Edit tour

Windows Analysis Report
AdobeReaderPDFonline.exe

Overview

General Information

Sample name:	AdobeReaderPDFonline.exe
Analysis ID:	1587434
MD5:	af1d0f01b01da4da3a9a54b2bee820e9
SHA1:	859814a52ba8c1a67468cce646974be9bdece0cb
SHA256:	d883efc9e3f21d039ba1bec082b390432ea3f3608657e9ced8682be27c318ec2
Tags:	exeuser-zhuzhu0009
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

AI detected suspicious sample

Allocates memory in foreign processes

Drops PE files to the document folder of the user

Drops large PE files

Injects a PE file into a foreign processes

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

AdobeReaderPDFonline.exe (PID: 5056 cmdline: "C:\Users\user\Desktop\AdobeReaderPDFonline.exe" MD5: AF1D0F01B01DA4DA3A9A54B2BEE820E9)

csc.exe (PID: 2760 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.3922060213.0000000007F43000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.3918431665.0000000006B30000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.3918792657.0000000006DA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: csc.exe PID: 2760	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: csc.exe PID: 2760	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.csc.exe.6b30000.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.csc.exe.7fca228.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\AdobeReaderPDFonline.exe, ProcessId: 5056, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QualysDLP

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: AdobeReaderPDFonline.exe	Virustotal: Detection: 53%			Perma Link
Source: AdobeReaderPDFonline.exe	ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: AdobeReaderPDFonline.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: AdobeReaderPDFonline.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: csc.exe, 00000005.00000003.1715936571.000000000835C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3922905850.0000000009550000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1715936571.0000000008222000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Source\Repos\DS-Platform\CppInstaller\CppSetup\bin\Win32\Release\CppSetup.pdb source: AdobeReaderPDFonline.exe, hdtach.exe.1.dr
Source:	Binary string: protobuf-net.pdb source: csc.exe, 00000005.00000003.1715936571.000000000835C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3922905850.0000000009550000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1715936571.0000000008222000.00000004.00000800.00020000.00000000.sdmp

Source: global traffic

TCP traffic: 192.168.2.8:49708 -> 181.71.216.203:30203

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: newstaticfreepoint24.ddns-ip.net

Source: csc.exe, 00000005.00000002.3918792657.0000000007007000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3918792657.0000000006DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: AdobeReaderPDFonline.exe, hdtach.exe.1.dr	String found in binary or memory: http://www.openssl.org/)
Source: AdobeReaderPDFonline.exe, hdtach.exe.1.dr	String found in binary or memory: https://download-lb.utorrent.com/endpoint/utweb/os/riserollout/track/beta
Source: AdobeReaderPDFonline.exe, hdtach.exe.1.dr	String found in binary or memory: https://download-lb.utorrent.com/endpoint/utweb/os/riserollout/track/betahttps://www.bittorrent.com/
Source: AdobeReaderPDFonline.exe, hdtach.exe.1.dr	String found in binary or memory: https://dvpwdfe80sj9.cloudfront.net/f/
Source: AdobeReaderPDFonline.exe, hdtach.exe.1.dr	String found in binary or memory: https://dvpwdfe80sj9.cloudfront.net/o
Source: AdobeReaderPDFonline.exe, hdtach.exe.1.dr	String found in binary or memory: https://dvpwdfe80sj9.cloudfront.net/ohttps://dvpwdfe80sj9.cloudfront.net/zbdhttps://dvpwdfe80sj9.clo
Source: AdobeReaderPDFonline.exe, hdtach.exe.1.dr	String found in binary or memory: https://dvpwdfe80sj9.cloudfront.net/zbd
Source: AdobeReaderPDFonline.exe, hdtach.exe.1.dr	String found in binary or memory: https://github.com/arvidn/libtorrent/blob/master/LICENSE
Source: csc.exe, 00000005.00000003.1715936571.000000000835C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3922905850.0000000009550000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1715936571.0000000008222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: csc.exe, 00000005.00000003.1715936571.000000000835C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3922905850.0000000009550000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1715936571.0000000008222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: csc.exe, 00000005.00000003.1715936571.000000000835C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3922905850.0000000009550000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1715936571.0000000008222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: AdobeReaderPDFonline.exe, hdtach.exe.1.dr	String found in binary or memory: https://github.com/webtorrent/webtorrent/blob/master/LICENSE
Source: csc.exe, 00000005.00000003.1715936571.000000000835C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3922905850.0000000009550000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1715936571.0000000008222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: csc.exe, 00000005.00000003.1715936571.000000000835C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3922905850.0000000009550000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1715936571.0000000008222000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3918792657.0000000006DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: csc.exe, 00000005.00000003.1715936571.000000000835C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3922905850.0000000009550000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1715936571.0000000008222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: AdobeReaderPDFonline.exe, hdtach.exe.1.dr	String found in binary or memory: https://www.bittorrent.com/legal/privacy-policy/
Source: AdobeReaderPDFonline.exe, hdtach.exe.1.dr	String found in binary or memory: https://www.bittorrent.com/legal/terms-of-use/

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe

File dump: hdtach.exe.1.dr 959667331

Jump to dropped file

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02603A1D	1_2_02603A1D
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025E573A	1_2_025E573A
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025FE508	1_2_025FE508
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F95B4	1_2_025F95B4
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EAA05	1_2_025EAA05
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025E323F	1_2_025E323F
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025FBA3C	1_2_025FBA3C
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025E723B	1_2_025E723B
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F0A21	1_2_025F0A21
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F1221	1_2_025F1221
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025E22D5	1_2_025E22D5
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F12CE	1_2_025F12CE
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F12C3	1_2_025F12C3
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EE282	1_2_025EE282
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EC35D	1_2_025EC35D
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F0B6E	1_2_025F0B6E
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025ED30E	1_2_025ED30E
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F0B3F	1_2_025F0B3F
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F0B2C	1_2_025F0B2C
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025E2327	1_2_025E2327
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F1BDF	1_2_025F1BDF
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F0BF7	1_2_025F0BF7
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025FC3EE	1_2_025FC3EE
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EF390	1_2_025EF390
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F0BB0	1_2_025F0BB0
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EC852	1_2_025EC852
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025ED871	1_2_025ED871
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025E4863	1_2_025E4863
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025FF061	1_2_025FF061
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0260282C	1_2_0260282C
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F1011	1_2_025F1011
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EE00A	1_2_025EE00A
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025ED809	1_2_025ED809
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F1038	1_2_025F1038
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025ED82E	1_2_025ED82E
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F102F	1_2_025F102F
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025E48D4	1_2_025E48D4
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EC0C1	1_2_025EC0C1
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EC0BA	1_2_025EC0BA
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025ED950	1_2_025ED950
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025ED96E	1_2_025ED96E
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02603955	1_2_02603955
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EC111	1_2_025EC111
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EC90E	1_2_025EC90E
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EC104	1_2_025EC104
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025E1939	1_2_025E1939
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025E212E	1_2_025E212E
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025ED920	1_2_025ED920
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F1199	1_2_025F1199
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025E5992	1_2_025E5992
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_026021B0	1_2_026021B0
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025FE98E	1_2_025FE98E
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F11A6	1_2_025F11A6
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EC9A1	1_2_025EC9A1
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02602E78	1_2_02602E78
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EC63D	1_2_025EC63D
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EC637	1_2_025EC637
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F0E2E	1_2_025F0E2E
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EAEF4	1_2_025EAEF4
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F5E87	1_2_025F5E87
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025E5745	1_2_025E5745
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EA76F	1_2_025EA76F
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F176D	1_2_025F176D
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025E1F3C	1_2_025E1F3C
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F27DA	1_2_025F27DA
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025ED7D6	1_2_025ED7D6
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F279E	1_2_025F279E
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EC785	1_2_025EC785
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025ED7BE	1_2_025ED7BE
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025ED7A7	1_2_025ED7A7
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025E2C7B	1_2_025E2C7B
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025E3473	1_2_025E3473
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F0C1F	1_2_025F0C1F
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EDC30	1_2_025EDC30
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EDCF6	1_2_025EDCF6
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025E3C95	1_2_025E3C95
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EDC8E	1_2_025EDC8E
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EDC86	1_2_025EDC86
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F2CB8	1_2_025F2CB8
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F1559	1_2_025F1559
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F1568	1_2_025F1568
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EDD24	1_2_025EDD24
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025FBDD6	1_2_025FBDD6
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025ED5FF	1_2_025ED5FF
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025E65E7	1_2_025E65E7
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EC59E	1_2_025EC59E
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_026035B9	1_2_026035B9
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025F2585	1_2_025F2585
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EC5BA	1_2_025EC5BA
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EC5A5	1_2_025EC5A5
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02663E0B	1_2_02663E0B
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266D740	1_2_0266D740
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266788D	1_2_0266788D
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02664672	1_2_02664672
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266D643	1_2_0266D643
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266464D	1_2_0266464D
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266C24D	1_2_0266C24D
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02664A58	1_2_02664A58
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02669A2F	1_2_02669A2F
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266BA36	1_2_0266BA36
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266D635	1_2_0266D635
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266D6E3	1_2_0266D6E3
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02664AFD	1_2_02664AFD
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_026686F9	1_2_026686F9
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02666AD6	1_2_02666AD6
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_026682A4	1_2_026682A4
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266C6A5	1_2_0266C6A5
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266D6A3	1_2_0266D6A3
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266C282	1_2_0266C282
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266D68A	1_2_0266D68A
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02668689	1_2_02668689
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266D777	1_2_0266D777
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02668B7F	1_2_02668B7F
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02668743	1_2_02668743
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266CF4C	1_2_0266CF4C
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266CF51	1_2_0266CF51
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266835C	1_2_0266835C
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02668337	1_2_02668337
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266A706	1_2_0266A706
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266B7EC	1_2_0266B7EC
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266CFF4	1_2_0266CFF4
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266CFFF	1_2_0266CFFF
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266D3F8	1_2_0266D3F8
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_026697C5	1_2_026697C5
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_026683C8	1_2_026683C8
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_026683D9	1_2_026683D9
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266D3A3	1_2_0266D3A3
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_026697AE	1_2_026697AE
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266B7AB	1_2_0266B7AB
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_026647BA	1_2_026647BA
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_026697B8	1_2_026697B8
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02664B81	1_2_02664B81
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266479B	1_2_0266479B
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266C471	1_2_0266C471
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02664C48	1_2_02664C48
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266C449	1_2_0266C449
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02664C5A	1_2_02664C5A
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266B82D	1_2_0266B82D
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266C429	1_2_0266C429
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266C412	1_2_0266C412
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266481A	1_2_0266481A
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02667418	1_2_02667418
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266C4F5	1_2_0266C4F5
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266D8FE	1_2_0266D8FE
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02664C92	1_2_02664C92
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02665172	1_2_02665172
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266B179	1_2_0266B179
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266854F	1_2_0266854F
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266B54F	1_2_0266B54F
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266B94A	1_2_0266B94A
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02667155	1_2_02667155
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02669955	1_2_02669955
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02664D22	1_2_02664D22
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266D93C	1_2_0266D93C
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02664D11	1_2_02664D11
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_026649EA	1_2_026649EA
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_026695FC	1_2_026695FC
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266D9D8	1_2_0266D9D8
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02664DA7	1_2_02664DA7
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_0266C5A7	1_2_0266C5A7
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02664DAC	1_2_02664DAC
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_026685B2	1_2_026685B2
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_02669182	1_2_02669182
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_04E93060	5_2_04E93060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_04E93054	5_2_04E93054
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_06B24798	5_2_06B24798
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_06B2C220	5_2_06B2C220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_06B24788	5_2_06B24788
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_06B2C547	5_2_06B2C547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_06B2D250	5_2_06B2D250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_06B23E56	5_2_06B23E56
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_06B23DB0	5_2_06B23DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_06B23DE0	5_2_06B23DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_06B24A4A	5_2_06B24A4A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_06B24922	5_2_06B24922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_093D3120	5_2_093D3120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_093D5F80	5_2_093D5F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_093D13F0	5_2_093D13F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_093D07D8	5_2_093D07D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_093D3113	5_2_093D3113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_093D1DB0	5_2_093D1DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_093D1DC0	5_2_093D1DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_093D0B20	5_2_093D0B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_093D32FF	5_2_093D32FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_095ACB38	5_2_095ACB38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_095AE298	5_2_095AE298
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_095AE289	5_2_095AE289

