • Instruction Fuzzy Hash: A111BB75904280DFDB11CF10C5C0B15FBA1FB84315F24C6ADDC494B296C33AD84ACB62

                                Execution Graph

                                Execution Coverage:10.3%
                                Dynamic/Decrypted Code Coverage:100%
                                Signature Coverage:0%
                                Total number of Nodes:257
                                Total number of Limit Nodes:13
                                execution_graph 29670 120dea0 29671 120dee6 GetCurrentProcess 29670->29671 29673 120df31 29671->29673 29674 120df38 GetCurrentThread 29671->29674 29673->29674 29675 120df75 GetCurrentProcess 29674->29675 29676 120df6e 29674->29676 29678 120dfab GetCurrentThreadId 29675->29678 29676->29675 29679 120e004 29678->29679 29752 120e4f0 DuplicateHandle 29753 120e586 29752->29753 29680 1204668 29681 120467a 29680->29681 29682 1204686 29681->29682 29686 1204779 29681->29686 29691 1204210 29682->29691 29684 12046a5 29687 120479d 29686->29687 29697 1204878 29687->29697 29701 1204888 29687->29701 29692 120421b 29691->29692 29709 1207908 29692->29709 29694 12084bd 29713 1207918 29694->29713 29696 12084d6 29696->29684 29699 1204888 29697->29699 29698 120498c 29698->29698 29699->29698 29705 120448c 29699->29705 29703 12048af 29701->29703 29702 120498c 29702->29702 29703->29702 29704 120448c CreateActCtxA 29703->29704 29704->29702 29706 1205918 CreateActCtxA 29705->29706 29708 12059db 29706->29708 29710 1207913 29709->29710 29711 1207918 GetModuleHandleW 29710->29711 29712 120874d 29711->29712 29712->29694 29714 1207923 29713->29714 29716 1208975 29714->29716 29717 120821c 29714->29717 29716->29696 29718 1208227 29717->29718 29721 120824c 29718->29721 29720 1208a5a 29720->29716 29722 1208257 29721->29722 29725 120827c 29722->29725 29724 1208b4d 29724->29720 29726 1208287 29725->29726 29727 120942b 29726->29727 29729 120bad8 29726->29729 29727->29724 29733 120bb10 29729->29733 29736 120bb02 29729->29736 29730 120baee 29730->29727 29740 120bbf7 29733->29740 29734 120bb1f 29734->29730 29737 120bb10 29736->29737 29739 120bbf7 GetModuleHandleW 29737->29739 29738 120bb1f 29738->29730 29739->29738 29741 120bc19 29740->29741 29742 120bc3c 29740->29742 29741->29742 29743 120be40 GetModuleHandleW 29741->29743 29742->29734 29744 120be6d 29743->29744 29744->29734 29754 120dd88 29755 120dd95 29754->29755 29756 120ddcf 29755->29756 29758 120c900 29755->29758 29760 120c90b 29758->29760 29759 120eae8 29760->29759 29762 120e0fc 29760->29762 29763 120e107 29762->29763 29764 120827c GetModuleHandleW 29763->29764 29765 120eb57 29764->29765 29765->29759 29766 70808a0 29767 70808a5 29766->29767 29768 7080914 MonitorFromPoint 29767->29768 29769 7080932 29767->29769 29768->29769 29745 73e2830 29746 73e29bb 29745->29746 29747 73e2856 29745->29747 29747->29746 29749 73e03c0 29747->29749 29750 73e2ab0 PostMessageW 29749->29750 29751 73e2b1c 29750->29751 29751->29747 29770 73e1080 29771 73e0c7c 29770->29771 29776 73e1609 29771->29776 29796 73e1640 29771->29796 29815 73e1630 29771->29815 29834 73e16a6 29771->29834 29777 73e1612 29776->29777 29778 73e1649 29776->29778 29777->29771 29792 73e1662 29778->29792 29854 73e1b24 29778->29854 29859 73e1be8 29778->29859 29864 73e224a 29778->29864 29869 73e222d 29778->29869 29874 73e1eac 29778->29874 29879 73e1baf 29778->29879 29883 73e214e 29778->29883 29887 73e1e75 29778->29887 29895 73e1d17 29778->29895 29900 73e1d56 29778->29900 29905 73e1e19 29778->29905 29910 73e22fa 29778->29910 29916 73e1abd 29778->29916 29921 73e1c3f 29778->29921 29926 73e2260 29778->29926 29935 73e1f20 29778->29935 29792->29771 29797 73e165a 29796->29797 29798 73e1c3f 3 API calls 29797->29798 29799 73e1abd 2 API calls 29797->29799 29800 73e22fa 2 API calls 29797->29800 29801 73e1e19 2 API calls 29797->29801 29802 73e1d56 2 API calls 29797->29802 29803 73e1d17 3 API calls 29797->29803 29804 73e1e75 4 API calls 29797->29804 29805 73e214e 2 API calls 29797->29805 29806 73e1baf 2 API calls 29797->29806 29807 73e1eac 2 API calls 29797->29807 29808 73e222d 2 API calls 29797->29808 29809 73e224a 3 API calls 29797->29809 29810 73e1be8 2 API calls 29797->29810 29811 73e1662 29797->29811 29812 73e1b24 2 API calls 29797->29812 29813 73e1f20 3 API calls 29797->29813 29814 73e2260 3 API calls 29797->29814 29798->29811 29799->29811 29800->29811 29801->29811 29802->29811 29803->29811 29804->29811 29805->29811 29806->29811 29807->29811 29808->29811 29809->29811 29810->29811 29811->29771 29812->29811 29813->29811 29814->29811 29816 73e1640 29815->29816 29817 73e1c3f 3 API calls 29816->29817 29818 73e1abd 2 API calls 29816->29818 29819 73e22fa 2 API calls 29816->29819 29820 73e1e19 2 API calls 29816->29820 29821 73e1d56 2 API calls 29816->29821 29822 73e1d17 3 API calls 29816->29822 29823 73e1e75 4 API calls 29816->29823 29824 73e214e 2 API calls 29816->29824 29825 73e1baf 2 API calls 29816->29825 29826 73e1eac 2 API calls 29816->29826 29827 73e222d 2 API calls 29816->29827 29828 73e224a 3 API calls 29816->29828 29829 73e1be8 2 API calls 29816->29829 29830 73e1662 29816->29830 29831 73e1b24 2 API calls 29816->29831 29832 73e1f20 3 API calls 29816->29832 29833 73e2260 3 API calls 29816->29833 29817->29830 29818->29830 29819->29830 29820->29830 29821->29830 29822->29830 29823->29830 29824->29830 29825->29830 29826->29830 29827->29830 29828->29830 29829->29830 29830->29771 29831->29830 29832->29830 29833->29830 29835 73e1634 29834->29835 29837 73e16a9 29834->29837 29836 73e1662 29835->29836 29838 73e1c3f 3 API calls 29835->29838 29839 73e1abd 2 API calls 29835->29839 29840 73e22fa 2 API calls 29835->29840 29841 73e1e19 2 API calls 29835->29841 29842 73e1d56 2 API calls 29835->29842 29843 73e1d17 3 API calls 29835->29843 29844 73e1e75 4 API calls 29835->29844 29845 73e214e 2 API calls 29835->29845 29846 73e1baf 2 API calls 29835->29846 29847 73e1eac 2 API calls 29835->29847 29848 73e222d 2 API calls 29835->29848 29849 73e224a 3 API calls 29835->29849 29850 73e1be8 2 API calls 29835->29850 29851 73e1b24 2 API calls 29835->29851 29852 73e1f20 3 API calls 29835->29852 29853 73e2260 3 API calls 29835->29853 29836->29771 29837->29771 29838->29836 29839->29836 29840->29836 29841->29836 29842->29836 29843->29836 29844->29836 29845->29836 29846->29836 29847->29836 29848->29836 29849->29836 29850->29836 29851->29836 29852->29836 29853->29836 29855 73e1b2a 29854->29855 29940 73e0854 29855->29940 29945 73e0860 29855->29945 29860 73e1bee 29859->29860 29949 73e01d8 29860->29949 29953 73e01d0 29860->29953 29861 73e1c20 29861->29792 29865 73e1c56 29864->29865 29957 73e02c8 29865->29957 29961 73e02c1 29865->29961 29965 73e0394 29865->29965 29870 73e1ec3 29869->29870 29871 73e1dae 29869->29871 29970 708ff18 29870->29970 29974 708ff11 29870->29974 29871->29792 29875 73e1eb2 29874->29875 29877 708ff18 ResumeThread 29875->29877 29878 708ff11 ResumeThread 29875->29878 29876 73e1dae 29876->29792 29877->29876 29878->29876 29978 73e0006 29879->29978 29982 73e0040 29879->29982 29880 73e1b83 29880->29792 29885 73e01d8 WriteProcessMemory 29883->29885 29886 73e01d0 WriteProcessMemory 29883->29886 29884 73e2172 29885->29884 29886->29884 29888 73e1e1c 29887->29888 29889 73e1e7c 29887->29889 29891 73e01d8 WriteProcessMemory 29888->29891 29892 73e01d0 WriteProcessMemory 29888->29892 29986 73e0118 29889->29986 29990 73e0110 29889->29990 29890 73e1e47 29890->29792 29891->29890 29892->29890 29896 73e1d1d 29895->29896 29897 73e02c8 ReadProcessMemory 29896->29897 29898 73e0394 ReadProcessMemory 29896->29898 29899 73e02c1 ReadProcessMemory 29896->29899 29897->29896 29898->29896 29899->29896 29902 73e1d63 29900->29902 29901 73e234b 29903 73e0006 Wow64SetThreadContext 29902->29903 29904 73e0040 Wow64SetThreadContext 29902->29904 29903->29901 29904->29901 29906 73e1e1c 29905->29906 29908 73e01d8 WriteProcessMemory 29906->29908 29909 73e01d0 WriteProcessMemory 29906->29909 29907 73e1e47 29908->29907 29909->29907 29911 73e1bff 29910->29911 29912 73e231b 29911->29912 29914 73e01d8 WriteProcessMemory 29911->29914 29915 73e01d0 WriteProcessMemory 29911->29915 29913 73e1c20 29913->29792 29914->29913 29915->29913 29917 73e1ac7 29916->29917 29918 73e1b58 29917->29918 29919 73e0854 CreateProcessA 29917->29919 29920 73e0860 CreateProcessA 29917->29920 29919->29918 29920->29918 29922 73e1c45 29921->29922 29923 73e02c8 ReadProcessMemory 29922->29923 29924 73e0394 ReadProcessMemory 29922->29924 29925 73e02c1 ReadProcessMemory 29922->29925 29923->29922 29924->29922 29925->29922 29927 73e226d 29926->29927 29928 73e227a 29927->29928 29929 73e02c8 ReadProcessMemory 29927->29929 29930 73e0394 ReadProcessMemory 29927->29930 29931 73e02c1 ReadProcessMemory 29927->29931 29932 73e02c8 ReadProcessMemory 29928->29932 29933 73e0394 ReadProcessMemory 29928->29933 29934 73e02c1 ReadProcessMemory 29928->29934 29929->29928 29930->29928 29931->29928 29932->29928 29933->29928 29934->29928 29936 73e1d1e 29935->29936 29937 73e02c8 ReadProcessMemory 29936->29937 29938 73e0394 ReadProcessMemory 29936->29938 29939 73e02c1 ReadProcessMemory 29936->29939 29937->29936 29938->29936 29939->29936 29941 73e085e CreateProcessA 29940->29941 29942 73e07df 29940->29942 29944 73e0aab 29941->29944 29946 73e08e9 CreateProcessA 29945->29946 29948 73e0aab 29946->29948 29950 73e0220 WriteProcessMemory 29949->29950 29952 73e0277 29950->29952 29952->29861 29954 73e01d8 WriteProcessMemory 29953->29954 29956 73e0277 29954->29956 29956->29861 29958 73e0313 ReadProcessMemory 29957->29958 29960 73e0357 29958->29960 29960->29865 29962 73e02c8 ReadProcessMemory 29961->29962 29964 73e0357 29962->29964 29964->29865 29966 73e039d 29965->29966 29967 73e03b2 29966->29967 29968 73e0333 ReadProcessMemory 29966->29968 29969 73e0357 29968->29969 29969->29865 29971 708ff58 ResumeThread 29970->29971 29973 708ff89 29971->29973 29973->29871 29975 708ff18 ResumeThread 29974->29975 29977 708ff89 29975->29977 29977->29871 29979 73e0085 Wow64SetThreadContext 29978->29979 29981 73e00cd 29979->29981 29981->29880 29983 73e0085 Wow64SetThreadContext 29982->29983 29985 73e00cd 29983->29985 29985->29880 29987 73e0158 VirtualAllocEx 29986->29987 29989 73e0195 29987->29989 29989->29890 29991 73e0118 VirtualAllocEx 29990->29991 29993 73e0195 29991->29993 29993->29890

                                Executed Functions

                                Function 0120DEA0 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                • GetCurrentProcess.KERNEL32 ref: 0120DF1E
                                • GetCurrentThread.KERNEL32 ref: 0120DF5B
                                • GetCurrentProcess.KERNEL32 ref: 0120DF98
                                • GetCurrentThreadId.KERNEL32 ref: 0120DFF1
                                Memory Dump Source
                                • Source File: 00000009.00000002.2272169921.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_1200000_remcos.jbxd
                                Similarity
                                • API ID: Current$ProcessThread
                                • String ID:
                                • API String ID: 2063062207-0
                                • Opcode ID: 9931bca5cc422920312c77f018f4250a3f662333610d2d42ec39701fd4edd150
                                • Instruction ID: 19ea8c195db79b94120347b66dc943fb2af0f0b14f7875732ccb9308194b5a99
                                • Opcode Fuzzy Hash: 9931bca5cc422920312c77f018f4250a3f662333610d2d42ec39701fd4edd150
                                • Instruction Fuzzy Hash: E55165B0911709DFEB14DFAAD548BAEBFF1EF88304F208459E509A7390DB346844CB65
                                Function 073E0854 Relevance: 1.8, APIs: 1, Instructions: 278processCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 195 73e0854-73e085c 196 73e085e-73e08f5 195->196 197 73e07df-73e081a 195->197 200 73e092e-73e094e 196->200 201 73e08f7-73e0901 196->201 216 73e081c-73e0822 197->216 217 73e0823-73e0848 197->217 207 73e0987-73e09b6 200->207 208 73e0950-73e095a 200->208 201->200 202 73e0903-73e0905 201->202 205 73e0928-73e092b 202->205 206 73e0907-73e0911 202->206 205->200 209 73e0915-73e0924 206->209 210 73e0913 206->210 221 73e09ef-73e0aa9 CreateProcessA 207->221 222 73e09b8-73e09c2 207->222 208->207 211 73e095c-73e095e 208->211 209->209 213 73e0926 209->213 210->209 214 73e0960-73e096a 211->214 215 73e0981-73e0984 211->215 213->205 219 73e096e-73e097d 214->219 220 73e096c 214->220 215->207 216->217 219->219 223 73e097f 219->223 220->219 236 73e0aab-73e0ab1 221->236 237 73e0ab2-73e0b38 221->237 222->221 226 73e09c4-73e09c6 222->226 223->215 227 73e09c8-73e09d2 226->227 228 73e09e9-73e09ec 226->228 231 73e09d6-73e09e5 227->231 232 73e09d4 227->232 228->221 231->231 233 73e09e7 231->233 232->231 233->228 236->237 247 73e0b3a-73e0b3e 237->247 248 73e0b48-73e0b4c 237->248 247->248 249 73e0b40 247->249 250 73e0b4e-73e0b52 248->250 251 73e0b5c-73e0b60 248->251 249->248 250->251 252 73e0b54 250->252 253 73e0b62-73e0b66 251->253 254 73e0b70-73e0b74 251->254 252->251 253->254 257 73e0b68 253->257 255 73e0b86-73e0b8d 254->255 256 73e0b76-73e0b7c 254->256 258 73e0b8f-73e0b9e 255->258 259 73e0ba4 255->259 256->255 257->254 258->259 261 73e0ba5 259->261 261->261
                                APIs
                                • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 073E0A96
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303631505.00000000073E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_73e0000_remcos.jbxd
                                Similarity
                                • API ID: CreateProcess
                                • String ID:
                                • API String ID: 963392458-0
                                • Opcode ID: f5933379c24319fb873df5a395464a4e51e91363f50779654967730f9d0fe4ec
                                • Instruction ID: 5cca50a4ed3a078ef0ff8674f01a3b257acbcb510b096c3d32a2b70b2bceb3af
                                • Opcode Fuzzy Hash: f5933379c24319fb873df5a395464a4e51e91363f50779654967730f9d0fe4ec
                                • Instruction Fuzzy Hash: C3B16DB1D0022ACFEF14CF68C8417EDBBB6BF45314F248169E849A7290DB759985CF91
                                Function 073E0860 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 262 73e0860-73e08f5 264 73e092e-73e094e 262->264 265 73e08f7-73e0901 262->265 270 73e0987-73e09b6 264->270 271 73e0950-73e095a 264->271 265->264 266 73e0903-73e0905 265->266 268 73e0928-73e092b 266->268 269 73e0907-73e0911 266->269 268->264 272 73e0915-73e0924 269->272 273 73e0913 269->273 281 73e09ef-73e0aa9 CreateProcessA 270->281 282 73e09b8-73e09c2 270->282 271->270 274 73e095c-73e095e 271->274 272->272 275 73e0926 272->275 273->272 276 73e0960-73e096a 274->276 277 73e0981-73e0984 274->277 275->268 279 73e096e-73e097d 276->279 280 73e096c 276->280 277->270 279->279 283 73e097f 279->283 280->279 293 73e0aab-73e0ab1 281->293 294 73e0ab2-73e0b38 281->294 282->281 284 73e09c4-73e09c6 282->284 283->277 285 73e09c8-73e09d2 284->285 286 73e09e9-73e09ec 284->286 288 73e09d6-73e09e5 285->288 289 73e09d4 285->289 286->281 288->288 290 73e09e7 288->290 289->288 290->286 293->294 304 73e0b3a-73e0b3e 294->304 305 73e0b48-73e0b4c 294->305 304->305 306 73e0b40 304->306 307 73e0b4e-73e0b52 305->307 308 73e0b5c-73e0b60 305->308 306->305 307->308 309 73e0b54 307->309 310 73e0b62-73e0b66 308->310 311 73e0b70-73e0b74 308->311 309->308 310->311 314 73e0b68 310->314 312 73e0b86-73e0b8d 311->312 313 73e0b76-73e0b7c 311->313 315 73e0b8f-73e0b9e 312->315 316 73e0ba4 312->316 313->312 314->311 315->316 318 73e0ba5 316->318 318->318