Source: AdobeReaderPDFonline.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal88.evad.winEXE@3/1@1/1

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe

File created: C:\Users\user\Documents\Elaborate Bytes

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Mutant created: \Sessions\1\BaseNamedObjects\mono1234

Source: AdobeReaderPDFonline.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AdobeReaderPDFonline.exe	Virustotal: Detection: 53%
Source: AdobeReaderPDFonline.exe	ReversingLabs: Detection: 44%

Source: AdobeReaderPDFonline.exe	String found in binary or memory: <LAUNCH_CHECKBOX>Launch the application on exit</LAUNCH_CHECKBOX>
Source: AdobeReaderPDFonline.exe	String found in binary or memory: n al cerrar</LAUNCH_CHECKBOX>
Source: AdobeReaderPDFonline.exe	String found in binary or memory: <LAUNCH_RADIO>Launch</LAUNCH_RADIO>
Source: AdobeReaderPDFonline.exe	String found in binary or memory: <LAUNCH_RADIO>Iniciar</LAUNCH_RADIO>
Source: AdobeReaderPDFonline.exe	String found in binary or memory: <LAUNCH_RADIO>Arrancar</LAUNCH_RADIO>
Source: AdobeReaderPDFonline.exe	String found in binary or memory: <LAUNCH_RADIO>Uruchom</LAUNCH_RADIO>
Source: AdobeReaderPDFonline.exe	String found in binary or memory: <LAUNCH_RADIO>Spustit</LAUNCH_RADIO>
Source: AdobeReaderPDFonline.exe	String found in binary or memory: <LAUNCH_RADIO>Start</LAUNCH_RADIO>
Source: AdobeReaderPDFonline.exe	String found in binary or memory: hren</LAUNCH_RADIO>
Source: AdobeReaderPDFonline.exe	String found in binary or memory: </LAUNCH_RADIO>
Source: AdobeReaderPDFonline.exe	String found in binary or memory: <LAUNCH_RADIO>Lancer</LAUNCH_RADIO>
Source: AdobeReaderPDFonline.exe	String found in binary or memory: <LAUNCH_RADIO>Avvia</LAUNCH_RADIO>
Source: AdobeReaderPDFonline.exe	String found in binary or memory: <LAUNCH_RADIO>Starten</LAUNCH_RADIO>
Source: AdobeReaderPDFonline.exe	String found in binary or memory: lat</LAUNCH_RADIO>
Source: AdobeReaderPDFonline.exe	String found in binary or memory: </LAUNCH_ICON>
Source: AdobeReaderPDFonline.exe	String found in binary or memory: </LAUNCH_BTN>

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe

File read: C:\Users\user\Desktop\AdobeReaderPDFonline.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\AdobeReaderPDFonline.exe "C:\Users\user\Desktop\AdobeReaderPDFonline.exe"
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Section loaded: a.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: AdobeReaderPDFonline.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: AdobeReaderPDFonline.exe

Static file information: File size 5835776 > 1048576

Source: AdobeReaderPDFonline.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x217c00
Source: AdobeReaderPDFonline.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x2e2400

Source: AdobeReaderPDFonline.exe

Static PE information: More than 200 imports for USER32.dll

Source: AdobeReaderPDFonline.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: AdobeReaderPDFonline.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: AdobeReaderPDFonline.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: AdobeReaderPDFonline.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: AdobeReaderPDFonline.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: AdobeReaderPDFonline.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: AdobeReaderPDFonline.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: AdobeReaderPDFonline.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: csc.exe, 00000005.00000003.1715936571.000000000835C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3922905850.0000000009550000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1715936571.0000000008222000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Source\Repos\DS-Platform\CppInstaller\CppSetup\bin\Win32\Release\CppSetup.pdb source: AdobeReaderPDFonline.exe, hdtach.exe.1.dr
Source:	Binary string: protobuf-net.pdb source: csc.exe, 00000005.00000003.1715936571.000000000835C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3922905850.0000000009550000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1715936571.0000000008222000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: 5.2.csc.exe.6b30000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.csc.exe.7fca228.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3922060213.0000000007F43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3918431665.0000000006B30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3918792657.0000000006DA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csc.exe PID: 2760, type: MEMORYSTR

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"			Jump to behavior

Source: AdobeReaderPDFonline.exe

Static PE information: real checksum: 0x46342c should be: 0x59eb74

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EEA7E pushad ; iretd	1_2_025EEA7F
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EEA76 pushad ; iretd	1_2_025EEA77
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Code function: 1_2_025EE458 push E0810001h; iretd	1_2_025EE45D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_04E965C9 push ecx; iretd	5_2_04E965CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_04E971B3 push ecx; ret	5_2_04E971CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_06B289AE push es; iretd	5_2_06B289B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_095ABC90 pushad ; iretd	5_2_095ABC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_097D8E9F push E9000002h; ret	5_2_097D8EA4

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe

File created: C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Jump to dropped file

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe

File created: C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Jump to dropped file

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QualysDLP			Jump to behavior
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QualysDLP			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: csc.exe PID: 2760, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 4E50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 6DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 69C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Window / User API: threadDelayed 3823			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Window / User API: threadDelayed 6024			Jump to behavior

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe

Dropped PE file which has not been started: C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Jump to dropped file

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe

API coverage: 6.1 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -59875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 6532	Thread sleep count: 3823 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 6532	Thread sleep count: 6024 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -59766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -59656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -59547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -59433s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -59328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -59219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -59094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -58984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -58875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -58766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -58656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -58547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -58438s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -58313s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -58203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -58086s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -57969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -57859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -57750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -57640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -57531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -57422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -57313s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -57188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -57069s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -56932s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -56808s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -56703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -56592s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -56484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -56375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -56255s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -56106s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -56000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -55886s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -55781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -55610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -55326s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -55192s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -55063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -54953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -54844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -54734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -54625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -54516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -54406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -54297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -54187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7136	Thread sleep time: -54077s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59433	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58086	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57069	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56932	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56808	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56592	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56255	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56106	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55886	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55326	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55192	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54077	Jump to behavior

Source: csc.exe, 00000005.00000002.3923374044.00000000097F0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlleratC

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4710000 protect: page readonly

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4710000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4710000			Jump to behavior
Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4858008			Jump to behavior

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe

Code function: 1_2_02606565 cpuid

1_2_02606565

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\AdobeReaderPDFonline.exe

Code function: 1_2_005CD4D4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_005CD4D4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	31 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	31 Process Injection	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	134 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AdobeReaderPDFonline.exe	54%	Virustotal		Browse
AdobeReaderPDFonline.exe	45%	ReversingLabs	Win32.Adware.RedCap

Source	Detection	Scanner	Label
https://download-lb.utorrent.com/endpoint/utweb/os/riserollout/track/beta	0%	Avira URL Cloud	safe
https://dvpwdfe80sj9.cloudfront.net/f/	0%	Avira URL Cloud	safe
https://dvpwdfe80sj9.cloudfront.net/o	0%	Avira URL Cloud	safe
https://dvpwdfe80sj9.cloudfront.net/ohttps://dvpwdfe80sj9.cloudfront.net/zbdhttps://dvpwdfe80sj9.clo	0%	Avira URL Cloud	safe
https://download-lb.utorrent.com/endpoint/utweb/os/riserollout/track/betahttps://www.bittorrent.com/	0%	Avira URL Cloud	safe
https://dvpwdfe80sj9.cloudfront.net/zbd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
newstaticfreepoint24.ddns-ip.net	181.71.216.203	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://download-lb.utorrent.com/endpoint/utweb/os/riserollout/track/betahttps://www.bittorrent.com/	AdobeReaderPDFonline.exe, hdtach.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-neti	csc.exe, 00000005.00000003.1715936571.000000000835C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3922905850.0000000009550000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1715936571.0000000008222000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	csc.exe, 00000005.00000003.1715936571.000000000835C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3922905850.0000000009550000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1715936571.0000000008222000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3918792657.0000000006DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	csc.exe, 00000005.00000003.1715936571.000000000835C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3922905850.0000000009550000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1715936571.0000000008222000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dvpwdfe80sj9.cloudfront.net/f/	AdobeReaderPDFonline.exe, hdtach.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://www.bittorrent.com/legal/privacy-policy/	AdobeReaderPDFonline.exe, hdtach.exe.1.dr	false		high
https://stackoverflow.com/q/11564914/23354;	csc.exe, 00000005.00000003.1715936571.000000000835C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3922905850.0000000009550000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1715936571.0000000008222000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	csc.exe, 00000005.00000003.1715936571.000000000835C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3922905850.0000000009550000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1715936571.0000000008222000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/webtorrent/webtorrent/blob/master/LICENSE	AdobeReaderPDFonline.exe, hdtach.exe.1.dr	false		high
https://github.com/mgravell/protobuf-net	csc.exe, 00000005.00000003.1715936571.000000000835C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3922905850.0000000009550000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1715936571.0000000008222000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.openssl.org/)	AdobeReaderPDFonline.exe, hdtach.exe.1.dr	false		high
https://download-lb.utorrent.com/endpoint/utweb/os/riserollout/track/beta	AdobeReaderPDFonline.exe, hdtach.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	csc.exe, 00000005.00000002.3918792657.0000000007007000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.3918792657.0000000006DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dvpwdfe80sj9.cloudfront.net/zbd	AdobeReaderPDFonline.exe, hdtach.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://github.com/arvidn/libtorrent/blob/master/LICENSE	AdobeReaderPDFonline.exe, hdtach.exe.1.dr	false		high
https://www.bittorrent.com/legal/terms-of-use/	AdobeReaderPDFonline.exe, hdtach.exe.1.dr	false		high
https://dvpwdfe80sj9.cloudfront.net/o	AdobeReaderPDFonline.exe, hdtach.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://dvpwdfe80sj9.cloudfront.net/ohttps://dvpwdfe80sj9.cloudfront.net/zbdhttps://dvpwdfe80sj9.clo	AdobeReaderPDFonline.exe, hdtach.exe.1.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
181.71.216.203	newstaticfreepoint24.ddns-ip.net	Colombia		27831	ColombiaMovilCO	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587434
Start date and time:	2025-01-10 11:33:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AdobeReaderPDFonline.exe
Detection:	MAL
Classification:	mal88.evad.winEXE@3/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 268 Number of non-executed functions: 71
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:34:35	API Interceptor	9611153x Sleep call for process: csc.exe modified
11:34:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run QualysDLP C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe
11:34:46	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run QualysDLP C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
181.71.216.203	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse
	AdobePremierPDF.exe	Get hash	malicious	Unknown	Browse
	2LDJIyMl2r.exe	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
newstaticfreepoint24.ddns-ip.net	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePremierPDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	2LDJIyMl2r.exe	Get hash	malicious	Remcos	Browse	181.71.216.203
	SHROsQyiAd.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	4JwhvqLe8n.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	3XSXmrEOw7.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	ozfqy8Ms6t.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	hCJ8gK9kNn.exe	Get hash	malicious	Remcos	Browse	181.131.217.244

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ColombiaMovilCO	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePremierPDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	1736491685b40eefbc9bdfbc98216071e6ff3a4c19c7e1ab8a144cde35036665da85346b6b949.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	6.elf	Get hash	malicious	Unknown	Browse	181.70.170.80
	173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	1736348224ad77cf86e491faad27e4b5decf1eb0bb26f16b0527e5ef488389ba353aa3db79582.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	1736348224f7603a5c535b2b2f6cc29730626d73a967c67551d2d14f73b547fe7b5fc10393994.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	1736348224bd83df4c8d79407f8e7ac5cf8c08b59746ce37ff95772daa0a6283b50e2b0882115.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6

Process:	C:\Users\user\Desktop\AdobeReaderPDFonline.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	959667331
Entropy (8bit):	0.08625462809460394
Encrypted:	false
SSDEEP:
MD5:	1ED9B1C1CC1AD0A0002A3CE083DC9D5F
SHA1:	CA8788C1C7FA2F39304E8AA2B8276C928B4B7165
SHA-256:	50C929F7C263A067D323E03CA02B3F18EDE373CFD53E89DCE9EEF589BB469826
SHA-512:	99B974DBD3F000B44C7D2F9245AD17BD909FDCA8CE1E3196BC0162760264CD3C859488847EBFA6ADA03359B4582C248E14E96862B748887F0221DB7A84780B7D
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7..V...V...V......V......V....."V......V......V...V..U..5...V..5...V..5..YW......V....p..V...V...V......V..Rich.V..........PE..L.....Eg...............'.\|!...7...............!...@...........................Y.....,4F...@.................................\|.)......`+.4"............E..(...`C.P...p.'.p.....................'.......'.@.............!..............................text.....!......\|!................. ..`.rdata........!.......!.............@..@.data.... ...@......,.............@....rsrc...4"...`+..$....*.............@..@........................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.0634954672891475
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AdobeReaderPDFonline.exe
File size:	5'835'776 bytes
MD5:	af1d0f01b01da4da3a9a54b2bee820e9
SHA1:	859814a52ba8c1a67468cce646974be9bdece0cb
SHA256:	d883efc9e3f21d039ba1bec082b390432ea3f3608657e9ced8682be27c318ec2
SHA512:	5ddcb57d828f1b33bed2c9a72a9eede38f7601fcf9e4e34f69f6b17363db41a2362799b3bf36be61cc0851c9d309137a1210c3d4c916349a2d1724ebb7909c35
SSDEEP:	98304:9jYWohHXZ64z3lrxA0+IbvT3916Floj9ghi1RebMIg9Cbk/VFE/nIV3MwBReUcRR:9jYWqXZ6wF3916vojDIg9Cbk/VK/nqbO
TLSH:	7246BF327D4A445BD07212716A69E975A13E6D78273202C363E47F3F7831AC2293BE67
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V...V...V.......V.......V......"V.......V.......V...V...U..5....V..5....V..5...YW.......V....p..V...V...V.......V..Rich.V.

File Icon


Icon Hash:	335092b3b2c66517

Static PE Info

General

Entrypoint:	0x5cc6df
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67459109 [Tue Nov 26 09:12:41 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	b48ec932e0b94d3910a5e2592ad0d9cf