                                APIs
                                • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 073E0A96
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303631505.00000000073E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_73e0000_remcos.jbxd
                                Similarity
                                • API ID: CreateProcess
                                • String ID:
                                • API String ID: 963392458-0
                                • Opcode ID: efc273797a140d02ef0217f49ec5ec408058bce04f6505a414450bffd02f1857
                                • Instruction ID: b51c07d97919ac341ea6f2a78574a679d31890f1e78fbd4975449b1a9e53520b
                                • Opcode Fuzzy Hash: efc273797a140d02ef0217f49ec5ec408058bce04f6505a414450bffd02f1857
                                • Instruction Fuzzy Hash: CD917EB1D1022ACFEF14CF68C8417EDBBB6BF45314F148169E848A7290DBB49985CF91
                                Function 0120BBF7 Relevance: 1.7, APIs: 1, Instructions: 205COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 319 120bbf7-120bc17 320 120bc43-120bc47 319->320 321 120bc19-120bc26 call 120aeec 319->321 323 120bc49-120bc53 320->323 324 120bc5b-120bc9c 320->324 326 120bc28 321->326 327 120bc3c 321->327 323->324 330 120bca9-120bcb7 324->330 331 120bc9e-120bca6 324->331 376 120bc2e call 120bea0 326->376 377 120bc2e call 120be90 326->377 327->320 332 120bcb9-120bcbe 330->332 333 120bcdb-120bcdd 330->333 331->330 335 120bcc0-120bcc7 call 120aef8 332->335 336 120bcc9 332->336 338 120bce0-120bce7 333->338 334 120bc34-120bc36 334->327 337 120bd78-120bdb4 334->337 340 120bccb-120bcd9 335->340 336->340 365 120bdb6-120bdf0 337->365 341 120bcf4-120bcfb 338->341 342 120bce9-120bcf1 338->342 340->338 344 120bd08-120bd11 call 120af08 341->344 345 120bcfd-120bd05 341->345 342->341 350 120bd13-120bd1b 344->350 351 120bd1e-120bd23 344->351 345->344 350->351 352 120bd41-120bd4e 351->352 353 120bd25-120bd2c 351->353 360 120bd50-120bd6e 352->360 361 120bd71-120bd77 352->361 353->352 355 120bd2e-120bd3e call 120af18 call 120af28 353->355 355->352 360->361 370 120bdf2-120be38 365->370 371 120be40-120be6b GetModuleHandleW 370->371 372 120be3a-120be3d 370->372 373 120be74-120be88 371->373 374 120be6d-120be73 371->374 372->371 374->373 376->334 377->334
                                APIs
                                • GetModuleHandleW.KERNELBASE(00000000), ref: 0120BE5E
                                Memory Dump Source
                                • Source File: 00000009.00000002.2272169921.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_1200000_remcos.jbxd
                                Similarity
                                • API ID: HandleModule
                                • String ID:
                                • API String ID: 4139908857-0
                                • Opcode ID: f0a697773e6dddf74d069b8297ae8b92f9c07b5e372469ca1b0de39f6bb77c93
                                • Instruction ID: cc78ea4ea037212c80ae3056eb9529de3dee8281a5a0883af8e19affe47ba1c3
                                • Opcode Fuzzy Hash: f0a697773e6dddf74d069b8297ae8b92f9c07b5e372469ca1b0de39f6bb77c93
                                • Instruction Fuzzy Hash: 42816574A10B068FD726CF29D05179ABBF1FF88304F008A2ED186D7A92DB75E845CB91
                                Function 0120590D Relevance: 1.6, APIs: 1, Instructions: 98COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 378 120590d-12059d9 CreateActCtxA 380 12059e2-1205a3c 378->380 381 12059db-12059e1 378->381 388 1205a4b-1205a4f 380->388 389 1205a3e-1205a41 380->389 381->380 390 1205a60 388->390 391 1205a51-1205a5d 388->391 389->388 393 1205a61 390->393 391->390 393->393
                                APIs
                                • CreateActCtxA.KERNEL32(?), ref: 012059C9
                                Memory Dump Source
                                • Source File: 00000009.00000002.2272169921.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_1200000_remcos.jbxd
                                Similarity
                                • API ID: Create
                                • String ID:
                                • API String ID: 2289755597-0
                                • Opcode ID: fedb24da4a1fcafc49fa9e6b4bfcd4e0b899bae5af73ac06668f4743dbb63267
                                • Instruction ID: a995dd3fcaf97f94ca1668b276cd9a2741d34b13e2f1a159b0bf7a153f4a4df1
                                • Opcode Fuzzy Hash: fedb24da4a1fcafc49fa9e6b4bfcd4e0b899bae5af73ac06668f4743dbb63267
                                • Instruction Fuzzy Hash: D441E070C0071DCBDB24CFAAC884BCEBBB1BF89704F20856AD509AB255D7756946CF50
                                Function 0120448C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 394 120448c-12059d9 CreateActCtxA 397 12059e2-1205a3c 394->397 398 12059db-12059e1 394->398 405 1205a4b-1205a4f 397->405 406 1205a3e-1205a41 397->406 398->397 407 1205a60 405->407 408 1205a51-1205a5d 405->408 406->405 410 1205a61 407->410 408->407 410->410
                                APIs
                                • CreateActCtxA.KERNEL32(?), ref: 012059C9
                                Memory Dump Source
                                • Source File: 00000009.00000002.2272169921.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_1200000_remcos.jbxd
                                Similarity
                                • API ID: Create
                                • String ID:
                                • API String ID: 2289755597-0
                                • Opcode ID: 8748ee5530ac8a048a3266548312c0fc754bc4b0de12a85d94e4c5d4787e3916
                                • Instruction ID: 5673ca3d54a1160a8be965078f61bcf4fd475a288b125764edf52622812c54b5
                                • Opcode Fuzzy Hash: 8748ee5530ac8a048a3266548312c0fc754bc4b0de12a85d94e4c5d4787e3916
                                • Instruction Fuzzy Hash: CA41F070C0071DCBEB24CFA9C884B8EBBF5BF89704F20856AD509AB251DB756946CF90
                                Function 073E0006 Relevance: 1.6, APIs: 1, Instructions: 87threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 411 73e0006-73e008b 413 73e008d-73e0099 411->413 414 73e009b-73e00cb Wow64SetThreadContext 411->414 413->414 416 73e00cd-73e00d3 414->416 417 73e00d4-73e0104 414->417 416->417
                                APIs
                                • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 073E00BE
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303631505.00000000073E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_73e0000_remcos.jbxd
                                Similarity
                                • API ID: ContextThreadWow64
                                • String ID:
                                • API String ID: 983334009-0
                                • Opcode ID: 685bf499da099ef3959faad8887f553ef1b0a0e6349bdfc3b20ac724d29240e4
                                • Instruction ID: a57837551dd90167fe96c42c42d39977870191db3967fa2ef31adc906c7cc5c7
                                • Opcode Fuzzy Hash: 685bf499da099ef3959faad8887f553ef1b0a0e6349bdfc3b20ac724d29240e4
                                • Instruction Fuzzy Hash: 5B319A719043898FDB11CFA9C8817EEBFF4EF4A320F14846AD459AB252C7789945CB61
                                Function 07080890 Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 421 7080890-708089c 422 70808dd-70808df 421->422 423 708089e 421->423 428 708090c-7080912 422->428 429 70808e1-70808ec 422->429 424 70808a0-70808a4 423->424 425 70808a5-70808d9 423->425 424->425 426 70808dc 425->426 426->422 428->426 432 7080914-7080930 MonitorFromPoint 428->432 430 70808ee-708090a 429->430 431 7080952-708096d 429->431 430->428 439 708096f-708097c 431->439 433 7080939-7080944 432->433 434 7080932-7080938 432->434 441 7080947 call 7080a68 433->441 442 7080947 call 7080a59 433->442 434->433 437 708094d-7080950 437->439 441->437 442->437
                                APIs
                                • MonitorFromPoint.USER32(?,?,00000002), ref: 0708091F
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303232666.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_7080000_remcos.jbxd
                                Similarity
                                • API ID: FromMonitorPoint
                                • String ID:
                                • API String ID: 1566494148-0
                                • Opcode ID: e2969804b93c85666dddaf2add6230eaca70231588584d5e43ef22252fb6b3a5
                                • Instruction ID: b589a04a7aca623331f609879cd3e83ba579592449f111b4360379582d4ec7e0
                                • Opcode Fuzzy Hash: e2969804b93c85666dddaf2add6230eaca70231588584d5e43ef22252fb6b3a5
                                • Instruction Fuzzy Hash: C22189B9904349DFDB51AF95D4447EEBFF0EB09210F10815AD895B7281C7386949CFA1
                                Function 073E01D0 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 443 73e01d0-73e0226 446 73e0228-73e0234 443->446 447 73e0236-73e0275 WriteProcessMemory 443->447 446->447 449 73e027e-73e02ae 447->449 450 73e0277-73e027d 447->450 450->449
                                APIs
                                • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 073E0268
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303631505.00000000073E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_73e0000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessWrite
                                • String ID:
                                • API String ID: 3559483778-0
                                • Opcode ID: 1c9d2908a2ee37f3c02309811c71eb581485b1533caaab2b4eb50a4bd7162da9
                                • Instruction ID: 37cc6349e180b30adb98e917abe67053118146247c9c97ad01e0f3e796f0972d
                                • Opcode Fuzzy Hash: 1c9d2908a2ee37f3c02309811c71eb581485b1533caaab2b4eb50a4bd7162da9
                                • Instruction Fuzzy Hash: B62135B19003599FDF10CFAAC981BDEBBF5FF48310F10842AE918A7240C778A955CBA4
                                Function 073E01D8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 454 73e01d8-73e0226 456 73e0228-73e0234 454->456 457 73e0236-73e0275 WriteProcessMemory 454->457 456->457 459 73e027e-73e02ae 457->459 460 73e0277-73e027d 457->460 460->459
                                APIs
                                • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 073E0268
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303631505.00000000073E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_73e0000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessWrite
                                • String ID:
                                • API String ID: 3559483778-0
                                • Opcode ID: 1b9e953b663eb4762ff43ab722c4fa6841e69aa301a44efdda00cb16161c9ff1
                                • Instruction ID: dd9777227cad970c99b0b7e1f2f3fbfcafa525b3dc67c36d04f2b5c0b33b42fc
                                • Opcode Fuzzy Hash: 1b9e953b663eb4762ff43ab722c4fa6841e69aa301a44efdda00cb16161c9ff1
                                • Instruction Fuzzy Hash: 042113B19003599FDF10CFAAC985BDEBBF5FF48310F10842AE918A7240C778A955CBA4
                                Function 070808A0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 464 70808a0-70808d9 466 70808dc-70808df 464->466 469 708090c-7080912 466->469 470 70808e1-70808ec 466->470 469->466 473 7080914-7080930 MonitorFromPoint 469->473 471 70808ee-708090a 470->471 472 7080952-708096d 470->472 471->469 480 708096f-708097c 472->480 474 7080939-7080944 473->474 475 7080932-7080938 473->475 482 7080947 call 7080a68 474->482 483 7080947 call 7080a59 474->483 475->474 478 708094d-7080950 478->480 482->478 483->478
                                APIs
                                • MonitorFromPoint.USER32(?,?,00000002), ref: 0708091F
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303232666.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_7080000_remcos.jbxd
                                Similarity
                                • API ID: FromMonitorPoint
                                • String ID:
                                • API String ID: 1566494148-0
                                • Opcode ID: 2569ed715af8fd11679caec8e72f2b2e00bfb1631025e80007ad1c77429c8778
                                • Instruction ID: 6425ebb614e315fd8b499c8f5c4a40beb33517625234c7f76f969a65664a8042
                                • Opcode Fuzzy Hash: 2569ed715af8fd11679caec8e72f2b2e00bfb1631025e80007ad1c77429c8778
                                • Instruction Fuzzy Hash: 2D2178B49003099FDB50EF9AD545BAEFFF5EB48314F108419E995AB380CB34A944CFA1
                                Function 073E02C1 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 484 73e02c1-73e0355 ReadProcessMemory 489 73e035e-73e038e 484->489 490 73e0357-73e035d 484->490 490->489
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 073E0348
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303631505.00000000073E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_73e0000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: ead149e71c1535aaaedd050f484094aa0038937c41d811b38440d8d45a763e91
                                • Instruction ID: 80b59920e1da4bc6cea10146e84961a5c2f662a9583f9a405447797a1b0289e1
                                • Opcode Fuzzy Hash: ead149e71c1535aaaedd050f484094aa0038937c41d811b38440d8d45a763e91
                                • Instruction Fuzzy Hash: C02114B18003599FDB10CFAAC981BEEFBF5FF48310F14842AE518A7240C779A951CBA4
                                Function 073E02C8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 504 73e02c8-73e0355 ReadProcessMemory 508 73e035e-73e038e 504->508 509 73e0357-73e035d 504->509 509->508
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 073E0348
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303631505.00000000073E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_73e0000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: 1d8a5737b3d224ffbdd98a7ed15c7c25b8712606886b761ab22cdbbcb057a479
                                • Instruction ID: 26dcd49cc7821dd8db47812e314e957d2d8fcf4600bf9481bb62027657af36bd
                                • Opcode Fuzzy Hash: 1d8a5737b3d224ffbdd98a7ed15c7c25b8712606886b761ab22cdbbcb057a479
                                • Instruction Fuzzy Hash: 352114B18003599FDB10CFAAC981AEEFBF5FF48310F10842AE518A7240C7799951CBA4
                                Function 073E0040 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 494 73e0040-73e008b 496 73e008d-73e0099 494->496 497 73e009b-73e00cb Wow64SetThreadContext 494->497 496->497 499 73e00cd-73e00d3 497->499 500 73e00d4-73e0104 497->500 499->500
                                APIs
                                • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 073E00BE
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303631505.00000000073E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_73e0000_remcos.jbxd
                                Similarity
                                • API ID: ContextThreadWow64
                                • String ID:
                                • API String ID: 983334009-0
                                • Opcode ID: 328fa5f4b42ff1c9bacee4968509d305b23de9dc81219cb3029012d55f6646a4
                                • Instruction ID: ceb535abd7c83d45eac1e9a32fe4a2b4d24fa36608d8bb0fef764187e76dc082
                                • Opcode Fuzzy Hash: 328fa5f4b42ff1c9bacee4968509d305b23de9dc81219cb3029012d55f6646a4
                                • Instruction Fuzzy Hash: A32138B19003099FEB14CFAAC4857EEBBF4EF88324F14842AD519A7240C7789945CFA5
                                Function 0120E4F0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                Download Yara Rule
                                APIs
                                • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0120E577
                                Memory Dump Source
                                • Source File: 00000009.00000002.2272169921.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_1200000_remcos.jbxd
                                Similarity
                                • API ID: DuplicateHandle
                                • String ID:
                                • API String ID: 3793708945-0
                                • Opcode ID: 75a6ebdab3e8eeefe11645916b4e262134587a2ae7e7dde7635aacbedd6d9959
                                • Instruction ID: df52757a38e64b5ca05bc14f459753d8e563022c10b40b9a86d4c78ceef03bd5
                                • Opcode Fuzzy Hash: 75a6ebdab3e8eeefe11645916b4e262134587a2ae7e7dde7635aacbedd6d9959
                                • Instruction Fuzzy Hash: D621E4B5900249DFDB10CFAAD984ADEFFF8EB48310F14841AE918A3350D379A954CF65
                                Function 073E0110 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON
                                Download Yara Rule
                                APIs
                                • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 073E0186
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303631505.00000000073E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_73e0000_remcos.jbxd
                                Similarity
                                • API ID: AllocVirtual
                                • String ID:
                                • API String ID: 4275171209-0
                                • Opcode ID: 5cae62f3aeb1d7537e9ffb3cc29ade0c476861433c15672fcd6aeb61caf1198e
                                • Instruction ID: b338048790c89c2832ea2d43beb98a95e74cd2d151a2e9eea6483ea0c75f9193
                                • Opcode Fuzzy Hash: 5cae62f3aeb1d7537e9ffb3cc29ade0c476861433c15672fcd6aeb61caf1198e
                                • Instruction Fuzzy Hash: 1F1144B68003499FDB10DFAAC845BDFBBF5EF89310F248419E519A7250C779A910CBA0
                                Function 073E0118 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                Download Yara Rule
                                APIs
                                • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 073E0186
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303631505.00000000073E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_73e0000_remcos.jbxd
                                Similarity
                                • API ID: AllocVirtual
                                • String ID:
                                • API String ID: 4275171209-0
                                • Opcode ID: 35b6237305b80588a1d25c1d8fcc17e5053cd31498e018ce206bd7f771a3c270
                                • Instruction ID: d20e3b849a262cd114dc36e3e6ccc0dd42ca78c3e8cde44e87d8b76b341adadf
                                • Opcode Fuzzy Hash: 35b6237305b80588a1d25c1d8fcc17e5053cd31498e018ce206bd7f771a3c270
                                • Instruction Fuzzy Hash: CD112675800349DFDB10DFAAC845BDEBBF5AF88710F248419E519A7250C779A950CBA4
                                Function 0708FF11 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303232666.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_7080000_remcos.jbxd
                                Similarity
                                • API ID: ResumeThread
                                • String ID:
                                • API String ID: 947044025-0
                                • Opcode ID: 91287b437cca17454865bccdd738ba8680e997815280f39ec4193b91f215f18e
                                • Instruction ID: 768f5b370f7f2976b190650ac24cedcd50370acccd39637e217c42ffc8cfc3b8
                                • Opcode Fuzzy Hash: 91287b437cca17454865bccdd738ba8680e997815280f39ec4193b91f215f18e
                                • Instruction Fuzzy Hash: B01125B1D003498FDB10DFAAC8457AEFBF4EF89724F24841AD519A7240CB79A944CBA4
                                Function 0708FF18 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303232666.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_7080000_remcos.jbxd
                                Similarity
                                • API ID: ResumeThread
                                • String ID:
                                • API String ID: 947044025-0
                                • Opcode ID: 0e56bd7812929c0cf2c42e2826409070145da64a2e1d23bd25207bb288e32fb5
                                • Instruction ID: a4c2b48f466bd8284dae1427a83f26a8ba27218db3900ad2d40ee3f3fc8b8183
                                • Opcode Fuzzy Hash: 0e56bd7812929c0cf2c42e2826409070145da64a2e1d23bd25207bb288e32fb5
                                • Instruction Fuzzy Hash: 081136B1D00349CFDB10DFAAC8457DEFBF4AF89724F24841AD519A7240CB79A944CBA4
                                Function 073E03C0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                Download Yara Rule
                                APIs
                                • PostMessageW.USER32(?,00000010,00000000,?), ref: 073E2B0D
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303631505.00000000073E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_73e0000_remcos.jbxd
                                Similarity
                                • API ID: MessagePost
                                • String ID:
                                • API String ID: 410705778-0
                                • Opcode ID: 9f0201a4afb044395158a4cd6f7474a3aa001e7d4ffc90471728d761ef5eac0e
                                • Instruction ID: 73c35fc884039753bc1c914bddaf03379f673aceac5fb926e8df04aa3b3ed720
                                • Opcode Fuzzy Hash: 9f0201a4afb044395158a4cd6f7474a3aa001e7d4ffc90471728d761ef5eac0e
                                • Instruction Fuzzy Hash: 5C1110B5800709DFDB20CF8AC485BDEBBF8EB48320F10841AE918A7240C379A944CFA5
                                Function 0120BDF8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                Download Yara Rule
                                APIs
                                • GetModuleHandleW.KERNELBASE(00000000), ref: 0120BE5E
                                Memory Dump Source
                                • Source File: 00000009.00000002.2272169921.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_1200000_remcos.jbxd
                                Similarity
                                • API ID: HandleModule
                                • String ID:
                                • API String ID: 4139908857-0
                                • Opcode ID: eb588546dcb981cbd99b9149ffcf1e50e95d52abbcb01b05c548b45f679f6e9a
                                • Instruction ID: 0283296a977e2fa3ee6e728aaad62932dd7697a85d6b3237974d116ce141acce
                                • Opcode Fuzzy Hash: eb588546dcb981cbd99b9149ffcf1e50e95d52abbcb01b05c548b45f679f6e9a
                                • Instruction Fuzzy Hash: DD110FB5C00649CFDB20CF9AC444ADEFBF4AB88614F10852AD618A7651C379A945CFA1
                                Function 073E2AA8 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON
                                Download Yara Rule
                                APIs
                                • PostMessageW.USER32(?,00000010,00000000,?), ref: 073E2B0D
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303631505.00000000073E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_73e0000_remcos.jbxd
                                Similarity
                                • API ID: MessagePost
                                • String ID:
                                • API String ID: 410705778-0
                                • Opcode ID: 2cf438b55a6e90457e742abe41bb4dec615fbcde2715b171f08e2162151d74e3
                                • Instruction ID: 5b83d08826f6692fd297d99387221658ae434736c6a67c1fc8ff659c42697890
                                • Opcode Fuzzy Hash: 2cf438b55a6e90457e742abe41bb4dec615fbcde2715b171f08e2162151d74e3
                                • Instruction Fuzzy Hash: 5B11E0B6800749DFDB10DF9AD885BDEBBF8EB48720F10841AE558A7240C375A544CFA1
                                Function 073E0394 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                Download Yara Rule
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 073E0348
                                Memory Dump Source
                                • Source File: 00000009.00000002.2303631505.00000000073E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073E0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_73e0000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: 98935201570de59bc8111031811928a111e4f7475ced02fefc654b22bb3182b1
                                • Instruction ID: 57201d715df6c8e223f7aadd2c9f28dba752eb7e2734cc73b527a2b7d0cf1bc6
                                • Opcode Fuzzy Hash: 98935201570de59bc8111031811928a111e4f7475ced02fefc654b22bb3182b1
                                • Instruction Fuzzy Hash: 2F01C0728087A58FEB02CBA8C4553C9BFF0AF46324F19848AC1989B1A2D3BD5449C725
                                Function 011BD01C Relevance: .1, Instructions: 72COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000009.00000002.2271930594.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_11bd000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 6653b782899e3d0faf98917ff7793b556d984d8d16d7f71f24e3ae29d172112d
                                • Instruction ID: 0b87b10372720ad5721dcf9cd74112d067878ec083b7634a95a79bb314ee40f9
                                • Opcode Fuzzy Hash: 6653b782899e3d0faf98917ff7793b556d984d8d16d7f71f24e3ae29d172112d
                                • Instruction Fuzzy Hash: C121D375604204EFDF1DDF68E5C0B56BB65EB84318F24C56DD9094B246C33AD446CA62
                                Function 011BD1D4 Relevance: .1, Instructions: 72COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000009.00000002.2271930594.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_11bd000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: cdedf262f60956cac1e3d533716baf0a0715ade046c8eec3118227b80a8eb9a8
                                • Instruction ID: f34d25401d7d5f14516b2fa50a1b0baa15920c1c1b1fe2c1aa5683e745b839a9
                                • Opcode Fuzzy Hash: cdedf262f60956cac1e3d533716baf0a0715ade046c8eec3118227b80a8eb9a8
                                • Instruction Fuzzy Hash: 41210771504244EFDF0DDF94E5C0B65BB65FB84328F20C5ADE9094B252C336D846CB62
                                Function 011BD006 Relevance: .1, Instructions: 63COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000009.00000002.2271930594.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_11bd000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: fca848dbe73456d4c2e5943d36be3576d76b28e9071865c9a2396f93cb868b69
                                • Instruction ID: 62a39f6244ab7a46113bb2e3b2f32918475230041edaf9685c63f0458be6c6dc
                                • Opcode Fuzzy Hash: fca848dbe73456d4c2e5943d36be3576d76b28e9071865c9a2396f93cb868b69
                                • Instruction Fuzzy Hash: 8D218075508380DFCB06CF64D9D4B11BF71EB46214F28C5DAD8498F2A7C33A981ACB62
                                Function 011BD1CF Relevance: .1, Instructions: 53COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000009.00000002.2271930594.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_9_2_11bd000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                                • Instruction ID: 78ad3e4f4a489cf602f077ed41b530090a163c85b5c2f3662c5897434ff6bda0
                                • Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                                • Instruction Fuzzy Hash: 2611BB75904280DFCB0ACF54D5C0B15FFA1FB84228F24C6A9D8494B296C33AD40ACB62

                                Execution Graph

                                Execution Coverage:11.2%
                                Dynamic/Decrypted Code Coverage:100%
                                Signature Coverage:0%
                                Total number of Nodes:219
                                Total number of Limit Nodes:11