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
call 00007F165CC6DDC2h
jmp 00007F165CC6CDFFh
cmp ecx, dword ptr [006A5000h]
jne 00007F165CC6CF83h
ret
jmp 00007F165CC6D981h
push ebp
mov ebp, esp
push esi
mov esi, 006B34E4h
push esi
call dword ptr [006192E8h]
mov eax, dword ptr [ebp+08h]
push esi
and dword ptr [eax], 00000000h
call dword ptr [006192ECh]
push 006B34E0h
call dword ptr [006192E4h]
pop esi
pop ebp
ret
push ebp
mov ebp, esp
push esi
mov esi, 006B34E4h
push esi
call dword ptr [006192E8h]
mov ecx, dword ptr [006A4FF0h]
mov eax, dword ptr [ebp+08h]
inc ecx
mov dword ptr [006A4FF0h], ecx
push esi
mov dword ptr [eax], ecx
mov eax, dword ptr fs:[0000002Ch]
mov ecx, dword ptr [006B3844h]
mov ecx, dword ptr [eax+ecx*4]
mov eax, dword ptr [006A4FF0h]
mov dword ptr [ecx+00000004h], eax
call dword ptr [006192ECh]
push 006B34E0h
call dword ptr [006192E4h]
pop esi
pop ebp
ret
push ebp
mov ebp, esp
push esi
push edi
mov edi, 006B34E4h
push edi
call dword ptr [006192E8h]
mov esi, dword ptr [ebp+08h]
cmp dword ptr [esi], 00000000h
jne 00007F165CC6CF8Eh
or dword ptr [esi], FFFFFFFFh
jmp 00007F165CC6CFA8h
call 00007F165CC6CFB1h
jmp 00007F165CC6CF71h
cmp dword ptr [esi], FFFFFFFFh
je 00007F165CC6CF76h
mov eax, dword ptr fs:[0000002Ch]
mov ecx, dword ptr [00003844h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29fe7c	0x1b8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2b6000	0x2e2234	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x458600	0x2800	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x436000	0x2ab50	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x278c70	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x278d00	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x278bb0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x219000	0xad0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x218000	0x217c00	bf8442e1a060d6a6110e5353f0b7e4f0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x219000	0x8b000	0x8ac00	c071b645d904afddfae36d09fbff0a76	False	0.33050218186936936	data	5.546535578758396	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2a4000	0x12000	0xbc00	df682c1e69ad36bfcf32c628e7178a04	False	0.17351645611702127	data	5.056360385601096	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2b6000	0x2e2234	0x2e2400	7e9251cd98c2809c7f0a338118d8a199	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x2cb174	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x2cb178	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x2cb17c	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x2cb180	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x2cb184	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x2cb188	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x2cb18c	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x2cb190	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x2cb194	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x2cb198	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x2cb19c	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x2cb1a0	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x2cb1a4	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x2cb1a8	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x2cb1ac	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x2cb1b0	0x2	data	English	United States	5.0
IMAGE_BLOB	0x2cb1b4	0x6182	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9983174425126192
IMAGE_BLOB2	0x2d1338	0x57e4	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	English	United States	0.9663111111111111
IMAGE_BLOB3	0x2d6b1c	0x6050	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	English	United States	0.9756245944192083
LOCALE	0x2dcb6c	0xb1f	XML 1.0 document, ASCII text, with very long lines (345), with CRLF line terminators	English	United States	0.4130663856691254
LOCALE	0x2dd68c	0xb1f	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (344), with CRLF line terminators	English	United States	0.4260625219529329
LOCALE	0x2de1ac	0xa65	XML 1.0 document, ASCII text, with very long lines (344), with CRLF line terminators	English	United States	0.4269071777527245
LOCALE	0x2dec14	0xac8	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (343), with CRLF line terminators	English	United States	0.43623188405797103
LOCALE	0x2df6dc	0xafc	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (346), with CRLF line terminators	English	United States	0.4317211948790896
LOCALE	0x2e01d8	0xb1a	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (367), with CRLF line terminators	English	United States	0.45918367346938777
LOCALE	0x2e0cf4	0xaf3	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (353), with CRLF line terminators	English	United States	0.4659293613985016
LOCALE	0x2e17e8	0xa94	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (356), with CRLF line terminators	English	United States	0.4324224519940916
LOCALE	0x2e227c	0xb98	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (426), with CRLF line terminators	English	United States	0.4366576819407008
LOCALE	0x2e2e14	0xaa2	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (349), with CRLF line terminators	English	United States	0.44305657604702425
LOCALE	0x2e38b8	0xb6b	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (381), with CRLF line terminators	English	United States	0.43345877523092713
LOCALE	0x2e4424	0xad7	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (365), with CRLF line terminators	English	United States	0.43963963963963965
LOCALE	0x2e4efc	0xb00	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (406), with CRLF line terminators	English	United States	0.43785511363636365
LOCALE	0x2e59fc	0xb1a	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (367), with CRLF line terminators	English	United States	0.45918367346938777
LOCALE	0x2e6518	0xde9	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (366), with CRLF line terminators	English	United States	0.41224375175512495
LOCALE	0x2e7304	0xada	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (348), with CRLF line terminators	English	United States	0.4474442044636429
LOCALE	0x2e7de0	0x1f1f	exported SGML document, Unicode text, UTF-8 text, with very long lines (1357), with CRLF line terminators	English	United States	0.3887285050834693
PNG	0x2e9d00	0x77	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	English	United States	0.9915966386554622
PNG	0x2e9d78	0x2f5	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0145310435931307
PNG	0x2ea070	0x301	PNG image data, 70 x 31, 8-bit/color RGBA, non-interlaced	English	United States	1.0143042912873863
PNG	0x2ea374	0x287	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.017001545595054
PNG	0x2ea5fc	0x36e	PNG image data, 22 x 40, 8-bit/color RGB, non-interlaced	English	United States	1.0125284738041003
PNG	0x2ea96c	0x15d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0315186246418337
PNG	0x2eaacc	0x13e	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0345911949685536
PNG	0x2eac0c	0x115	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	English	United States	1.03971119133574
PNG	0x2ead24	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0302013422818792
PNG	0x2eae50	0x20c	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0209923664122138
PNG	0x2eb05c	0xfd	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0276679841897234
PNG	0x2eb15c	0xa6	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x2eb204	0x7c	PNG image data, 3 x 11, 8-bit/color RGBA, non-interlaced	English	United States	0.9919354838709677
PNG	0x2eb280	0x96	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.0133333333333334
PNG	0x2eb318	0x91	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.006896551724138
PNG	0x2eb3ac	0x84	PNG image data, 15 x 3, 8-bit/color RGB, non-interlaced	English	United States	0.9848484848484849
PNG	0x2eb430	0xa3	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0122699386503067
PNG	0x2eb4d4	0x771	PNG image data, 13 x 156, 8-bit/color RGB, non-interlaced	English	United States	1.005774278215223
PNG	0x2ebc48	0x697	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.006520450503853
PNG	0x2ec2e0	0x342	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.013189448441247
PNG	0x2ec624	0x45f	PNG image data, 24 x 72, 8-bit/color RGB, non-interlaced	English	United States	1.0098302055406614
PNG	0x2eca84	0x1a3	PNG image data, 20 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.026252983293556
PNG	0x2ecc28	0xac8	PNG image data, 24 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0039855072463768
PNG	0x2ed6f0	0x37c	PNG image data, 8 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0123318385650224
PNG	0x2eda6c	0xa50	PNG image data, 24 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0041666666666667
PNG	0x2ee4bc	0x48e	PNG image data, 9 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.009433962264151
PNG	0x2ee94c	0xa50	PNG image data, 24 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0041666666666667
PNG	0x2ef39c	0x380	PNG image data, 8 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0122767857142858
PNG	0x2ef71c	0xab0	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0040204678362572
PNG	0x2f01cc	0xb1f	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0038637161924833
PNG	0x2f0cec	0xa8e	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0040710584752035
PNG	0x2f177c	0xb30	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.003840782122905
PNG	0x2f22ac	0x3a6	PNG image data, 48 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.011777301927195
PNG	0x2f2654	0x111b	PNG image data, 38 x 114, 8-bit/color RGBA, non-interlaced	English	United States	1.0025119890385932
PNG	0x2f3770	0x3d1	PNG image data, 23 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0112589559877174
PNG	0x2f3b44	0x21b	PNG image data, 11 x 88, 8-bit/color RGB, non-interlaced	English	United States	1.0204081632653061
PNG	0x2f3d60	0xb12	PNG image data, 50 x 273, 8-bit/color RGBA, non-interlaced	English	United States	1.003881439661256
PNG	0x2f4874	0x7ac	PNG image data, 50 x 162, 8-bit/color RGBA, non-interlaced	English	United States	1.005600814663951
PNG	0x2f5020	0xd43	PNG image data, 50 x 264, 8-bit/color RGB, non-interlaced	English	United States	1.003240058910162
PNG	0x2f5d64	0x3a4	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.011802575107296
PNG	0x2f6108	0x320	PNG image data, 14 x 246, 8-bit/color RGBA, non-interlaced	English	United States	1.01375
PNG	0x2f6428	0x31f	PNG image data, 14 x 246, 8-bit/color RGBA, non-interlaced	English	United States	1.0137672090112642
PNG	0x2f6748	0x2bd	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0156918687589158
PNG	0x2f6a08	0x273	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	English	United States	1.0175438596491229
PNG	0x2f6c7c	0x2c9	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0154277699859748
PNG	0x2f6f48	0x163	PNG image data, 70 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.0112676056338028
PNG	0x2f70ac	0x152	PNG image data, 41 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.032544378698225
PNG	0x2f7200	0x38a	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0121412803532008
PNG	0x2f758c	0x532	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0082706766917293
PNG	0x2f7ac0	0x19c	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8810679611650486
PNG	0x2f7c5c	0x2296	PNG image data, 72 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.001242376327084
PNG	0x2f9ef4	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x2fa594	0x1c4	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8252212389380531
PNG	0x2fa758	0x522	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.008371385083714
PNG	0x2fac7c	0x2475	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.000750026786671
PNG	0x2fd0f4	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x2fd794	0x1c3	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8314855875831486
PNG	0x2fd958	0x505	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0085603112840467
PNG	0x2fde60	0x24d3	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.0004243131430997
PNG	0x300334	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x3009d4	0x1c7	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.832967032967033
PNG	0x300b9c	0x536	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0082458770614693
PNG	0x3010d4	0x24f0	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.0011632825719121
PNG	0x3035c4	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x303c64	0x1c5	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8388520971302428
PNG	0x303e2c	0x4d9	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.008863819500403
PNG	0x304308	0x23d3	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.0
PNG	0x3066dc	0x189	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.0279898218829517
PNG	0x306868	0x1bc	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	0.7027027027027027
PNG	0x306a24	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x3070c4	0x1c4	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.827433628318584
PNG	0x307288	0x4ef	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0087094220110848
PNG	0x307778	0x23a2	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.0007673755755317
PNG	0x309b1c	0xc5	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0253807106598984
PNG	0x309be4	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x30a284	0x1ba	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8212669683257918
PNG	0x30a440	0x4e4	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0087859424920127
PNG	0x30a924	0x250f	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.0005270369979973
PNG	0x30ce34	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x30d4d4	0x1c2	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8288888888888889
PNG	0x30d698	0x4e9	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0087509944311854
PNG	0x30db84	0x23c6	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.000436776588775
PNG	0x30ff4c	0xb5	PNG image data, 15 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0165745856353592
PNG	0x310004	0x186	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.028205128205128
PNG	0x31018c	0x1b5	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	0.6864988558352403
PNG	0x310344	0x66	PNG image data, 1 x 46, 8-bit/color RGBA, non-interlaced	English	United States	0.9803921568627451
PNG	0x3103ac	0xf9	PNG image data, 90 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.0321285140562249
PNG	0x3104a8	0x17c3	PNG image data, 86 x 240, 8-bit/color RGBA, non-interlaced	English	United States	0.992931119513398
PNG	0x311c6c	0x283	PNG image data, 86 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0171073094867806
PNG	0x311ef0	0x71	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced	English	United States	0.9823008849557522
PNG	0x311f64	0x71d	PNG image data, 16 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.0060406370126305
PNG	0x312684	0x794	PNG image data, 16 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.0056701030927835
PNG	0x312e18	0x284	PNG image data, 7 x 39, 8-bit/color RGBA, non-interlaced	English	United States	1.0170807453416149
PNG	0x31309c	0x203	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.021359223300971
PNG	0x3132a0	0x1b5	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0251716247139588
PNG	0x313458	0xb2	PNG image data, 2 x 20, 8-bit/color RGB, non-interlaced	English	United States	1.0168539325842696
PNG	0x31350c	0xd1	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	English	United States	0.9760765550239234
PNG	0x3135e0	0x21c	PNG image data, 21 x 42, 8-bit/color RGBA, non-interlaced	English	United States	1.0203703703703704
PNG	0x3137fc	0x21c	PNG image data, 21 x 42, 8-bit/color RGBA, non-interlaced	English	United States	1.0203703703703704
PNG	0x313a18	0x1ae	PNG image data, 21 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0186046511627906
PNG	0x313bc8	0x13a	PNG image data, 16 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.0222929936305734
PNG	0x313d04	0x13f	PNG image data, 21 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0344827586206897
PNG	0x313e44	0x135	PNG image data, 16 x 56, 8-bit/color RGBA, non-interlaced	English	United States	0.9967637540453075
PNG	0x313f7c	0xdb	PNG image data, 21 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0228310502283104
PNG	0x314058	0xc6	PNG image data, 16 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.0252525252525253
PNG	0x314120	0x1a9	PNG image data, 21 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0141176470588236
PNG	0x3142cc	0x19b	PNG image data, 16 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.0194647201946472
PNG	0x314468	0x2296	PNG image data, 72 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.001242376327084
PNG	0x316700	0x13e	PNG image data, 72 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0345911949685536
PNG	0x316840	0x115	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	English	United States	1.03971119133574
PNG	0x316958	0x83	PNG image data, 35 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.0076335877862594
PNG	0x3169dc	0xce	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0242718446601942
PNG	0x316aac	0xb30	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.003840782122905
PNG	0x3175dc	0x25f	PNG image data, 72 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0181219110378912
PNG	0x31783c	0x79	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	English	United States	0.9752066115702479
PNG	0x3178b8	0x170	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9755434782608695
PNG	0x317a28	0x26b	PNG image data, 70 x 31, 8-bit/color RGBA, non-interlaced	English	United States	1.0177705977382876
PNG	0x317c94	0x105	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9731800766283525
PNG	0x317d9c	0xe6	PNG image data, 22 x 38, 8-bit/color RGB, non-interlaced	English	United States	1.0260869565217392
PNG	0x317e84	0x38d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.012101210121012
PNG	0x318214	0x265	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0179445350734095
PNG	0x31847c	0x11a	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0319148936170213
PNG	0x318598	0xaa	PNG image data, 2 x 19, 8-bit/color RGB, non-interlaced	English	United States	1.011764705882353
PNG	0x318644	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0268456375838926
PNG	0x318770	0x209	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.021113243761996
PNG	0x31897c	0xf5	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0244897959183674
PNG	0x318a74	0xa6	PNG image data, 54 x 31, 8-bit/color RGB, non-interlaced	English	United States	1.0180722891566265
PNG	0x318b1c	0x150	PNG image data, 54 x 124, 8-bit/color RGB, non-interlaced	English	United States	1.0327380952380953
PNG	0x318c6c	0xac	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0174418604651163
PNG	0x318d18	0x89	PNG image data, 3 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0
PNG	0x318da4	0x98	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.006578947368421
PNG	0x318e3c	0x91	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.006896551724138
PNG	0x318ed0	0x7d	PNG image data, 15 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.008
PNG	0x318f50	0xa6	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x318ff8	0xbc	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0159574468085106
PNG	0x3190b4	0xa07	PNG image data, 13 x 156, 8-bit/color RGBA, non-interlaced	English	United States	1.004285157771718
PNG	0x319abc	0x1de1	PNG image data, 52 x 336, 8-bit/color RGBA, non-interlaced	English	United States	1.0014380964832004
PNG	0x31b8a0	0x1be	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0246636771300448
PNG	0x31ba60	0x53b	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0082150858849888
PNG	0x31bf9c	0x440	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.010110294117647
PNG	0x31c3dc	0x12e	PNG image data, 20 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.0298013245033113
PNG	0x31c50c	0x5b1	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0075497597803706
PNG	0x31cac0	0x408	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0106589147286822
PNG	0x31cec8	0x471	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.009674582233949
PNG	0x31d33c	0x4b7	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0091135045567523
PNG	0x31d7f4	0x481	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0095403295750216
PNG	0x31dc78	0x3ec	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0109561752988048
PNG	0x31e064	0x452	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0099457504520795
PNG	0x31e4b8	0x414	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.010536398467433
PNG	0x31e8cc	0x39e	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.011879049676026
PNG	0x31ec6c	0x48d	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.009442060085837
PNG	0x31f0fc	0x1b3	PNG image data, 15 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.025287356321839
PNG	0x31f2b0	0xea	PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0299145299145298
PNG	0x31f39c	0x1ae0	PNG image data, 38 x 114, 8-bit/color RGBA, non-interlaced	English	United States	1.0015988372093023
PNG	0x320e7c	0xb43	PNG image data, 22 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0038154699965314
PNG	0x3219c0	0x609	PNG image data, 11 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0071197411003237
PNG	0x321fcc	0x18ae	PNG image data, 43 x 234, 8-bit/color RGBA, non-interlaced	English	United States	1.0017410572966128
PNG	0x32387c	0x1177	PNG image data, 43 x 135, 8-bit/color RGBA, non-interlaced	English	United States	1.0024602997092373
PNG	0x3249f4	0x25ec	PNG image data, 43 x 330, 8-bit/color RGBA, non-interlaced	English	United States	1.0011330861145447
PNG	0x326fe0	0xacb	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0039811798769454
PNG	0x327aac	0xbc8	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0036472148541113
PNG	0x328674	0xc2e	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0035279025016035
PNG	0x3292a4	0x5dd	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0073284477015323
PNG	0x329884	0x597	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	English	United States	1.0076869322152342
PNG	0x329e1c	0x5f8	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.007198952879581
PNG	0x32a414	0x237	PNG image data, 54 x 69, 8-bit/color RGBA, non-interlaced	English	United States	1.0194003527336861
PNG	0x32a64c	0x588	PNG image data, 22 x 44, 8-bit/color RGBA, non-interlaced	English	United States	1.0077683615819208
PNG	0x32abd4	0x4b6	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0091210613598673
PNG	0x32b08c	0x532	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0082706766917293
PNG	0x32b5c0	0x5fe	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0071707953063884
PNG	0x32bbc0	0xdd3	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	0.9960440802486578
PNG	0x32c994	0x7c	PNG image data, 1 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9919354838709677
PNG	0x32ca10	0x13c1	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021752026893416
PNG	0x32ddd4	0x37d	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0123180291153415
PNG	0x32e154	0x395	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0119956379498365
PNG	0x32e4ec	0x125e	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023394300297745
PNG	0x32f74c	0x13b4	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021808088818398
PNG	0x330b00	0x369	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126002290950744
PNG	0x330e6c	0x3cc	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0113168724279835
PNG	0x331238	0x1320	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002246732026144
PNG	0x332558	0x13ac	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021842732327244
PNG	0x333904	0x364	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012672811059908
PNG	0x333c68	0x3ba	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0115303983228512
PNG	0x334024	0x1274	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023285351397122
PNG	0x335298	0x139f	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021899263388414
PNG	0x336638	0x380	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0122767857142858
PNG	0x3369b8	0x352	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0129411764705882
PNG	0x336d0c	0x1288	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002318718381113
PNG	0x337f94	0x211	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.0207939508506616
PNG	0x3381a8	0x2e4	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0148648648648648
PNG	0x33848c	0x13ad	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021838395870557
PNG	0x33983c	0x365	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126582278481013