                                execution_graph 29412 57bd25b 29413 57bd26b 29412->29413 29417 57bfb28 29413->29417 29421 57bfb18 29413->29421 29414 57bd29e 29418 57bfb5b 29417->29418 29419 57bfbc9 29418->29419 29425 57bff13 29418->29425 29419->29414 29422 57bfb5b 29421->29422 29423 57bfbc9 29422->29423 29424 57bff13 ResumeThread 29422->29424 29423->29414 29424->29423 29426 57bfef0 29425->29426 29427 57bff17 ResumeThread 29425->29427 29426->29419 29429 57bff89 29427->29429 29429->29419 29640 25f4668 29641 25f467a 29640->29641 29642 25f4686 29641->29642 29644 25f4779 29641->29644 29645 25f479d 29644->29645 29649 25f4888 29645->29649 29653 25f4878 29645->29653 29651 25f48af 29649->29651 29650 25f498c 29650->29650 29651->29650 29657 25f448c 29651->29657 29655 25f48af 29653->29655 29654 25f498c 29654->29654 29655->29654 29656 25f448c CreateActCtxA 29655->29656 29656->29654 29658 25f5918 CreateActCtxA 29657->29658 29660 25f59db 29658->29660 29660->29660 29405 6aa2830 29406 6aa29bb 29405->29406 29408 6aa2856 29405->29408 29408->29406 29409 6aa03c0 29408->29409 29410 6aa2ab0 PostMessageW 29409->29410 29411 6aa2b1c 29410->29411 29411->29408 29435 6aa1080 29436 6aa0c7c 29435->29436 29440 6aa1630 29436->29440 29459 6aa16a6 29436->29459 29479 6aa1640 29436->29479 29441 6aa165a 29440->29441 29442 6aa1662 29441->29442 29498 6aa224a 29441->29498 29503 6aa1e75 29441->29503 29511 6aa1d17 29441->29511 29516 6aa1d56 29441->29516 29521 6aa1abd 29441->29521 29526 6aa1c3f 29441->29526 29531 6aa1e19 29441->29531 29536 6aa22fa 29441->29536 29542 6aa1b24 29441->29542 29547 6aa2260 29441->29547 29556 6aa1f20 29441->29556 29561 6aa222d 29441->29561 29566 6aa1eac 29441->29566 29571 6aa1baf 29441->29571 29575 6aa214e 29441->29575 29579 6aa1be8 29441->29579 29442->29436 29460 6aa1634 29459->29460 29461 6aa16a9 29459->29461 29462 6aa224a 3 API calls 29460->29462 29463 6aa1be8 2 API calls 29460->29463 29464 6aa214e 2 API calls 29460->29464 29465 6aa1baf 2 API calls 29460->29465 29466 6aa1eac 2 API calls 29460->29466 29467 6aa222d 2 API calls 29460->29467 29468 6aa1f20 3 API calls 29460->29468 29469 6aa2260 3 API calls 29460->29469 29470 6aa1662 29460->29470 29471 6aa1b24 2 API calls 29460->29471 29472 6aa22fa 2 API calls 29460->29472 29473 6aa1e19 2 API calls 29460->29473 29474 6aa1c3f 3 API calls 29460->29474 29475 6aa1abd 2 API calls 29460->29475 29476 6aa1d56 2 API calls 29460->29476 29477 6aa1d17 3 API calls 29460->29477 29478 6aa1e75 4 API calls 29460->29478 29461->29436 29462->29470 29463->29470 29464->29470 29465->29470 29466->29470 29467->29470 29468->29470 29469->29470 29470->29436 29471->29470 29472->29470 29473->29470 29474->29470 29475->29470 29476->29470 29477->29470 29478->29470 29480 6aa165a 29479->29480 29481 6aa1662 29480->29481 29482 6aa224a 3 API calls 29480->29482 29483 6aa1be8 2 API calls 29480->29483 29484 6aa214e 2 API calls 29480->29484 29485 6aa1baf 2 API calls 29480->29485 29486 6aa1eac 2 API calls 29480->29486 29487 6aa222d 2 API calls 29480->29487 29488 6aa1f20 3 API calls 29480->29488 29489 6aa2260 3 API calls 29480->29489 29490 6aa1b24 2 API calls 29480->29490 29491 6aa22fa 2 API calls 29480->29491 29492 6aa1e19 2 API calls 29480->29492 29493 6aa1c3f 3 API calls 29480->29493 29494 6aa1abd 2 API calls 29480->29494 29495 6aa1d56 2 API calls 29480->29495 29496 6aa1d17 3 API calls 29480->29496 29497 6aa1e75 4 API calls 29480->29497 29481->29436 29482->29481 29483->29481 29484->29481 29485->29481 29486->29481 29487->29481 29488->29481 29489->29481 29490->29481 29491->29481 29492->29481 29493->29481 29494->29481 29495->29481 29496->29481 29497->29481 29499 6aa1c56 29498->29499 29584 6aa02c8 29499->29584 29588 6aa0394 29499->29588 29593 6aa02c3 29499->29593 29504 6aa1e1c 29503->29504 29505 6aa1e7c 29503->29505 29597 6aa01d8 29504->29597 29601 6aa01d0 29504->29601 29606 6aa0118 29505->29606 29610 6aa0110 29505->29610 29506 6aa1e47 29506->29442 29512 6aa1d1d 29511->29512 29513 6aa02c8 ReadProcessMemory 29512->29513 29514 6aa02c3 ReadProcessMemory 29512->29514 29515 6aa0394 ReadProcessMemory 29512->29515 29513->29512 29514->29512 29515->29512 29518 6aa1d63 29516->29518 29517 6aa234b 29615 6aa0007 29518->29615 29619 6aa0040 29518->29619 29522 6aa1ac7 29521->29522 29623 6aa0860 29522->29623 29627 6aa0854 29522->29627 29527 6aa1c45 29526->29527 29528 6aa02c8 ReadProcessMemory 29527->29528 29529 6aa02c3 ReadProcessMemory 29527->29529 29530 6aa0394 ReadProcessMemory 29527->29530 29528->29527 29529->29527 29530->29527 29532 6aa1e1c 29531->29532 29534 6aa01d8 WriteProcessMemory 29532->29534 29535 6aa01d0 WriteProcessMemory 29532->29535 29533 6aa1e47 29534->29533 29535->29533 29537 6aa1bff 29536->29537 29538 6aa231b 29537->29538 29540 6aa01d8 WriteProcessMemory 29537->29540 29541 6aa01d0 WriteProcessMemory 29537->29541 29539 6aa1c20 29539->29442 29540->29539 29541->29539 29543 6aa1b2a 29542->29543 29544 6aa1b58 29543->29544 29545 6aa0860 CreateProcessA 29543->29545 29546 6aa0854 CreateProcessA 29543->29546 29545->29544 29546->29544 29548 6aa226d 29547->29548 29549 6aa227a 29548->29549 29550 6aa02c8 ReadProcessMemory 29548->29550 29551 6aa02c3 ReadProcessMemory 29548->29551 29552 6aa0394 ReadProcessMemory 29548->29552 29553 6aa02c8 ReadProcessMemory 29549->29553 29554 6aa02c3 ReadProcessMemory 29549->29554 29555 6aa0394 ReadProcessMemory 29549->29555 29550->29549 29551->29549 29552->29549 29553->29549 29554->29549 29555->29549 29557 6aa1d1e 29556->29557 29558 6aa02c8 ReadProcessMemory 29557->29558 29559 6aa02c3 ReadProcessMemory 29557->29559 29560 6aa0394 ReadProcessMemory 29557->29560 29558->29557 29559->29557 29560->29557 29562 6aa1ec3 29561->29562 29563 6aa1dae 29561->29563 29565 57bff13 ResumeThread 29562->29565 29631 57bff18 29562->29631 29563->29442 29565->29563 29567 6aa1eb2 29566->29567 29569 57bff18 ResumeThread 29567->29569 29570 57bff13 ResumeThread 29567->29570 29568 6aa1dae 29568->29442 29569->29568 29570->29568 29573 6aa0040 Wow64SetThreadContext 29571->29573 29574 6aa0007 Wow64SetThreadContext 29571->29574 29572 6aa1b83 29572->29442 29573->29572 29574->29572 29577 6aa01d8 WriteProcessMemory 29575->29577 29578 6aa01d0 WriteProcessMemory 29575->29578 29576 6aa2172 29577->29576 29578->29576 29580 6aa1bee 29579->29580 29582 6aa01d8 WriteProcessMemory 29580->29582 29583 6aa01d0 WriteProcessMemory 29580->29583 29581 6aa1c20 29581->29442 29582->29581 29583->29581 29585 6aa0313 ReadProcessMemory 29584->29585 29587 6aa0357 29585->29587 29587->29499 29589 6aa039d 29588->29589 29590 6aa03b2 29589->29590 29591 6aa0333 ReadProcessMemory 29589->29591 29592 6aa0357 29591->29592 29592->29499 29594 6aa02c8 ReadProcessMemory 29593->29594 29596 6aa0357 29594->29596 29596->29499 29598 6aa0220 WriteProcessMemory 29597->29598 29600 6aa0277 29598->29600 29600->29506 29602 6aa0193 29601->29602 29603 6aa01d7 WriteProcessMemory 29601->29603 29602->29506 29605 6aa0277 29603->29605 29605->29506 29607 6aa0158 VirtualAllocEx 29606->29607 29609 6aa0193 29607->29609 29609->29506 29611 6aa00f0 29610->29611 29612 6aa0117 VirtualAllocEx 29610->29612 29611->29506 29614 6aa0193 29612->29614 29614->29506 29616 6aa0014 Wow64SetThreadContext 29615->29616 29618 6aa00cd 29616->29618 29618->29517 29620 6aa0085 Wow64SetThreadContext 29619->29620 29622 6aa00cd 29620->29622 29622->29517 29624 6aa08e9 29623->29624 29624->29624 29625 6aa0a4e CreateProcessA 29624->29625 29626 6aa0aab 29625->29626 29626->29626 29628 6aa08e9 29627->29628 29628->29628 29629 6aa0a4e CreateProcessA 29628->29629 29630 6aa0aab 29629->29630 29630->29630 29632 57bff58 ResumeThread 29631->29632 29634 57bff89 29632->29634 29634->29563 29635 57bcfd7 29636 57bcff5 29635->29636 29638 57bfb28 ResumeThread 29636->29638 29639 57bfb18 ResumeThread 29636->29639 29637 57bd028 29638->29637 29639->29637 29386 25fbb10 29389 25fbc08 29386->29389 29387 25fbb1f 29390 25fbc19 29389->29390 29393 25fbc3c 29389->29393 29398 25faeec 29390->29398 29393->29387 29394 25fbc34 29394->29393 29395 25fbe40 GetModuleHandleW 29394->29395 29396 25fbe6d 29395->29396 29396->29387 29399 25fbdf8 GetModuleHandleW 29398->29399 29401 25fbc24 29399->29401 29401->29393 29402 25fbea0 29401->29402 29403 25faeec GetModuleHandleW 29402->29403 29404 25fbeb4 29403->29404 29404->29394 29661 25fdea0 29662 25fdee6 29661->29662 29665 25fe488 29662->29665 29668 25fe09c 29665->29668 29669 25fe4f0 DuplicateHandle 29668->29669 29670 25fdfd3 29669->29670

                                Executed Functions

                                Function 06AA0854 Relevance: 1.7, APIs: 1, Instructions: 246processCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 173 6aa0854-6aa08f5 175 6aa092e-6aa094e 173->175 176 6aa08f7-6aa0901 173->176 183 6aa0950-6aa095a 175->183 184 6aa0987-6aa09b6 175->184 176->175 177 6aa0903-6aa0905 176->177 179 6aa0928-6aa092b 177->179 180 6aa0907-6aa0911 177->180 179->175 181 6aa0913 180->181 182 6aa0915-6aa0924 180->182 181->182 182->182 185 6aa0926 182->185 183->184 186 6aa095c-6aa095e 183->186 190 6aa09b8-6aa09c2 184->190 191 6aa09ef-6aa0aa9 CreateProcessA 184->191 185->179 188 6aa0960-6aa096a 186->188 189 6aa0981-6aa0984 186->189 192 6aa096e-6aa097d 188->192 193 6aa096c 188->193 189->184 190->191 194 6aa09c4-6aa09c6 190->194 204 6aa0aab-6aa0ab1 191->204 205 6aa0ab2-6aa0b38 191->205 192->192 195 6aa097f 192->195 193->192 196 6aa09c8-6aa09d2 194->196 197 6aa09e9-6aa09ec 194->197 195->189 199 6aa09d6-6aa09e5 196->199 200 6aa09d4 196->200 197->191 199->199 201 6aa09e7 199->201 200->199 201->197 204->205 215 6aa0b3a-6aa0b3e 205->215 216 6aa0b48-6aa0b4c 205->216 215->216 217 6aa0b40 215->217 218 6aa0b4e-6aa0b52 216->218 219 6aa0b5c-6aa0b60 216->219 217->216 218->219 220 6aa0b54 218->220 221 6aa0b62-6aa0b66 219->221 222 6aa0b70-6aa0b74 219->222 220->219 221->222 223 6aa0b68 221->223 224 6aa0b86-6aa0b8d 222->224 225 6aa0b76-6aa0b7c 222->225 223->222 226 6aa0b8f-6aa0b9e 224->226 227 6aa0ba4 224->227 225->224 226->227 229 6aa0ba5 227->229 229->229
                                APIs
                                • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06AA0A96
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2384822250.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_6aa0000_remcos.jbxd
                                Similarity
                                • API ID: CreateProcess
                                • String ID:
                                • API String ID: 963392458-0
                                • Opcode ID: 02f3ad2f63efb2840d93160f2c8ff492e9cd165a685f6e695063103b389b0551
                                • Instruction ID: 04b99da65cf579b54607985328bb12f9c40ce210c9b30778a6e4fcfbc92c4a08
                                • Opcode Fuzzy Hash: 02f3ad2f63efb2840d93160f2c8ff492e9cd165a685f6e695063103b389b0551
                                • Instruction Fuzzy Hash: E1A16B71D00319CFEB50DF69C9417EEBBB2BF48318F1485AAD848AB240DB759985CF91
                                Function 06AA0860 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 230 6aa0860-6aa08f5 232 6aa092e-6aa094e 230->232 233 6aa08f7-6aa0901 230->233 240 6aa0950-6aa095a 232->240 241 6aa0987-6aa09b6 232->241 233->232 234 6aa0903-6aa0905 233->234 236 6aa0928-6aa092b 234->236 237 6aa0907-6aa0911 234->237 236->232 238 6aa0913 237->238 239 6aa0915-6aa0924 237->239 238->239 239->239 242 6aa0926 239->242 240->241 243 6aa095c-6aa095e 240->243 247 6aa09b8-6aa09c2 241->247 248 6aa09ef-6aa0aa9 CreateProcessA 241->248 242->236 245 6aa0960-6aa096a 243->245 246 6aa0981-6aa0984 243->246 249 6aa096e-6aa097d 245->249 250 6aa096c 245->250 246->241 247->248 251 6aa09c4-6aa09c6 247->251 261 6aa0aab-6aa0ab1 248->261 262 6aa0ab2-6aa0b38 248->262 249->249 252 6aa097f 249->252 250->249 253 6aa09c8-6aa09d2 251->253 254 6aa09e9-6aa09ec 251->254 252->246 256 6aa09d6-6aa09e5 253->256 257 6aa09d4 253->257 254->248 256->256 258 6aa09e7 256->258 257->256 258->254 261->262 272 6aa0b3a-6aa0b3e 262->272 273 6aa0b48-6aa0b4c 262->273 272->273 274 6aa0b40 272->274 275 6aa0b4e-6aa0b52 273->275 276 6aa0b5c-6aa0b60 273->276 274->273 275->276 277 6aa0b54 275->277 278 6aa0b62-6aa0b66 276->278 279 6aa0b70-6aa0b74 276->279 277->276 278->279 280 6aa0b68 278->280 281 6aa0b86-6aa0b8d 279->281 282 6aa0b76-6aa0b7c 279->282 280->279 283 6aa0b8f-6aa0b9e 281->283 284 6aa0ba4 281->284 282->281 283->284 286 6aa0ba5 284->286 286->286
                                APIs
                                • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06AA0A96
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2384822250.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_6aa0000_remcos.jbxd
                                Similarity
                                • API ID: CreateProcess
                                • String ID:
                                • API String ID: 963392458-0
                                • Opcode ID: 5fce55c85558d2eec133e4e7948f60b845a8672758818e6a5c903492c7cf08ed
                                • Instruction ID: 8322c2445bc7157d98fc2f75f7a3be186104d9e074906b4211f4346ffdf35bf2
                                • Opcode Fuzzy Hash: 5fce55c85558d2eec133e4e7948f60b845a8672758818e6a5c903492c7cf08ed
                                • Instruction Fuzzy Hash: 67916971D00319CFEB60DF69C9417EEBBB2BF48308F1485AAE848A7240DB759985CF91
                                Function 025FBC08 Relevance: 1.7, APIs: 1, Instructions: 197COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 287 25fbc08-25fbc17 288 25fbc19-25fbc26 call 25faeec 287->288 289 25fbc43-25fbc47 287->289 294 25fbc3c 288->294 295 25fbc28-25fbc36 call 25fbea0 288->295 291 25fbc5b-25fbc9c 289->291 292 25fbc49-25fbc53 289->292 298 25fbc9e-25fbca6 291->298 299 25fbca9-25fbcb7 291->299 292->291 294->289 295->294 305 25fbd78-25fbdb4 295->305 298->299 300 25fbcdb-25fbcdd 299->300 301 25fbcb9-25fbcbe 299->301 306 25fbce0-25fbce7 300->306 303 25fbcc9 301->303 304 25fbcc0-25fbcc7 call 25faef8 301->304 308 25fbccb-25fbcd9 303->308 304->308 333 25fbdb6-25fbdf0 305->333 309 25fbce9-25fbcf1 306->309 310 25fbcf4-25fbcfb 306->310 308->306 309->310 312 25fbcfd-25fbd05 310->312 313 25fbd08-25fbd11 call 25faf08 310->313 312->313 318 25fbd1e-25fbd23 313->318 319 25fbd13-25fbd1b 313->319 320 25fbd25-25fbd2c 318->320 321 25fbd41-25fbd4e 318->321 319->318 320->321 323 25fbd2e-25fbd3e call 25faf18 call 25faf28 320->323 328 25fbd71-25fbd77 321->328 329 25fbd50-25fbd6e 321->329 323->321 329->328 338 25fbdf2-25fbe38 333->338 339 25fbe3a-25fbe3d 338->339 340 25fbe40-25fbe6b GetModuleHandleW 338->340 339->340 341 25fbe6d-25fbe73 340->341 342 25fbe74-25fbe88 340->342 341->342
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2354918599.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_25f0000_remcos.jbxd
                                Similarity
                                • API ID: HandleModule
                                • String ID:
                                • API String ID: 4139908857-0
                                • Opcode ID: b7e904f54a199678cb6f6bc624b5795c173b101cd834f0b2d2cc6a06661ee18d
                                • Instruction ID: 6328f35fe01dc05440e02f5cf1fb818642ad2bda09e3d4126ed9f980cb69abe0
                                • Opcode Fuzzy Hash: b7e904f54a199678cb6f6bc624b5795c173b101cd834f0b2d2cc6a06661ee18d
                                • Instruction Fuzzy Hash: EF712370A00B05CFDB64DF2AD45075ABBF1FF88308F008A29D68ADBA40DB35E945CB95
                                Function 025F590D Relevance: 1.6, APIs: 1, Instructions: 98COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 345 25f590d-25f59d9 CreateActCtxA 347 25f59db-25f59e1 345->347 348 25f59e2-25f5a3c 345->348 347->348 355 25f5a3e-25f5a41 348->355 356 25f5a4b-25f5a4f 348->356 355->356 357 25f5a51-25f5a5d 356->357 358 25f5a60 356->358 357->358 360 25f5a61 358->360 360->360
                                APIs
                                • CreateActCtxA.KERNEL32(?), ref: 025F59C9
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2354918599.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_25f0000_remcos.jbxd
                                Similarity
                                • API ID: Create
                                • String ID:
                                • API String ID: 2289755597-0
                                • Opcode ID: cf02cf058d1cb152fa6f3c43706fe2d46b93a787fdae61dd7d13e82eab967b6a
                                • Instruction ID: 50ab08d6d85794de921b4c780ad29a8a3457131917d9bdf84df169fed6cbadcc
                                • Opcode Fuzzy Hash: cf02cf058d1cb152fa6f3c43706fe2d46b93a787fdae61dd7d13e82eab967b6a
                                • Instruction Fuzzy Hash: 37410070C00719CFEB24CFAAC884BCDBBB1BF89304F60856AD548AB251DB716949CF50
                                Function 025F448C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 361 25f448c-25f59d9 CreateActCtxA 364 25f59db-25f59e1 361->364 365 25f59e2-25f5a3c 361->365 364->365 372 25f5a3e-25f5a41 365->372 373 25f5a4b-25f5a4f 365->373 372->373 374 25f5a51-25f5a5d 373->374 375 25f5a60 373->375 374->375 377 25f5a61 375->377 377->377
                                APIs
                                • CreateActCtxA.KERNEL32(?), ref: 025F59C9
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2354918599.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_25f0000_remcos.jbxd
                                Similarity
                                • API ID: Create
                                • String ID:
                                • API String ID: 2289755597-0
                                • Opcode ID: df22349c1895ff8fb016fa53fbc5d8e08dd627ba8838a702aa1e440144af4978
                                • Instruction ID: f7be1b1ade498a8929ec5c8895ae48ea655639c246d7c30cbedb5e3d8fa246eb
                                • Opcode Fuzzy Hash: df22349c1895ff8fb016fa53fbc5d8e08dd627ba8838a702aa1e440144af4978
                                • Instruction Fuzzy Hash: 1A41F170C0071DCBEB24DFAAC884B8EBBB5FF49304F60846AD508AB251DB716949CF94
                                Function 06AA0007 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 378 6aa0007-6aa0012 379 6aa0019-6aa003d 378->379 380 6aa0014-6aa0016 378->380 381 6aa0018 379->381 382 6aa003f-6aa008b 379->382 380->381 381->379 384 6aa009b-6aa00cb Wow64SetThreadContext 382->384 385 6aa008d-6aa0099 382->385 387 6aa00cd-6aa00d3 384->387 388 6aa00d4-6aa0104 384->388 385->384 387->388
                                APIs
                                • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06AA00BE
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2384822250.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_6aa0000_remcos.jbxd
                                Similarity
                                • API ID: ContextThreadWow64
                                • String ID:
                                • API String ID: 983334009-0
                                • Opcode ID: 262cd6f48723d08758d9f1232f83665756003fba80fe5f378cae42f1207521ed
                                • Instruction ID: 71a53a4ada072d732605bc4ef81e5a73b1d46d2e54ae5a16c3469586569ebdba
                                • Opcode Fuzzy Hash: 262cd6f48723d08758d9f1232f83665756003fba80fe5f378cae42f1207521ed
                                • Instruction Fuzzy Hash: D231CF718043499FDB51DFA9C845BEEBFF4EF4A224F19846AD054AB252CB388944CFA1
                                Function 06AA01D0 Relevance: 1.6, APIs: 1, Instructions: 92injectionCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 392 6aa01d0-6aa01d5 393 6aa01b0-6aa01b5 392->393 394 6aa01d7-6aa0226 392->394 395 6aa0193 393->395 396 6aa01b7-6aa01c1 393->396 400 6aa0228-6aa0234 394->400 401 6aa0236-6aa0275 WriteProcessMemory 394->401 398 6aa019c-6aa01aa 395->398 399 6aa0195-6aa019b 395->399 398->393 399->398 400->401 405 6aa027e-6aa02ae 401->405 406 6aa0277-6aa027d 401->406 406->405
                                APIs
                                • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06AA0268
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2384822250.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_6aa0000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessWrite
                                • String ID:
                                • API String ID: 3559483778-0
                                • Opcode ID: a343207c83ce67cab320ad76b007318af158797d2a5b116ac9825f5ee0bb744f
                                • Instruction ID: ba1d1f6bd45b1968c5080fd52a6b8a9619fa45b42e86febd72b805a7cf7a0607
                                • Opcode Fuzzy Hash: a343207c83ce67cab320ad76b007318af158797d2a5b116ac9825f5ee0bb744f
                                • Instruction Fuzzy Hash: B73136729003099FDB50DFAAD8817DEBBF5FF88324F10882AE519A7240C7799955CBA4
                                Function 06AA01D8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 410 6aa01d8-6aa0226 412 6aa0228-6aa0234 410->412 413 6aa0236-6aa0275 WriteProcessMemory 410->413 412->413 415 6aa027e-6aa02ae 413->415 416 6aa0277-6aa027d 413->416 416->415
                                APIs
                                • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06AA0268
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2384822250.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_6aa0000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessWrite
                                • String ID:
                                • API String ID: 3559483778-0
                                • Opcode ID: c3e22b5a55a11c534c8ad7eb6de4f1cab359b58ff71ec63fc93f54cf828e1d4f
                                • Instruction ID: 5a769e319ef09abe18f3b59b64fce5ac55d9c5c9e018de2a8224b639de969487
                                • Opcode Fuzzy Hash: c3e22b5a55a11c534c8ad7eb6de4f1cab359b58ff71ec63fc93f54cf828e1d4f
                                • Instruction Fuzzy Hash: AF2113719003499FDF10DFAAC885BDEBBF5FF48310F10842AE918A7240C7789944CBA4
                                Function 06AA0110 Relevance: 1.6, APIs: 1, Instructions: 66memoryCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 420 6aa0110-6aa0115 421 6aa00f0-6aa0104 420->421 422 6aa0117-6aa018c VirtualAllocEx 420->422 425 6aa0193 422->425 426 6aa019c-6aa01b5 425->426 427 6aa0195-6aa019b 425->427 426->425 431 6aa01b7-6aa01c1 426->431 427->426
                                APIs
                                • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06AA0186
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2384822250.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_6aa0000_remcos.jbxd
                                Similarity
                                • API ID: AllocVirtual
                                • String ID:
                                • API String ID: 4275171209-0
                                • Opcode ID: 0b2a47e80ae3a71a02eecff0188435804816129039c99b8b39987c6c2bf07ce0
                                • Instruction ID: 6b1879d87dbfb0abf1225a81941fd9d0969bbb4d277531b6475fbcf509305300
                                • Opcode Fuzzy Hash: 0b2a47e80ae3a71a02eecff0188435804816129039c99b8b39987c6c2bf07ce0
                                • Instruction Fuzzy Hash: 6E2148728003499FDB10DF9AD8417EEFBF5EF88324F24882AD559A7210C7399511CFA0
                                Function 025FE09C Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 432 25fe09c-25fe584 DuplicateHandle 434 25fe58d-25fe5aa 432->434 435 25fe586-25fe58c 432->435 435->434
                                APIs
                                • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,025FE4B6,?,?,?,?,?), ref: 025FE577
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2354918599.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_25f0000_remcos.jbxd
                                Similarity
                                • API ID: DuplicateHandle
                                • String ID:
                                • API String ID: 3793708945-0
                                • Opcode ID: 685d487601e7269b750dd6e64845f8577781848a6fdd391f090348efdf3a7d37
                                • Instruction ID: ca5bf4ce1ccbfe0ce504a2d8fa284a52d81b1fb190e10b166f0463e476eefeb0
                                • Opcode Fuzzy Hash: 685d487601e7269b750dd6e64845f8577781848a6fdd391f090348efdf3a7d37
                                • Instruction Fuzzy Hash: 3C21F4B5900249EFDB10CF9AD484ADEBBF8FB48310F14841AE914A3310D374A954CFA4
                                Function 06AA02C3 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 438 6aa02c3-6aa0355 ReadProcessMemory 443 6aa035e-6aa038e 438->443 444 6aa0357-6aa035d 438->444 444->443
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06AA0348
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2384822250.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_6aa0000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: 4ac053ab162061b91d8e740b22cc18c800575e402a41e4cbc6c7bc4b7bb5a94c
                                • Instruction ID: a6e19e684ca54b2db50c1475a3d02830f7d31a6cac9084e0e3925904ceb69d3b
                                • Opcode Fuzzy Hash: 4ac053ab162061b91d8e740b22cc18c800575e402a41e4cbc6c7bc4b7bb5a94c
                                • Instruction Fuzzy Hash: 812116718007499FDB10DFAAC881BDEFBF5FF48310F14842AE918A7250C7399545CBA4
                                Function 06AA02C8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 458 6aa02c8-6aa0355 ReadProcessMemory 462 6aa035e-6aa038e 458->462 463 6aa0357-6aa035d 458->463 463->462
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06AA0348
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2384822250.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_6aa0000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: 370ae770eef7c365addc8c6d25e7154269ca9949016b3bde9a3c6f433afd5af2
                                • Instruction ID: 8fd7538b4257b33cc2d2f1933e722663dbb5d648df73e30e2a812fff9d6d991f
                                • Opcode Fuzzy Hash: 370ae770eef7c365addc8c6d25e7154269ca9949016b3bde9a3c6f433afd5af2
                                • Instruction Fuzzy Hash: 4B2114718003499FDB10DFAAC881BEEFBF5FF48310F14842AE918A7240C7399940CBA4
                                Function 06AA0040 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 448 6aa0040-6aa008b 450 6aa009b-6aa00cb Wow64SetThreadContext 448->450 451 6aa008d-6aa0099 448->451 453 6aa00cd-6aa00d3 450->453 454 6aa00d4-6aa0104 450->454 451->450 453->454
                                APIs
                                • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06AA00BE
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2384822250.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_6aa0000_remcos.jbxd
                                Similarity
                                • API ID: ContextThreadWow64
                                • String ID:
                                • API String ID: 983334009-0
                                • Opcode ID: 5a79d8e4d6bffc5cf1b5c53ae6acfa6fbe50fd362af5d1081635867ce9272b39
                                • Instruction ID: 8f89fd578139e4321ef1079d73a60c706238ababd965202c9969b2d98ad7fd5a
                                • Opcode Fuzzy Hash: 5a79d8e4d6bffc5cf1b5c53ae6acfa6fbe50fd362af5d1081635867ce9272b39
                                • Instruction Fuzzy Hash: 27214771D003099FDB10DFAAC4857EEBBF4EF88324F14842AD519A7240CB799944CFA4
                                Function 057BFF13 Relevance: 1.6, APIs: 1, Instructions: 59threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 467 57bff13-57bff15 468 57bfef0-57bfef1 467->468 469 57bff17-57bff87 ResumeThread 467->469 471 57bfef9-57bff02 468->471 473 57bff89-57bff8f 469->473 474 57bff90-57bffb5 469->474 473->474
                                APIs
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2384186507.00000000057B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_57b0000_remcos.jbxd
                                Similarity
                                • API ID: ResumeThread
                                • String ID:
                                • API String ID: 947044025-0
                                • Opcode ID: 2b23a5832291184ed237d25376fc8209bffbcad1ed8a1723c4c9a23818f70da7
                                • Instruction ID: f9346b1478f6d0dcfc110f0ceaeae0d04f718e655ada473c3d82edcaf6741cc7
                                • Opcode Fuzzy Hash: 2b23a5832291184ed237d25376fc8209bffbcad1ed8a1723c4c9a23818f70da7
                                • Instruction Fuzzy Hash: E91147B1D002499FEB10DFAAD8457EEFBF4EF89610F20845AD519A7200C775A941CF94
                                Function 06AA0118 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                Download Yara Rule
                                APIs
                                • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06AA0186
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2384822250.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_6aa0000_remcos.jbxd
                                Similarity
                                • API ID: AllocVirtual
                                • String ID:
                                • API String ID: 4275171209-0
                                • Opcode ID: 4c35e921d21df91d889061eff10b43170087acf375f319a69972f2f18e56218f
                                • Instruction ID: 26a6fb71b594c9bac5852b72f69f515144d3f4125b2ebcbcda1591bcd745d86a
                                • Opcode Fuzzy Hash: 4c35e921d21df91d889061eff10b43170087acf375f319a69972f2f18e56218f
                                • Instruction Fuzzy Hash: A5112671800349DFDB10DFAAC845BEFBBF5EF88314F24881AE519A7250C775A944CBA4
                                Function 025FAEEC Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                Download Yara Rule
                                APIs
                                • GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,025FBC24), ref: 025FBE5E
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2354918599.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_25f0000_remcos.jbxd
                                Similarity
                                • API ID: HandleModule
                                • String ID:
                                • API String ID: 4139908857-0
                                • Opcode ID: 958f44588ce38e3fe5f8160eb593e714cd14204973fff765f42e532b79025c1d
                                • Instruction ID: 64dddb3251a7bb2969194cdf6b89559ffdff56ba0e681801c2b67528711c4cb1
                                • Opcode Fuzzy Hash: 958f44588ce38e3fe5f8160eb593e714cd14204973fff765f42e532b79025c1d
                                • Instruction Fuzzy Hash: 021120B6800609DBDB10CF9AC444B9EFBF4EB88218F20846ADA28B7200D375A504CFA5
                                Function 057BFF18 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2384186507.00000000057B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_57b0000_remcos.jbxd
                                Similarity
                                • API ID: ResumeThread
                                • String ID:
                                • API String ID: 947044025-0
                                • Opcode ID: b97b5f31ec60469da0dc1712ed2b796d218d84970b3f69a8707eca395cf7f1a9
                                • Instruction ID: 21f2a27534dc8ef419f3a318e47dbd3aeee9e903569e60a34e82b1e9a370970d
                                • Opcode Fuzzy Hash: b97b5f31ec60469da0dc1712ed2b796d218d84970b3f69a8707eca395cf7f1a9
                                • Instruction Fuzzy Hash: 98113AB1D00349CFEB10DFAAC8457DEFBF4AF89710F248419D519A7240C779A544CBA4
                                Function 06AA2AA8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                Download Yara Rule
                                APIs
                                • PostMessageW.USER32(?,00000010,00000000,?), ref: 06AA2B0D
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2384822250.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_6aa0000_remcos.jbxd
                                Similarity
                                • API ID: MessagePost
                                • String ID:
                                • API String ID: 410705778-0