PNG	0x339ba4	0x374	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x339f18	0x126b	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023329798515377
PNG	0x33b184	0xd4	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.028301886792453
PNG	0x33b258	0x1394	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.00219473264166
PNG	0x33c5ec	0x374	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x33c960	0x3f4	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0108695652173914
PNG	0x33cd54	0x1304	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0022596548890714
PNG	0x33e058	0x1397	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021934197407776
PNG	0x33f3f0	0x373	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0124575311438277
PNG	0x33f764	0x33d	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0132689987937273
PNG	0x33faa4	0x119e	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002439024390244
PNG	0x340c44	0xa6	PNG image data, 15 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x340cec	0x211	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.0207939508506616
PNG	0x340f00	0x2f7	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0144927536231885
PNG	0x3411f8	0x16e	PNG image data, 9 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.030054644808743
PNG	0x341368	0x73	PNG image data, 5 x 5, 8-bit/color RGB, non-interlaced	English	United States	0.9826086956521739
PNG	0x3413dc	0x117	PNG image data, 11 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.021505376344086
PNG	0x3414f4	0x67	PNG image data, 2 x 55, 8-bit/color RGBA, non-interlaced	English	United States	0.9902912621359223
PNG	0x34155c	0xce	PNG image data, 90 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.0242718446601942
PNG	0x34162c	0xa40	PNG image data, 86 x 240, 8-bit/color RGBA, non-interlaced	English	United States	0.9733231707317073
PNG	0x34206c	0x283	PNG image data, 86 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0171073094867806
PNG	0x3422f0	0x93	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0136054421768708
PNG	0x342384	0x96a	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.004564315352697
PNG	0x342cf0	0x99b	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.0044733631557543
PNG	0x34368c	0x2f7	PNG image data, 11 x 45, 8-bit/color RGBA, non-interlaced	English	United States	1.0144927536231885
PNG	0x343984	0x1ff	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0215264187866928
PNG	0x343b84	0x1f7	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.021868787276342
PNG	0x343d7c	0xb6	PNG image data, 2 x 20, 8-bit/color RGB, non-interlaced	English	United States	1.010989010989011
PNG	0x343e34	0x94	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0135135135135136
PNG	0x343ec8	0x3e6	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.0110220440881763
PNG	0x3442b0	0x3e6	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.0110220440881763
PNG	0x344698	0x315	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0139416983523448
PNG	0x3449b0	0x259	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0183028286189684
PNG	0x344c0c	0x205	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0212765957446808
PNG	0x344e14	0x176	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0294117647058822
PNG	0x344f8c	0x124	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0136986301369864
PNG	0x3450b0	0xd7	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0
PNG	0x345188	0x28f	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.016793893129771
PNG	0x345418	0x225	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0200364298724955
PNG	0x345640	0xdd3	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	0.9960440802486578
PNG	0x346414	0x123	PNG image data, 72 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0378006872852235
PNG	0x346538	0x10b	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	English	United States	1.0337078651685394
PNG	0x346644	0x83	PNG image data, 35 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.0076335877862594
PNG	0x3466c8	0x12f	PNG image data, 9 x 9, 8-bit/color RGB, non-interlaced	English	United States	1.0264026402640265
PNG	0x3467f8	0x48d	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.009442060085837
PNG	0x346c88	0x261	PNG image data, 72 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0180623973727423
PNG	0x346eec	0x79	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	English	United States	0.9752066115702479
PNG	0x346f68	0x1b5	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9931350114416476
PNG	0x347120	0x293	PNG image data, 70 x 31, 8-bit/color RGBA, non-interlaced	English	United States	1.0166919575113809
PNG	0x3473b4	0x11a	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9716312056737588
PNG	0x3474d0	0xde	PNG image data, 22 x 38, 8-bit/color RGB, non-interlaced	English	United States	1.027027027027027
PNG	0x3475b0	0x38d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.012101210121012
PNG	0x347940	0x265	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0179445350734095
PNG	0x347ba8	0x124	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0308219178082192
PNG	0x347ccc	0xaa	PNG image data, 2 x 19, 8-bit/color RGB, non-interlaced	English	United States	1.011764705882353
PNG	0x347d78	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0268456375838926
PNG	0x347ea4	0x209	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.021113243761996
PNG	0x3480b0	0xf5	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0244897959183674
PNG	0x3481a8	0x9f	PNG image data, 54 x 31, 8-bit/color RGB, non-interlaced	English	United States	1.0125786163522013
PNG	0x348248	0x148	PNG image data, 54 x 124, 8-bit/color RGB, non-interlaced	English	United States	1.0335365853658536
PNG	0x348390	0xac	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0174418604651163
PNG	0x34843c	0x8b	PNG image data, 3 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.014388489208633
PNG	0x3484c8	0xa4	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.0
PNG	0x34856c	0x94	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.0067567567567568
PNG	0x348600	0x87	PNG image data, 15 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.0
PNG	0x348688	0xa6	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x348730	0xc5	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0203045685279188
PNG	0x3487f8	0xa54	PNG image data, 13 x 156, 8-bit/color RGBA, non-interlaced	English	United States	1.004160363086233
PNG	0x34924c	0x1eda	PNG image data, 52 x 336, 8-bit/color RGBA, non-interlaced	English	United States	1.001392757660167
PNG	0x34b128	0x1cb	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0239651416122004
PNG	0x34b2f4	0x53b	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0082150858849888
PNG	0x34b830	0x4f3	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.0086819258089976
PNG	0x34bd24	0x11a	PNG image data, 20 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.024822695035461
PNG	0x34be40	0x5af	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0075601374570446
PNG	0x34c3f0	0x3ff	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.010752688172043
PNG	0x34c7f0	0x461	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0098126672613739
PNG	0x34cc54	0x4cc	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.008957654723127
PNG	0x34d120	0x474	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0096491228070175
PNG	0x34d594	0x3ef	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0109235352532273
PNG	0x34d984	0x44a	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0100182149362478
PNG	0x34ddd0	0x41f	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0104265402843602
PNG	0x34e1f0	0x39b	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0119176598049837
PNG	0x34e58c	0x4a1	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.009282700421941
PNG	0x34ea30	0x1b3	PNG image data, 15 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.025287356321839
PNG	0x34ebe4	0xf9	PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.036144578313253
PNG	0x34ece0	0x1bfa	PNG image data, 38 x 114, 8-bit/color RGBA, non-interlaced	English	United States	1.001535883831332
PNG	0x3508dc	0xb43	PNG image data, 22 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0038154699965314
PNG	0x351420	0x609	PNG image data, 11 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0071197411003237
PNG	0x351a2c	0x18ae	PNG image data, 43 x 234, 8-bit/color RGBA, non-interlaced	English	United States	1.0017410572966128
PNG	0x3532dc	0x1177	PNG image data, 43 x 135, 8-bit/color RGBA, non-interlaced	English	United States	1.0024602997092373
PNG	0x354454	0x25ec	PNG image data, 43 x 330, 8-bit/color RGBA, non-interlaced	English	United States	1.0011330861145447
PNG	0x356a40	0xac7	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0039869517941282
PNG	0x357508	0xa82	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.004089219330855
PNG	0x357f8c	0xac7	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0039869517941282
PNG	0x358a54	0x5d3	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0073775989268947
PNG	0x359028	0x575	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	English	United States	1.0078740157480315
PNG	0x3595a0	0x5ea	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0072655217965654
PNG	0x359b8c	0x222	PNG image data, 54 x 69, 8-bit/color RGBA, non-interlaced	English	United States	1.02014652014652
PNG	0x359db0	0x588	PNG image data, 22 x 44, 8-bit/color RGBA, non-interlaced	English	United States	1.0077683615819208
PNG	0x35a338	0x552	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0080763582966226
PNG	0x35a88c	0x532	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0082706766917293
PNG	0x35adc0	0x624	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.006997455470738
PNG	0x35b3e4	0xf6f	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0027841052898
PNG	0x35c354	0x98	PNG image data, 1 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.013157894736842
PNG	0x35c3ec	0x13c1	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021752026893416
PNG	0x35d7b0	0x37d	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0123180291153415
PNG	0x35db30	0x395	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0119956379498365
PNG	0x35dec8	0xbea	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0036065573770492
PNG	0x35eab4	0x13b4	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021808088818398
PNG	0x35fe68	0x369	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126002290950744
PNG	0x3601d4	0x3cc	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0113168724279835
PNG	0x3605a0	0xcb2	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0033846153846153
PNG	0x361254	0x13ac	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021842732327244
PNG	0x362600	0x364	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012672811059908
PNG	0x362964	0x3ba	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0115303983228512
PNG	0x362d20	0xbff	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0035818951481603
PNG	0x363920	0x139f	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021899263388414
PNG	0x364cc0	0x380	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0122767857142858
PNG	0x365040	0x352	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0129411764705882
PNG	0x365394	0xbf8	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0035900783289817
PNG	0x365f8c	0x1e3	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.0227743271221532
PNG	0x366170	0x3d2	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0112474437627812
PNG	0x366544	0x13ad	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021838395870557
PNG	0x3678f4	0x365	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126582278481013
PNG	0x367c5c	0x374	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x367fd0	0xb9a	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0037037037037038
PNG	0x368b6c	0xd4	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.028301886792453
PNG	0x368c40	0x1394	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.00219473264166
PNG	0x369fd4	0x374	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x36a348	0x3f4	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0108695652173914
PNG	0x36a73c	0xc62	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0034700315457412
PNG	0x36b3a0	0x1397	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021934197407776
PNG	0x36c738	0x373	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0124575311438277
PNG	0x36caac	0x33d	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0132689987937273
PNG	0x36cdec	0xb84	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0003392130257802
PNG	0x36d970	0xb1	PNG image data, 15 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0169491525423728
PNG	0x36da24	0x1da	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.0232067510548524
PNG	0x36dc00	0x375	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0124293785310734
PNG	0x36df78	0x1a5	PNG image data, 9 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0261282660332542
PNG	0x36e120	0x71	PNG image data, 5 x 5, 8-bit/color RGB, non-interlaced	English	United States	0.9911504424778761
PNG	0x36e194	0x11a	PNG image data, 11 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0283687943262412
PNG	0x36e2b0	0x67	PNG image data, 2 x 55, 8-bit/color RGBA, non-interlaced	English	United States	0.9902912621359223
PNG	0x36e318	0xe0	PNG image data, 90 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.03125
PNG	0x36e3f8	0xa40	PNG image data, 86 x 240, 8-bit/color RGBA, non-interlaced	English	United States	0.9733231707317073
PNG	0x36ee38	0x283	PNG image data, 86 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0171073094867806
PNG	0x36f0bc	0x93	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0136054421768708
PNG	0x36f150	0x985	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.00451374640952
PNG	0x36fad8	0x9ca	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.00438946528332
PNG	0x3704a4	0x339	PNG image data, 11 x 45, 8-bit/color RGBA, non-interlaced	English	United States	1.0133333333333334
PNG	0x3707e0	0x214	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0206766917293233
PNG	0x3709f4	0x22e	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0197132616487454
PNG	0x370c24	0xb3	PNG image data, 2 x 20, 8-bit/color RGB, non-interlaced	English	United States	1.011173184357542
PNG	0x370cd8	0x95	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	English	United States	0.9932885906040269
PNG	0x370d70	0x414	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.010536398467433
PNG	0x371184	0x414	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.010536398467433
PNG	0x371598	0x1fb	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0216962524654833
PNG	0x371794	0x179	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0159151193633953
PNG	0x371910	0x179	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0053050397877985
PNG	0x371a8c	0x114	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0289855072463767
PNG	0x371ba0	0x10e	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.011111111111111
PNG	0x371cb0	0xb6	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0054945054945055
PNG	0x371d68	0x17e	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0287958115183247
PNG	0x371ee8	0x15c	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0201149425287357
PNG	0x372044	0xf6f	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0027841052898
PNG	0x372fb4	0x143	PNG image data, 72 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0340557275541795
PNG	0x3730f8	0x110	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	English	United States	1.0294117647058822
PNG	0x373208	0x87	PNG image data, 35 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.0074074074074073
PNG	0x373290	0x13b	PNG image data, 9 x 9, 8-bit/color RGB, non-interlaced	English	United States	1.0253968253968253
PNG	0x3733cc	0x4a1	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.009282700421941
PNG	0x373870	0x25e	PNG image data, 72 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.018151815181518
PNG	0x373ad0	0x79	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	English	United States	0.9752066115702479
PNG	0x373b4c	0x167	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9972144846796658
PNG	0x373cb4	0x278	PNG image data, 70 x 31, 8-bit/color RGBA, non-interlaced	English	United States	1.0174050632911393
PNG	0x373f2c	0x11a	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9680851063829787
PNG	0x374048	0xd4	PNG image data, 22 x 38, 8-bit/color RGB, non-interlaced	English	United States	1.0235849056603774
PNG	0x37411c	0x38d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.012101210121012
PNG	0x3744ac	0x265	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0179445350734095
PNG	0x374714	0x11a	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0319148936170213
PNG	0x374830	0xaa	PNG image data, 2 x 19, 8-bit/color RGB, non-interlaced	English	United States	1.011764705882353
PNG	0x3748dc	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0268456375838926
PNG	0x374a08	0x209	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.021113243761996
PNG	0x374c14	0xf5	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0244897959183674
PNG	0x374d0c	0xa6	PNG image data, 54 x 31, 8-bit/color RGB, non-interlaced	English	United States	1.0180722891566265
PNG	0x374db4	0x150	PNG image data, 54 x 124, 8-bit/color RGB, non-interlaced	English	United States	1.0327380952380953
PNG	0x374f04	0xac	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0174418604651163
PNG	0x374fb0	0x8b	PNG image data, 3 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0
PNG	0x37503c	0x98	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.006578947368421
PNG	0x3750d4	0x91	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.006896551724138
PNG	0x375168	0x7d	PNG image data, 15 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.008
PNG	0x3751e8	0xa6	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x375290	0xbd	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0105820105820107
PNG	0x375350	0xa07	PNG image data, 13 x 156, 8-bit/color RGBA, non-interlaced	English	United States	1.004285157771718
PNG	0x375d58	0x1de1	PNG image data, 52 x 336, 8-bit/color RGBA, non-interlaced	English	United States	1.0014380964832004
PNG	0x377b3c	0x1be	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0246636771300448
PNG	0x377cfc	0x53b	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0082150858849888
PNG	0x378238	0x46c	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.0097173144876326
PNG	0x3786a4	0xaf	PNG image data, 20 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.0171428571428571
PNG	0x378754	0x701	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0061349693251533
PNG	0x378e58	0x498	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0093537414965987
PNG	0x3792f0	0x5c1	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0074677528852682
PNG	0x3798b4	0x539	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0082273747195214
PNG	0x379df0	0x5c7	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0074374577417173
PNG	0x37a3b8	0x47f	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.009556907037359
PNG	0x37a838	0x585	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0077848549186128
PNG	0x37adc0	0x546	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0081481481481482
PNG	0x37b308	0x4e1	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0088070456365092
PNG	0x37b7ec	0x5b0	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.007554945054945
PNG	0x37bd9c	0x1b3	PNG image data, 15 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.025287356321839
PNG	0x37bf50	0xea	PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0299145299145298
PNG	0x37c03c	0x1ad9	PNG image data, 38 x 114, 8-bit/color RGBA, non-interlaced	English	United States	1.0016004655899897
PNG	0x37db18	0xb43	PNG image data, 22 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0038154699965314
PNG	0x37e65c	0x609	PNG image data, 11 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0071197411003237
PNG	0x37ec68	0x18ae	PNG image data, 43 x 234, 8-bit/color RGBA, non-interlaced	English	United States	1.0017410572966128
PNG	0x380518	0x1177	PNG image data, 43 x 135, 8-bit/color RGBA, non-interlaced	English	United States	1.0024602997092373
PNG	0x381690	0x25ec	PNG image data, 43 x 330, 8-bit/color RGBA, non-interlaced	English	United States	1.0011330861145447
PNG	0x383c7c	0xad3	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0039696860339227
PNG	0x384750	0xbc8	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0036472148541113
PNG	0x385318	0xc2e	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0035279025016035
PNG	0x385f48	0x5dd	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0073284477015323
PNG	0x386528	0x597	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	English	United States	1.0076869322152342
PNG	0x386ac0	0x5f8	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.007198952879581
PNG	0x3870b8	0x228	PNG image data, 54 x 69, 8-bit/color RGBA, non-interlaced	English	United States	1.019927536231884
PNG	0x3872e0	0x588	PNG image data, 22 x 44, 8-bit/color RGBA, non-interlaced	English	United States	1.0077683615819208
PNG	0x387868	0x38a	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0121412803532008
PNG	0x387bf4	0x532	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0082706766917293
PNG	0x388128	0x32f	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0134969325153373
PNG	0x388458	0xef8	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	0.9950417536534447
PNG	0x389350	0x7c	PNG image data, 1 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9919354838709677
PNG	0x3893cc	0x13c1	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021752026893416
PNG	0x38a790	0x37d	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0123180291153415
PNG	0x38ab10	0x395	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0119956379498365
PNG	0x38aea8	0x125e	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023394300297745
PNG	0x38c108	0x13b4	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021808088818398
PNG	0x38d4bc	0x369	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126002290950744
PNG	0x38d828	0x3cc	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0113168724279835
PNG	0x38dbf4	0x1320	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002246732026144
PNG	0x38ef14	0x13ac	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021842732327244
PNG	0x3902c0	0x364	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012672811059908
PNG	0x390624	0x3ba	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0115303983228512
PNG	0x3909e0	0x1274	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023285351397122
PNG	0x391c54	0x139f	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021899263388414
PNG	0x392ff4	0x380	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0122767857142858
PNG	0x393374	0x352	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0129411764705882
PNG	0x3936c8	0x1288	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002318718381113
PNG	0x394950	0x99d	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.004469727752946
PNG	0x3952f0	0x2e6	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0148247978436657
PNG	0x3955d8	0x13ad	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021838395870557
PNG	0x396988	0x365	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126582278481013
PNG	0x396cf0	0x374	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x397064	0x126b	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023329798515377
PNG	0x3982d0	0xd4	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.028301886792453
PNG	0x3983a4	0x1394	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.00219473264166
PNG	0x399738	0x374	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x399aac	0x3f4	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0108695652173914
PNG	0x399ea0	0x1304	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0022596548890714
PNG	0x39b1a4	0x1397	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021934197407776
PNG	0x39c53c	0x373	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0124575311438277
PNG	0x39c8b0	0x33d	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0132689987937273
PNG	0x39cbf0	0x119e	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002439024390244
PNG	0x39dd90	0xa6	PNG image data, 15 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x39de38	0x99d	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.004469727752946
PNG	0x39e7d8	0x2f7	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0144927536231885
PNG	0x39ead0	0x17e	PNG image data, 9 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0287958115183247