                                • Opcode ID: ab392b74946a0edc8fc25353effec6c1ebc066980581bafa48357516cc03a6b6
                                • Instruction ID: 90488266957927964c01e0ba16ab2d85debae8c68d8644cd3a7cd0259432b885
                                • Opcode Fuzzy Hash: ab392b74946a0edc8fc25353effec6c1ebc066980581bafa48357516cc03a6b6
                                • Instruction Fuzzy Hash: BE1122B5800349DFDB50DF9AD845BDEFBF8EB48320F20841AE558A7200C375A954CFA5
                                Function 06AA03C0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                Download Yara Rule
                                APIs
                                • PostMessageW.USER32(?,00000010,00000000,?), ref: 06AA2B0D
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2384822250.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_6aa0000_remcos.jbxd
                                Similarity
                                • API ID: MessagePost
                                • String ID:
                                • API String ID: 410705778-0
                                • Opcode ID: d0b362befbbad4b1cb714564d5e156f8b21a2c4bad49016248e3e90bb0734aeb
                                • Instruction ID: cfc12ea8711f65c4fdf2c63d8b580e35b92b89ab6ce9455928fb8886799b42e3
                                • Opcode Fuzzy Hash: d0b362befbbad4b1cb714564d5e156f8b21a2c4bad49016248e3e90bb0734aeb
                                • Instruction Fuzzy Hash: DD1122B5800708DFDB50DF8AD845BDEBBF8EB48310F24841AE918A7200C375AA54CFA5
                                Function 06AA0394 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                Download Yara Rule
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06AA0348
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2384822250.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_6aa0000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: d17db3a8db343bb05a31375c54f14c8d8217741c57014debe3e7c849b3694332
                                • Instruction ID: 894074388ecfa3ce1d2aeffe00813dca0087cf125e0b25c1796018beda9da593
                                • Opcode Fuzzy Hash: d17db3a8db343bb05a31375c54f14c8d8217741c57014debe3e7c849b3694332
                                • Instruction Fuzzy Hash: 380192728093958FEB029B79D8647CDBFF09F46328F19849BC1D4AB1A2C7385449CB66
                                Function 00A4D4C4 Relevance: .1, Instructions: 75COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2353289924.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_a4d000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: d88b6f287d7b42e55b4cf8a8ed5481e2d6d6d7382c63b7696cd3d5d6f8ef0df1
                                • Instruction ID: 88d6104edb870a5f13892bc82020b5dd19f9766b421f99275ebf3a6bb9e2d2be
                                • Opcode Fuzzy Hash: d88b6f287d7b42e55b4cf8a8ed5481e2d6d6d7382c63b7696cd3d5d6f8ef0df1
                                • Instruction Fuzzy Hash: EF21227A600240EFDB05DF14D9C0B26BF75FBC8318F20C56DE9090B256C736D856CAA2
                                Function 00A5D1D4 Relevance: .1, Instructions: 72COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2353398291.0000000000A5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_a5d000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 6d0e5241fdea79289d64a837d41725b86f32812a1b93741ab6e44f7c9cb13e96
                                • Instruction ID: 29770caafc4779ca2dd5927e34f112c04e3804a86e7a723d4c02e6265d64252c
                                • Opcode Fuzzy Hash: 6d0e5241fdea79289d64a837d41725b86f32812a1b93741ab6e44f7c9cb13e96
                                • Instruction Fuzzy Hash: 0621C271604304EFDB25DF24D9C0B6ABBA5FB84315F24C66DED094B292C376D84ACA61
                                Function 00A5D01C Relevance: .1, Instructions: 72COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2353398291.0000000000A5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_a5d000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 6cc854abb41dc2bbefaf673e8dac16bcdec10fa129a41fa9266c67b5e0441b7b
                                • Instruction ID: 9263ab396c7a1082abe0a47863ad41e0cb1d0c6dd4f7e28af792127acf75ac7b
                                • Opcode Fuzzy Hash: 6cc854abb41dc2bbefaf673e8dac16bcdec10fa129a41fa9266c67b5e0441b7b
                                • Instruction Fuzzy Hash: B121F271604204EFDB24DF24E9C0B26BB65FB84315F20C56DDD0A4B296C33AD84BCA62
                                Function 00A5D005 Relevance: .1, Instructions: 60COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2353398291.0000000000A5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_a5d000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 7585f50efff44059e9b392474b310e7138afc2fc92ff3328fef697f37ef4b377
                                • Instruction ID: 36aabada6bf454bedd41b8ed7ec2b469dd05e5cb9bde021b88cf6caa606ffb85
                                • Opcode Fuzzy Hash: 7585f50efff44059e9b392474b310e7138afc2fc92ff3328fef697f37ef4b377
                                • Instruction Fuzzy Hash: F4219275509380DFDB12CF20D990715BF71FB46314F28C5DAD8498B6A7C33A980ACB62
                                Function 00A4D4BF Relevance: .1, Instructions: 56COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2353289924.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_a4d000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                                • Instruction ID: 611925250d8998bdd7c3c8b08b93633dd849142e71ffc71f6e0615aaa21208d7
                                • Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                                • Instruction Fuzzy Hash: 1511D376504280DFCB15CF10D5C4B16BF71FB94314F24C6A9D8494B656C33AD85ACBA2
                                Function 00A5D1CF Relevance: .1, Instructions: 53COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 0000000C.00000002.2353398291.0000000000A5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5D000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_12_2_a5d000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                                • Instruction ID: f7e33fe9e42cac84f7dcebf87ae7fa6e9ade509da7bfcfe286a726e225250047
                                • Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                                • Instruction Fuzzy Hash: 60118B75904284DFCB15CF10D5C4B59FBA1FB84315F24C6ADDC494B696C33AD84ACB62

                                Execution Graph

                                Execution Coverage:9.8%
                                Dynamic/Decrypted Code Coverage:100%
                                Signature Coverage:0%
                                Total number of Nodes:196
                                Total number of Limit Nodes:12
                                execution_graph 29592 b1e4f0 DuplicateHandle 29593 b1e586 29592->29593 29609 b1dea0 29610 b1dee6 GetCurrentProcess 29609->29610 29612 b1df31 29610->29612 29613 b1df38 GetCurrentThread 29610->29613 29612->29613 29614 b1df75 GetCurrentProcess 29613->29614 29615 b1df6e 29613->29615 29616 b1dfab GetCurrentThreadId 29614->29616 29615->29614 29618 b1e004 29616->29618 29594 b1bdf8 29595 b1be40 GetModuleHandleW 29594->29595 29596 b1be3a 29594->29596 29597 b1be6d 29595->29597 29596->29595 29619 b14668 29620 b1467a 29619->29620 29621 b14686 29620->29621 29623 b14779 29620->29623 29624 b1479d 29623->29624 29628 b14888 29624->29628 29632 b14878 29624->29632 29629 b148af 29628->29629 29630 b1498c 29629->29630 29636 b1448c 29629->29636 29634 b148af 29632->29634 29633 b1498c 29633->29633 29634->29633 29635 b1448c CreateActCtxA 29634->29635 29635->29633 29637 b15918 CreateActCtxA 29636->29637 29639 b159db 29637->29639 29598 6ba2930 29599 6ba2956 29598->29599 29600 6ba2abb 29598->29600 29599->29600 29602 6ba0450 29599->29602 29603 6ba2bb0 PostMessageW 29602->29603 29604 6ba2c1c 29603->29604 29604->29599 29640 6ba1080 29641 6ba0c7c 29640->29641 29645 6ba1609 29641->29645 29664 6ba1645 29641->29664 29683 6ba1640 29641->29683 29646 6ba1610 29645->29646 29657 6ba1662 29646->29657 29702 6ba22fa 29646->29702 29708 6ba1b24 29646->29708 29713 6ba2260 29646->29713 29722 6ba1f20 29646->29722 29727 6ba222d 29646->29727 29732 6ba1eac 29646->29732 29737 6ba1baf 29646->29737 29740 6ba214e 29646->29740 29744 6ba1be8 29646->29744 29749 6ba224a 29646->29749 29754 6ba1e75 29646->29754 29762 6ba1d17 29646->29762 29767 6ba1d56 29646->29767 29771 6ba1abd 29646->29771 29776 6ba1c3f 29646->29776 29781 6ba1e19 29646->29781 29657->29641 29665 6ba165a 29664->29665 29666 6ba22fa 2 API calls 29665->29666 29667 6ba1e19 2 API calls 29665->29667 29668 6ba1c3f 3 API calls 29665->29668 29669 6ba1abd 2 API calls 29665->29669 29670 6ba1d56 Wow64SetThreadContext 29665->29670 29671 6ba1d17 3 API calls 29665->29671 29672 6ba1e75 4 API calls 29665->29672 29673 6ba224a 3 API calls 29665->29673 29674 6ba1be8 2 API calls 29665->29674 29675 6ba214e 2 API calls 29665->29675 29676 6ba1662 29665->29676 29677 6ba1baf Wow64SetThreadContext 29665->29677 29678 6ba1eac 2 API calls 29665->29678 29679 6ba222d 2 API calls 29665->29679 29680 6ba1f20 3 API calls 29665->29680 29681 6ba2260 3 API calls 29665->29681 29682 6ba1b24 2 API calls 29665->29682 29666->29676 29667->29676 29668->29676 29669->29676 29670->29676 29671->29676 29672->29676 29673->29676 29674->29676 29675->29676 29676->29641 29677->29676 29678->29676 29679->29676 29680->29676 29681->29676 29682->29676 29684 6ba165a 29683->29684 29685 6ba22fa 2 API calls 29684->29685 29686 6ba1e19 2 API calls 29684->29686 29687 6ba1c3f 3 API calls 29684->29687 29688 6ba1abd 2 API calls 29684->29688 29689 6ba1d56 Wow64SetThreadContext 29684->29689 29690 6ba1d17 3 API calls 29684->29690 29691 6ba1e75 4 API calls 29684->29691 29692 6ba224a 3 API calls 29684->29692 29693 6ba1be8 2 API calls 29684->29693 29694 6ba214e 2 API calls 29684->29694 29695 6ba1662 29684->29695 29696 6ba1baf Wow64SetThreadContext 29684->29696 29697 6ba1eac 2 API calls 29684->29697 29698 6ba222d 2 API calls 29684->29698 29699 6ba1f20 3 API calls 29684->29699 29700 6ba2260 3 API calls 29684->29700 29701 6ba1b24 2 API calls 29684->29701 29685->29695 29686->29695 29687->29695 29688->29695 29689->29695 29690->29695 29691->29695 29692->29695 29693->29695 29694->29695 29695->29641 29696->29695 29697->29695 29698->29695 29699->29695 29700->29695 29701->29695 29703 6ba1bff 29702->29703 29704 6ba231b 29703->29704 29786 6ba01d8 29703->29786 29790 6ba01d3 29703->29790 29705 6ba1c20 29705->29657 29709 6ba1b2a 29708->29709 29710 6ba1b58 29709->29710 29795 6ba0860 29709->29795 29799 6ba085b 29709->29799 29714 6ba226d 29713->29714 29715 6ba227a 29714->29715 29717 6ba02c3 ReadProcessMemory 29714->29717 29718 6ba0394 ReadProcessMemory 29714->29718 29803 6ba02c8 29714->29803 29719 6ba02c8 ReadProcessMemory 29715->29719 29807 6ba0394 29715->29807 29812 6ba02c3 29715->29812 29717->29715 29718->29715 29719->29715 29723 6ba1d1e 29722->29723 29724 6ba02c8 ReadProcessMemory 29723->29724 29725 6ba02c3 ReadProcessMemory 29723->29725 29726 6ba0394 ReadProcessMemory 29723->29726 29724->29723 29725->29723 29726->29723 29728 6ba1ec3 29727->29728 29729 6ba1dae 29727->29729 29816 6acff18 29728->29816 29820 6acff13 29728->29820 29729->29657 29733 6ba1eb2 29732->29733 29735 6acff18 ResumeThread 29733->29735 29736 6acff13 ResumeThread 29733->29736 29734 6ba1dae 29734->29657 29735->29734 29736->29734 29825 6ba0040 29737->29825 29738 6ba1b83 29738->29657 29742 6ba01d8 WriteProcessMemory 29740->29742 29743 6ba01d3 WriteProcessMemory 29740->29743 29741 6ba2172 29742->29741 29743->29741 29745 6ba1bee 29744->29745 29747 6ba01d8 WriteProcessMemory 29745->29747 29748 6ba01d3 WriteProcessMemory 29745->29748 29746 6ba1c20 29746->29657 29747->29746 29748->29746 29750 6ba1c56 29749->29750 29751 6ba02c8 ReadProcessMemory 29750->29751 29752 6ba02c3 ReadProcessMemory 29750->29752 29753 6ba0394 ReadProcessMemory 29750->29753 29751->29750 29752->29750 29753->29750 29755 6ba1e1c 29754->29755 29756 6ba1e7c 29754->29756 29758 6ba01d8 WriteProcessMemory 29755->29758 29759 6ba01d3 WriteProcessMemory 29755->29759 29829 6ba0118 29756->29829 29833 6ba0113 29756->29833 29757 6ba1e47 29757->29657 29758->29757 29759->29757 29763 6ba1d1d 29762->29763 29764 6ba02c8 ReadProcessMemory 29763->29764 29765 6ba02c3 ReadProcessMemory 29763->29765 29766 6ba0394 ReadProcessMemory 29763->29766 29764->29763 29765->29763 29766->29763 29768 6ba1d63 29767->29768 29770 6ba0040 Wow64SetThreadContext 29768->29770 29769 6ba234b 29770->29769 29772 6ba1ac7 29771->29772 29774 6ba085b CreateProcessA 29772->29774 29775 6ba0860 CreateProcessA 29772->29775 29773 6ba1b58 29774->29773 29775->29773 29777 6ba1c45 29776->29777 29778 6ba02c8 ReadProcessMemory 29777->29778 29779 6ba02c3 ReadProcessMemory 29777->29779 29780 6ba0394 ReadProcessMemory 29777->29780 29778->29777 29779->29777 29780->29777 29782 6ba1e1c 29781->29782 29784 6ba01d8 WriteProcessMemory 29782->29784 29785 6ba01d3 WriteProcessMemory 29782->29785 29783 6ba1e47 29784->29783 29785->29783 29787 6ba0220 WriteProcessMemory 29786->29787 29789 6ba0277 29787->29789 29789->29705 29791 6ba01c1 29790->29791 29792 6ba01d7 WriteProcessMemory 29790->29792 29791->29705 29794 6ba0277 29792->29794 29794->29705 29796 6ba08e9 CreateProcessA 29795->29796 29798 6ba0aab 29796->29798 29798->29798 29800 6ba08e9 29799->29800 29800->29800 29801 6ba0a4e CreateProcessA 29800->29801 29802 6ba0aab 29801->29802 29804 6ba0313 ReadProcessMemory 29803->29804 29806 6ba0357 29804->29806 29806->29715 29808 6ba039d 29807->29808 29809 6ba03b2 29808->29809 29810 6ba0333 ReadProcessMemory 29808->29810 29811 6ba0357 29810->29811 29811->29715 29813 6ba02c8 ReadProcessMemory 29812->29813 29815 6ba0357 29813->29815 29815->29715 29817 6acff58 ResumeThread 29816->29817 29819 6acff89 29817->29819 29819->29729 29821 6acff17 ResumeThread 29820->29821 29822 6acff01 29820->29822 29824 6acff89 29821->29824 29822->29729 29824->29729 29826 6ba0085 Wow64SetThreadContext 29825->29826 29828 6ba00cd 29826->29828 29828->29738 29830 6ba0158 VirtualAllocEx 29829->29830 29832 6ba0195 29830->29832 29832->29757 29834 6ba0101 29833->29834 29835 6ba0117 VirtualAllocEx 29833->29835 29834->29757 29837 6ba0195 29835->29837 29837->29757 29605 6ac08a0 29606 6ac08e3 29605->29606 29607 6ac0901 MonitorFromPoint 29606->29607 29608 6ac0932 29606->29608 29607->29608

                                Executed Functions

                                Function 00B1DEA0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128threadCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                • GetCurrentProcess.KERNEL32 ref: 00B1DF1E
                                • GetCurrentThread.KERNEL32 ref: 00B1DF5B
                                • GetCurrentProcess.KERNEL32 ref: 00B1DF98
                                • GetCurrentThreadId.KERNEL32 ref: 00B1DFF1
                                Strings
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2433678841.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_b10000_remcos.jbxd
                                Similarity
                                • API ID: Current$ProcessThread
                                • String ID: (%e
                                • API String ID: 2063062207-473205626
                                • Opcode ID: 357c77c5ddeb57f9637439fb20b8e1ea66117fa1f8abb3668cbc9505b7a93db1
                                • Instruction ID: f16ef24848374b2175bba50ed1c01700be41b453bf9e59ceaa5af80a3b55f9a7
                                • Opcode Fuzzy Hash: 357c77c5ddeb57f9637439fb20b8e1ea66117fa1f8abb3668cbc9505b7a93db1
                                • Instruction Fuzzy Hash: 775135B0900749DFEB14CFA9D548BEEBBF1EF88304F208459E419A7350D774A985CB66
                                Function 06AC0890 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 21 6ac0890-6ac089c 22 6ac08dd-6ac08ec 21->22 23 6ac089e-6ac08dc 21->23 27 6ac08ee-6ac0930 MonitorFromPoint 22->27 28 6ac0952-6ac096d 22->28 23->22 31 6ac0939-6ac0944 27->31 32 6ac0932-6ac0938 27->32 34 6ac096f-6ac097c 28->34 37 6ac0947 call 6ac0a68 31->37 38 6ac0947 call 6ac0a59 31->38 32->31 36 6ac094d-6ac0950 36->34 37->36 38->36
                                APIs
                                • MonitorFromPoint.USER32(?,?,00000002), ref: 06AC091F
                                Strings
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460593225.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ac0000_remcos.jbxd
                                Similarity
                                • API ID: FromMonitorPoint
                                • String ID: (%e
                                • API String ID: 1566494148-473205626
                                • Opcode ID: d3772ac5c3957d7f6ccf63d3f3eef365ca7f06cc588c138fc8a40dd67a511aa0
                                • Instruction ID: 20d352580317f5526d76beb90d9bf7301723f0f38ecfee4f0255b71ffe516fce
                                • Opcode Fuzzy Hash: d3772ac5c3957d7f6ccf63d3f3eef365ca7f06cc588c138fc8a40dd67a511aa0
                                • Instruction Fuzzy Hash: DC2176B9904349DFDB51AFA9D905BEEBBB4EB09320F10805AE495BB241C3356A05CFA1
                                Function 06AC08A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 39 6ac08a0-6ac08ec 41 6ac08ee-6ac0930 MonitorFromPoint 39->41 42 6ac0952-6ac096d 39->42 45 6ac0939-6ac0944 41->45 46 6ac0932-6ac0938 41->46 48 6ac096f-6ac097c 42->48 51 6ac0947 call 6ac0a68 45->51 52 6ac0947 call 6ac0a59 45->52 46->45 50 6ac094d-6ac0950 50->48 51->50 52->50
                                APIs
                                • MonitorFromPoint.USER32(?,?,00000002), ref: 06AC091F
                                Strings
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460593225.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ac0000_remcos.jbxd
                                Similarity
                                • API ID: FromMonitorPoint
                                • String ID: (%e
                                • API String ID: 1566494148-473205626
                                • Opcode ID: 027b3279dbda891422eb8afde8b3b21c82c2e6e6d861e7d16143fc35216cb620
                                • Instruction ID: 5d45c326968da6dd86cf04568cd2383e3ba26cbf648ea6c9b60fe1eae1581f10
                                • Opcode Fuzzy Hash: 027b3279dbda891422eb8afde8b3b21c82c2e6e6d861e7d16143fc35216cb620
                                • Instruction Fuzzy Hash: 61216675A00208DFDB50AF9AD405BAEBBF5EB48720F108419E955AB341C775A904CFA1
                                Function 06BA0860 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 624 6ba0860-6ba08f5 626 6ba092e-6ba094e 624->626 627 6ba08f7-6ba0901 624->627 634 6ba0950-6ba095a 626->634 635 6ba0987-6ba09b6 626->635 627->626 628 6ba0903-6ba0905 627->628 629 6ba0928-6ba092b 628->629 630 6ba0907-6ba0911 628->630 629->626 632 6ba0913 630->632 633 6ba0915-6ba0924 630->633 632->633 633->633 636 6ba0926 633->636 634->635 637 6ba095c-6ba095e 634->637 641 6ba09b8-6ba09c2 635->641 642 6ba09ef-6ba0aa9 CreateProcessA 635->642 636->629 639 6ba0960-6ba096a 637->639 640 6ba0981-6ba0984 637->640 643 6ba096e-6ba097d 639->643 644 6ba096c 639->644 640->635 641->642 645 6ba09c4-6ba09c6 641->645 655 6ba0aab-6ba0ab1 642->655 656 6ba0ab2-6ba0b38 642->656 643->643 646 6ba097f 643->646 644->643 647 6ba09c8-6ba09d2 645->647 648 6ba09e9-6ba09ec 645->648 646->640 650 6ba09d6-6ba09e5 647->650 651 6ba09d4 647->651 648->642 650->650 652 6ba09e7 650->652 651->650 652->648 655->656 666 6ba0b3a-6ba0b3e 656->666 667 6ba0b48-6ba0b4c 656->667 666->667 668 6ba0b40 666->668 669 6ba0b4e-6ba0b52 667->669 670 6ba0b5c-6ba0b60 667->670 668->667 669->670 673 6ba0b54 669->673 671 6ba0b62-6ba0b66 670->671 672 6ba0b70-6ba0b74 670->672 671->672 674 6ba0b68 671->674 675 6ba0b86-6ba0b8d 672->675 676 6ba0b76-6ba0b7c 672->676 673->670 674->672 677 6ba0b8f-6ba0b9e 675->677 678 6ba0ba4 675->678 676->675 677->678 680 6ba0ba5 678->680 680->680
                                APIs
                                • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06BA0A96
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460755993.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ba0000_remcos.jbxd
                                Similarity
                                • API ID: CreateProcess
                                • String ID:
                                • API String ID: 963392458-0
                                • Opcode ID: 0cda3bead5bacc2d6ebea0a60bd22fe474c8434673e2117f8dddad48d42ce970
                                • Instruction ID: adda6be50adf27c5ad454cf778a5f2019658ac5280a547ac490a0e7d9e56f4e2
                                • Opcode Fuzzy Hash: 0cda3bead5bacc2d6ebea0a60bd22fe474c8434673e2117f8dddad48d42ce970
                                • Instruction Fuzzy Hash: E39159B1D04319CFEB50DF68C941BEDBAB2FF48308F1485AAE849A7240DB759985CF91
                                Function 06BA085B Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 567 6ba085b-6ba08f5 569 6ba092e-6ba094e 567->569 570 6ba08f7-6ba0901 567->570 577 6ba0950-6ba095a 569->577 578 6ba0987-6ba09b6 569->578 570->569 571 6ba0903-6ba0905 570->571 572 6ba0928-6ba092b 571->572 573 6ba0907-6ba0911 571->573 572->569 575 6ba0913 573->575 576 6ba0915-6ba0924 573->576 575->576 576->576 579 6ba0926 576->579 577->578 580 6ba095c-6ba095e 577->580 584 6ba09b8-6ba09c2 578->584 585 6ba09ef-6ba0aa9 CreateProcessA 578->585 579->572 582 6ba0960-6ba096a 580->582 583 6ba0981-6ba0984 580->583 586 6ba096e-6ba097d 582->586 587 6ba096c 582->587 583->578 584->585 588 6ba09c4-6ba09c6 584->588 598 6ba0aab-6ba0ab1 585->598 599 6ba0ab2-6ba0b38 585->599 586->586 589 6ba097f 586->589 587->586 590 6ba09c8-6ba09d2 588->590 591 6ba09e9-6ba09ec 588->591 589->583 593 6ba09d6-6ba09e5 590->593 594 6ba09d4 590->594 591->585 593->593 595 6ba09e7 593->595 594->593 595->591 598->599 609 6ba0b3a-6ba0b3e 599->609 610 6ba0b48-6ba0b4c 599->610 609->610 611 6ba0b40 609->611 612 6ba0b4e-6ba0b52 610->612 613 6ba0b5c-6ba0b60 610->613 611->610 612->613 616 6ba0b54 612->616 614 6ba0b62-6ba0b66 613->614 615 6ba0b70-6ba0b74 613->615 614->615 617 6ba0b68 614->617 618 6ba0b86-6ba0b8d 615->618 619 6ba0b76-6ba0b7c 615->619 616->613 617->615 620 6ba0b8f-6ba0b9e 618->620 621 6ba0ba4 618->621 619->618 620->621 623 6ba0ba5 621->623 623->623
                                APIs
                                • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06BA0A96
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460755993.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ba0000_remcos.jbxd
                                Similarity
                                • API ID: CreateProcess
                                • String ID:
                                • API String ID: 963392458-0
                                • Opcode ID: 5d925154a6847e5e27838ed0d905165aa8ffd97dedade3e5f861bd4ab491dac9
                                • Instruction ID: 0a9d02bff8ec40686d7cc49906fe04ff604abe3f99d31634d4cf66a13ab59d20
                                • Opcode Fuzzy Hash: 5d925154a6847e5e27838ed0d905165aa8ffd97dedade3e5f861bd4ab491dac9
                                • Instruction Fuzzy Hash: D39149B1D04319CFEB50DF68C941BDDBAB2EB48308F1485AAE849A7240DB759985CF91
                                Function 00B1590D Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 681 b1590d-b159d9 CreateActCtxA 683 b159e2-b15a3c 681->683 684 b159db-b159e1 681->684 691 b15a4b-b15a4f 683->691 692 b15a3e-b15a41 683->692 684->683 693 b15a51-b15a5d 691->693 694 b15a60 691->694 692->691 693->694 696 b15a61 694->696 696->696
                                APIs
                                • CreateActCtxA.KERNEL32(?), ref: 00B159C9
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2433678841.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_b10000_remcos.jbxd
                                Similarity
                                • API ID: Create
                                • String ID:
                                • API String ID: 2289755597-0
                                • Opcode ID: 3c1f7bba79081e288aa66742341b31f36239833b7f283227f73affc2e04bb617
                                • Instruction ID: 6ec427e8ba5dfc14d0dc8f78324c8c897a95859c0cd2625ac5944e42de3e1c2c
                                • Opcode Fuzzy Hash: 3c1f7bba79081e288aa66742341b31f36239833b7f283227f73affc2e04bb617
                                • Instruction Fuzzy Hash: EC41F2B0C00A19CBEB24CFA9C884BDEBBF5FF85304F20819AD449AB251D7756946CF51
                                Function 00B1448C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 697 b1448c-b159d9 CreateActCtxA 700 b159e2-b15a3c 697->700 701 b159db-b159e1 697->701 708 b15a4b-b15a4f 700->708 709 b15a3e-b15a41 700->709 701->700 710 b15a51-b15a5d 708->710 711 b15a60 708->711 709->708 710->711 713 b15a61 711->713 713->713
                                APIs
                                • CreateActCtxA.KERNEL32(?), ref: 00B159C9
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2433678841.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_b10000_remcos.jbxd
                                Similarity
                                • API ID: Create
                                • String ID:
                                • API String ID: 2289755597-0
                                • Opcode ID: 9381461e6e62809fdb5702feb6280578b01abc19468350e87d8e1e646f152d4f
                                • Instruction ID: 596dec45c324effaea4b22c2cee458e6712a860854b37a4b176e5e6fdd23d167
                                • Opcode Fuzzy Hash: 9381461e6e62809fdb5702feb6280578b01abc19468350e87d8e1e646f152d4f
                                • Instruction Fuzzy Hash: EF41CF70C00A1DCBEB24CFA9C884B9EBBF5AF89704F6081AAD409AB251D7756945CF91
                                Function 06BA01D3 Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 806 6ba01d3-6ba01d5 807 6ba01c1 806->807 808 6ba01d7-6ba0226 806->808 810 6ba0228-6ba0234 808->810 811 6ba0236-6ba0275 WriteProcessMemory 808->811 810->811 813 6ba027e-6ba02ae 811->813 814 6ba0277-6ba027d 811->814 814->813
                                APIs
                                • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06BA0268
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460755993.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ba0000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessWrite
                                • String ID:
                                • API String ID: 3559483778-0
                                • Opcode ID: 92679045c68fa893f2efaa073ea950c041f54c5dc1627037e1b19f77b428ab37
                                • Instruction ID: 207eb8c0d4db0d7bc8e7d412436ade43f0a73be7fabc0b0535be8d16db3ef548
                                • Opcode Fuzzy Hash: 92679045c68fa893f2efaa073ea950c041f54c5dc1627037e1b19f77b428ab37
                                • Instruction Fuzzy Hash: C92144B29003499FDB50DFAAC881BDEBBF0FF48314F10842AE918A7240D7789941CBA4
                                Function 06BA01D8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 818 6ba01d8-6ba0226 820 6ba0228-6ba0234 818->820 821 6ba0236-6ba0275 WriteProcessMemory 818->821 820->821 823 6ba027e-6ba02ae 821->823 824 6ba0277-6ba027d 821->824 824->823
                                APIs
                                • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06BA0268
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460755993.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ba0000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessWrite
                                • String ID:
                                • API String ID: 3559483778-0
                                • Opcode ID: 7f90603480ef0cb813163a6564eb4c6c8adf921c6439df6a5fef6e2b52f3cefb
                                • Instruction ID: fa9769e963b738238f38a0b8a263adeb1d91f6e87baf862a1c140d349c03b8ed
                                • Opcode Fuzzy Hash: 7f90603480ef0cb813163a6564eb4c6c8adf921c6439df6a5fef6e2b52f3cefb
                                • Instruction Fuzzy Hash: 832124B19003499FDF10DFAAC885BDEBBF5FF48314F10842AE919A7240C7789944CBA4
                                Function 06BA02C3 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                Download Yara Rule
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06BA0348
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460755993.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ba0000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: a5833b2e9bdada8fbbeed5a11a7760d8b109df058d6632755b19f0861846da10
                                • Instruction ID: 01e849c258226c375a20b5c1e2944c441add27ff6123f6d1107a2d88e874a776
                                • Opcode Fuzzy Hash: a5833b2e9bdada8fbbeed5a11a7760d8b109df058d6632755b19f0861846da10
                                • Instruction Fuzzy Hash: A02128B1C003499FDB10DFAAC885BDEBBF5FF48310F108429E519A7240C7799545CBA4
                                Function 06BA02C8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                Download Yara Rule
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06BA0348
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460755993.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ba0000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: 6fe3c747522157d9e9b569361ed8fb1216bc51f955690a18303ef796dd54130d
                                • Instruction ID: 7318f97ede5c26b48cff86a0a73a9013114d27a9159d929e0c9cb7c6b9d1e8a6
                                • Opcode Fuzzy Hash: 6fe3c747522157d9e9b569361ed8fb1216bc51f955690a18303ef796dd54130d
                                • Instruction Fuzzy Hash: 252125B1C003499FDB10DFAAC881BEEBBF5FF48310F10842AE519A7240C7799940CBA4
                                Function 06BA0040 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                Download Yara Rule
                                APIs
                                • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06BA00BE
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460755993.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ba0000_remcos.jbxd
                                Similarity
                                • API ID: ContextThreadWow64
                                • String ID:
                                • API String ID: 983334009-0
                                • Opcode ID: a5da74361811ea8be28ebb01e88a79b9974e36bb9f4ad24220aee0ea04448ce5
                                • Instruction ID: 7b41253cc0b5e81b7674c08daaf0b026f909fd483baee0cef331bb78cd1d687a
                                • Opcode Fuzzy Hash: a5da74361811ea8be28ebb01e88a79b9974e36bb9f4ad24220aee0ea04448ce5
                                • Instruction Fuzzy Hash: 3E2149B1D043098FDB50DFAAC4857EEBBF4EF88314F14842AD519A7240C7789944CFA4
                                Function 00B1E4F0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                Download Yara Rule
                                APIs
                                • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00B1E577
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2433678841.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_b10000_remcos.jbxd
                                Similarity
                                • API ID: DuplicateHandle
                                • String ID:
                                • API String ID: 3793708945-0
                                • Opcode ID: f7e4a7c4da74883555fb73aa976a306c6cb816873be02579fc8eb0d944941cb5
                                • Instruction ID: cde48a830a7e53e3e1dea57d28b62c931c1b1ca40c9bdab42f694ccdaa50dd79
                                • Opcode Fuzzy Hash: f7e4a7c4da74883555fb73aa976a306c6cb816873be02579fc8eb0d944941cb5
                                • Instruction Fuzzy Hash: 7221E4B5D00248DFDB10CFAAD884ADEBBF9EB48310F14805AE914A3310D378A954CF65
                                Function 06BA0113 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON
                                Download Yara Rule
                                APIs
                                • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06BA0186
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460755993.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ba0000_remcos.jbxd
                                Similarity
                                • API ID: AllocVirtual
                                • String ID:
                                • API String ID: 4275171209-0
                                • Opcode ID: dede81b09120d8a6b036b610adb12752e632cc4687e0b5a37bd0c20525c45efb
                                • Instruction ID: e2cb9c31e73de43b4b1efb7a9507bb3c590a62c56bb9d6ec440fea78174f129b
                                • Opcode Fuzzy Hash: dede81b09120d8a6b036b610adb12752e632cc4687e0b5a37bd0c20525c45efb
                                • Instruction Fuzzy Hash: 0D1189B2D043499FDB10DFAAD845BEEBBF5EF88324F10841AE519A7210C7759505CBA0
                                Function 06ACFF13 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460593225.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ac0000_remcos.jbxd
                                Similarity
                                • API ID: ResumeThread
                                • String ID:
                                • API String ID: 947044025-0
                                • Opcode ID: df2405511faab7de1f20da3704ccc7652b425041fc260d605c4b2a5e9c0bf523
                                • Instruction ID: 3df50e2757448b3061ccbe9417836194ad9589ee726c2a6f1e75f0d7c58bd64b
                                • Opcode Fuzzy Hash: df2405511faab7de1f20da3704ccc7652b425041fc260d605c4b2a5e9c0bf523
                                • Instruction Fuzzy Hash: 861146B1D003488FDB10DFAAD8457AEFBF5EF89624F20841AD519A7240C7799905CBA4
                                Function 06BA0118 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                Download Yara Rule
                                APIs
                                • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06BA0186
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460755993.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ba0000_remcos.jbxd
                                Similarity
                                • API ID: AllocVirtual
                                • String ID:
                                • API String ID: 4275171209-0
                                • Opcode ID: 78965edab4e2914ac11b5c9cf5c46d4a0d657ddfd1f3abbeb73ab4d1c8ab44df
                                • Instruction ID: ac67852c0a92039d830f3a02b5ef00503a8142fff29e0df7c8d7f640a72d4e93
                                • Opcode Fuzzy Hash: 78965edab4e2914ac11b5c9cf5c46d4a0d657ddfd1f3abbeb73ab4d1c8ab44df
                                • Instruction Fuzzy Hash: A71123728043499FDB10DFAAC845BEEBBF5EF88324F248419E519A7250C779A944CBA4
                                Function 06ACFF18 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460593225.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ac0000_remcos.jbxd
                                Similarity
                                • API ID: ResumeThread
                                • String ID:
                                • API String ID: 947044025-0
                                • Opcode ID: ff219d953849f31ace2cd9858e04eea8bcb4ad6a41dad4387698276eb75df6f6
                                • Instruction ID: 6e2694f50b16ce137cfc36a0ab59f71f30e7fdffbbf5e957cf4704aa4da4ef8c
                                • Opcode Fuzzy Hash: ff219d953849f31ace2cd9858e04eea8bcb4ad6a41dad4387698276eb75df6f6
                                • Instruction Fuzzy Hash: 041166B1C00348CFDB10DFAAC84579EFBF5EF88320F20841AD519A7240CB79A900CBA4
                                Function 00B1BDF8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                Download Yara Rule
                                APIs
                                • GetModuleHandleW.KERNELBASE(00000000), ref: 00B1BE5E
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2433678841.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_b10000_remcos.jbxd
                                Similarity
                                • API ID: HandleModule
                                • String ID:
                                • API String ID: 4139908857-0
                                • Opcode ID: 463ee7a564b914291ff717dac86e434d351551ae67c78922fdf67777a8519096
                                • Instruction ID: cc1db4c4f5de5ca742fece3aa8f6351d898165f6cddfca97ba4fb45520ca145a
                                • Opcode Fuzzy Hash: 463ee7a564b914291ff717dac86e434d351551ae67c78922fdf67777a8519096
                                • Instruction Fuzzy Hash: 181110B6C00749CFDB10CF9AC444ADEFBF4EB88314F10846AD519A7210C379A545CFA5
                                Function 06BA0450 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                Download Yara Rule
                                APIs
                                • PostMessageW.USER32(?,00000010,00000000,?), ref: 06BA2C0D
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460755993.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ba0000_remcos.jbxd
                                Similarity
                                • API ID: MessagePost
                                • String ID:
                                • API String ID: 410705778-0
                                • Opcode ID: 01b85c58dea1520c1de4d283b4ef6f6114243d76c712c824d47bda7774673f9a
                                • Instruction ID: f18e3c836772f629434097065f87baff7b6d7988fbc0af5bf11ed700d438ad77
                                • Opcode Fuzzy Hash: 01b85c58dea1520c1de4d283b4ef6f6114243d76c712c824d47bda7774673f9a
                                • Instruction Fuzzy Hash: 771122B5804348DFDB50DF9AC848BEEBBF8EB48310F14845AE918A7200C375AA44CFA5
                                Function 06BA2BA9 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON
                                Download Yara Rule
                                APIs
                                • PostMessageW.USER32(?,00000010,00000000,?), ref: 06BA2C0D
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460755993.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ba0000_remcos.jbxd
                                Similarity
                                • API ID: MessagePost
                                • String ID:
                                • API String ID: 410705778-0
                                • Opcode ID: 3d225ff8cde61f020c4d682102563220c5c239ba1bba2c3d84df4b45504c40f1
                                • Instruction ID: fc645aa103d9abf6a63de39fc663c4cd1d22026971bb52a99a0cdcfb928ff311
                                • Opcode Fuzzy Hash: 3d225ff8cde61f020c4d682102563220c5c239ba1bba2c3d84df4b45504c40f1
                                • Instruction Fuzzy Hash: 441100B5804349DFDB50DF9AD985BDEFBF8EB48320F14845AE918A7200C375AA44CFA5
                                Function 06BA2BAD Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON
                                Download Yara Rule
                                APIs
                                • PostMessageW.USER32(?,00000010,00000000,?), ref: 06BA2C0D
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460755993.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ba0000_remcos.jbxd
                                Similarity
                                • API ID: MessagePost
                                • String ID:
                                • API String ID: 410705778-0
                                • Opcode ID: 47e8db8cffcee9ce722053940f6e3a69e3f7ec3ba61257e04fd06b61f5a29dba
                                • Instruction ID: b00de8ac272348ff484e21b00610b0562f20c0b5660841be87570cfe1266a502
                                • Opcode Fuzzy Hash: 47e8db8cffcee9ce722053940f6e3a69e3f7ec3ba61257e04fd06b61f5a29dba
                                • Instruction Fuzzy Hash: B11100B5804349DFDB10DF9AD885BDEFBF8EB48320F10845AE518A7200C379AA44CFA5
                                Function 06BA0394 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                Download Yara Rule
                                APIs
                                • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06BA0348
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2460755993.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_6ba0000_remcos.jbxd
                                Similarity
                                • API ID: MemoryProcessRead
                                • String ID:
                                • API String ID: 1726664587-0
                                • Opcode ID: 8c2261d0c2beb6045aabfcd196ffef3e9d1de9805c2216d44b2043886bb2a3c4
                                • Instruction ID: be26fd96960efbacb225ff40e620f764b781b56ba86339e30d3b6a145669c587
                                • Opcode Fuzzy Hash: 8c2261d0c2beb6045aabfcd196ffef3e9d1de9805c2216d44b2043886bb2a3c4
                                • Instruction Fuzzy Hash: 7E01D4728093948FEB12AB78D8643CDBFF09F4A314F198487C2D4AB192C7394449C766
                                Function 00ABD4C4 Relevance: .1, Instructions: 75COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2433186052.0000000000ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ABD000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_abd000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 737bf620642320a15c30312e08ac196a38d47bb0c86992db56185e29b1fe3285
                                • Instruction ID: 8ccaf84fc85306cf9a9369c203df52aeb56dbf9778aaca285146ecfb73a3be46
                                • Opcode Fuzzy Hash: 737bf620642320a15c30312e08ac196a38d47bb0c86992db56185e29b1fe3285
                                • Instruction Fuzzy Hash: E5212272500244EFDB25DF14D9C0B66BF79FB88318F20C66DE9090B257D336E856CAA2
                                Function 00ACD01C Relevance: .1, Instructions: 72COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2433310931.0000000000ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ACD000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_acd000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 6bfdeda078f7c28bdf05304b72687f7bdb10bd6b609918dd8f5f6b7ea4f4d1e7
                                • Instruction ID: 12242037be95613ed48b724aad43091eb293fa7e747c5c9b318fa11db1cfd145
                                • Opcode Fuzzy Hash: 6bfdeda078f7c28bdf05304b72687f7bdb10bd6b609918dd8f5f6b7ea4f4d1e7
                                • Instruction Fuzzy Hash: 0121F275604204EFDB14DF28D9C0F26BBA5FB84314F20C57DD90A4B286C33AD847CA62
                                Function 00ACD1D4 Relevance: .1, Instructions: 72COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2433310931.0000000000ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ACD000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_acd000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 22382f968e7fa207bab918c502f7a003c1e5dabd83fb22354eead2c75da77cce
                                • Instruction ID: 45288da902d71c3fcec2ecbb0412c0f9e0a49607454c26b21897136d36be70f8
                                • Opcode Fuzzy Hash: 22382f968e7fa207bab918c502f7a003c1e5dabd83fb22354eead2c75da77cce
                                • Instruction Fuzzy Hash: AB2104B1604204EFDB05DF24D9C0F26BBB5FB84314F24C67DE9094B292C336D846CA61
                                Function 00ACD006 Relevance: .1, Instructions: 62COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2433310931.0000000000ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ACD000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_acd000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: f84277d8390ff5c6c133e7911df6148e44b9bf002c27f591a32538d2452645a9
                                • Instruction ID: 87502077cabea5abf222f55a132411610f090254686fea2f80414b19a322fde5
                                • Opcode Fuzzy Hash: f84277d8390ff5c6c133e7911df6148e44b9bf002c27f591a32538d2452645a9
                                • Instruction Fuzzy Hash: C52150755093809FCB12CF24D994B15BF71EB46314F29C5EED8498F6A7C33A980ACB62
                                Function 00ABD4BF Relevance: .1, Instructions: 56COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2433186052.0000000000ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ABD000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_abd000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                                • Instruction ID: 3183e7e0d376469b6ba44850b5d54368d2b610d0a06dc6656ee3bafd60bd713c
                                • Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                                • Instruction Fuzzy Hash: 1911D376504284DFCB15CF10D5C4B56BF71FB94314F24C6A9D8490B657C33AD85ACBA2
                                Function 00ACD1CF Relevance: .1, Instructions: 53COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 0000000E.00000002.2433310931.0000000000ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ACD000, based on PE: false
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_14_2_acd000_remcos.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                                • Instruction ID: c5ff64541b6b0f4902ae29d1670a668bcf6fa6ef3c094c47f8e2fc0968f556ce
                                • Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                                • Instruction Fuzzy Hash: 25118B76904284DFCB15CF10D9C4B55FBA1FB84314F24C6AED8494B696C33AD84ACB62