PNG	0x39ec50	0x71	PNG image data, 5 x 5, 8-bit/color RGB, non-interlaced	English	United States	0.9911504424778761
PNG	0x39ecc4	0x117	PNG image data, 11 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.021505376344086
PNG	0x39eddc	0x67	PNG image data, 2 x 55, 8-bit/color RGBA, non-interlaced	English	United States	0.9902912621359223
PNG	0x39ee44	0xd7	PNG image data, 90 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.0232558139534884
PNG	0x39ef1c	0xa40	PNG image data, 86 x 240, 8-bit/color RGBA, non-interlaced	English	United States	0.9733231707317073
PNG	0x39f95c	0x283	PNG image data, 86 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0171073094867806
PNG	0x39fbe0	0x93	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0136054421768708
PNG	0x39fc74	0x96a	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.004564315352697
PNG	0x3a05e0	0x99b	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.0044733631557543
PNG	0x3a0f7c	0x2f7	PNG image data, 11 x 45, 8-bit/color RGBA, non-interlaced	English	United States	1.0144927536231885
PNG	0x3a1274	0x1d3	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.019271948608137
PNG	0x3a1448	0x1f8	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0138888888888888
PNG	0x3a1640	0x67	PNG image data, 2 x 20, 8-bit/color RGB, non-interlaced	English	United States	0.9514563106796117
PNG	0x3a16a8	0x95	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0
PNG	0x3a1740	0x39d	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.011891891891892
PNG	0x3a1ae0	0x39d	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.011891891891892
PNG	0x3a1e80	0x1c1	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.024498886414254
PNG	0x3a2044	0x153	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0324483775811208
PNG	0x3a2198	0x15f	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0113960113960114
PNG	0x3a22f8	0x100	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.03515625
PNG	0x3a23f8	0x108	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.018939393939394
PNG	0x3a2500	0xb6	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.010989010989011
PNG	0x3a25b8	0x151	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.032640949554896
PNG	0x3a270c	0x135	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.029126213592233
PNG	0x3a2844	0xdd3	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	0.9960440802486578
PNG	0x3a3618	0x129	PNG image data, 72 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0303030303030303
PNG	0x3a3744	0x10b	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	English	United States	1.0337078651685394
PNG	0x3a3850	0x87	PNG image data, 35 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.0074074074074073
PNG	0x3a38d8	0x12f	PNG image data, 9 x 9, 8-bit/color RGB, non-interlaced	English	United States	1.0264026402640265
PNG	0x3a3a08	0x48d	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.009442060085837
PNG	0x3a3e98	0xdd1	PNG image data, 72 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.003109980209217
PNG	0x3a4c6c	0xd61	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0032116788321168
PNG	0x3a59d0	0x265	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0179445350734095
PNG	0x3a5c38	0xbb9	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0036654448517162
PNG	0x3a67f4	0xc66	PNG image data, 10 x 28, 8-bit/color RGBA, non-interlaced	English	United States	1.0034656584751103
PNG	0x3a745c	0xb90	PNG image data, 10 x 28, 8-bit/color RGBA, non-interlaced	English	United States	1.0037162162162163
PNG	0x3a7fec	0xb07	PNG image data, 5 x 5, 8-bit/color RGBA, non-interlaced	English	United States	1.003896563939072
PNG	0x3a8af4	0xb50	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0037983425414365
PNG	0x3a9644	0x2885	PNG image data, 42 x 348, 8-bit/color RGBA, non-interlaced	English	United States	1.0010604453870626
PNG	0x3abecc	0xd8e	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0031700288184437
PNG	0x3acc5c	0x53b	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0082150858849888
PNG	0x3ad198	0x4f3	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.0086819258089976
PNG	0x3ad68c	0x130f	PNG image data, 22 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0022545603607296
PNG	0x3ae99c	0xe74	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.002972972972973
PNG	0x3af810	0x11ba	PNG image data, 22 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.002423975319524
PNG	0x3b09cc	0xece	PNG image data, 11 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0029023746701846
PNG	0x3b189c	0x11ba	PNG image data, 22 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.002423975319524
PNG	0x3b2a58	0xe74	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.002972972972973
PNG	0x3b38cc	0x1206	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0023840485478976
PNG	0x3b4ad4	0x11bc	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0024229074889868
PNG	0x3b5c90	0x112a	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0025034137460174
PNG	0x3b6dbc	0x127a	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0023255813953489
PNG	0x3b8038	0xd3e	PNG image data, 15 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.003244837758112
PNG	0x3b8d78	0xbac	PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0036813922356091
PNG	0x3b9924	0x146a	PNG image data, 56 x 69, 8-bit/color RGBA, non-interlaced	English	United States	1.0021048603138156
PNG	0x3bad90	0x122f	PNG image data, 22 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0023630504833512
PNG	0x3bbfc0	0xdec	PNG image data, 11 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0030864197530864
PNG	0x3bcdac	0x1100	PNG image data, 42 x 228, 8-bit/color RGBA, non-interlaced	English	United States	1.0025275735294117
PNG	0x3bdeac	0x11ed	PNG image data, 42 x 140, 8-bit/color RGBA, non-interlaced	English	United States	1.0023970363913706
PNG	0x3bf09c	0x1864	PNG image data, 42 x 330, 8-bit/color RGBA, non-interlaced	English	United States	1.0003203074951954
PNG	0x3c0900	0x10b5	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0025718961889174
PNG	0x3c19b8	0x124b	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0023489216314327
PNG	0x3c2c04	0x1256	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0023434171282488
PNG	0x3c3e5c	0xf2c	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.002832131822863
PNG	0x3c4d88	0xede	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	English	United States	1.0028901734104045
PNG	0x3c5c68	0xf69	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0027883396704689
PNG	0x3c6bd4	0xe20	PNG image data, 22 x 44, 8-bit/color RGBA, non-interlaced	English	United States	1.0030420353982301
PNG	0x3c79f4	0xdc7	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0031187978451943
PNG	0x3c87bc	0xbae	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0036789297658864
PNG	0x3c936c	0xd91	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.003167290526922
PNG	0x3ca100	0xb12	PNG image data, 1 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.003881439661256
PNG	0x3cac14	0xbc3	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0036532713384259
PNG	0x3cb7d8	0xc9f	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.003404518724853
PNG	0x3cc478	0xd7d	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0031856356791196
PNG	0x3cd1f8	0xbf7	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0035912504080966
PNG	0x3cddf0	0xc96	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0034140285536934
PNG	0x3cea88	0xd8c	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0031718569780854
PNG	0x3cf814	0xbda	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0036255767963085
PNG	0x3d03f0	0xca0	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0034034653465347
PNG	0x3d1090	0xd80	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0031828703703705
PNG	0x3d1e10	0xbe2	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0036160420775806
PNG	0x3d29f4	0xc8c	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0034246575342465
PNG	0x3d3680	0xd7b	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0031874818893074
PNG	0x3d43fc	0xbe7	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0036101083032491
PNG	0x3d4fe4	0xc94	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0034161490683229
PNG	0x3d5c78	0xd80	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0031828703703705
PNG	0x3d69f8	0xd4	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.028301886792453
PNG	0x3d6acc	0xbd0	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.003637566137566
PNG	0x3d769c	0xc97	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0034129692832765
PNG	0x3d8334	0xd7a	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0031884057971014
PNG	0x3d90b0	0xbda	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0036255767963085
PNG	0x3d9c8c	0xc8f	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.003421461897356
PNG	0x3da91c	0xd86	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0031773541305604
PNG	0x3db6a4	0x1908	PNG image data, 50 x 178, 8-bit/color RGBA, non-interlaced	English	United States	0.9887640449438202
PNG	0x3dcfac	0xb75	PNG image data, 3 x 61, 8-bit/color RGBA, non-interlaced	English	United States	1.0037504261847938
PNG	0x3ddb24	0xbd0	PNG image data, 9 x 51, 8-bit/color RGBA, non-interlaced	English	United States	1.003637566137566
PNG	0x3de6f4	0x1570	PNG image data, 18 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0020043731778425
PNG	0x3dfc64	0x1623	PNG image data, 18 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0019410622904534
STYLE_XML	0x3e1288	0x4e01	HTML document, ASCII text, with CRLF line terminators	English	United States	0.1839851770243878
STYLE_XML	0x3e608c	0x4b09	HTML document, ASCII text, with CRLF line terminators	English	United States	0.20396689052006872
STYLE_XML	0x3eab98	0x4aa6	HTML document, ASCII text, with CRLF line terminators	English	United States	0.20460491889063318
STYLE_XML	0x3ef640	0x4a18	HTML document, ASCII text, with CRLF line terminators	English	United States	0.20397511598481655
STYLE_XML	0x3f4058	0x1955	HTML document, ASCII text, with CRLF line terminators	English	United States	0.1918272937548188
RT_CURSOR	0x3f59b0	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4805194805194805
RT_CURSOR	0x3f5ae4	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	English	United States	0.7
RT_CURSOR	0x3f5b98	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.36363636363636365
RT_CURSOR	0x3f5ccc	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.35714285714285715
RT_CURSOR	0x3f5e00	0x134	data	English	United States	0.37337662337662336
RT_CURSOR	0x3f5f34	0x134	data	English	United States	0.37662337662337664
RT_CURSOR	0x3f6068	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0x3f619c	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.37662337662337664
RT_CURSOR	0x3f62d0	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0x3f6404	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x3f6538	0x134	data	English	United States	0.44155844155844154
RT_CURSOR	0x3f666c	0x134	data	English	United States	0.4155844155844156
RT_CURSOR	0x3f67a0	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.5422077922077922
RT_CURSOR	0x3f68d4	0x134	data	English	United States	0.2662337662337662
RT_CURSOR	0x3f6a08	0x134	data	English	United States	0.2824675324675325
RT_CURSOR	0x3f6b3c	0x134	data	English	United States	0.3246753246753247
RT_CURSOR	0x3f6c70	0x134	data	English	United States	0.20454545454545456
RT_CURSOR	0x3f6da4	0x134	data	English	United States	0.2857142857142857
RT_CURSOR	0x3f6ed8	0x134	data	English	United States	0.4675324675324675
RT_CURSOR	0x3f700c	0x134	data	English	United States	0.2532467532467532
RT_CURSOR	0x3f7140	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.40584415584415584
RT_CURSOR	0x3f7274	0x134	data	English	United States	0.4383116883116883
RT_CURSOR	0x3f73a8	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_CURSOR	0x3f74dc	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"	English	United States	0.39285714285714285
RT_CURSOR	0x3f7610	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"	English	United States	0.4512987012987013
RT_CURSOR	0x3f7744	0x134	data	English	United States	0.37337662337662336
RT_CURSOR	0x3f7878	0x134	data	English	United States	0.4448051948051948
RT_CURSOR	0x3f79ac	0x134	data	English	United States	0.525974025974026
RT_BITMAP	0x3f7ae0	0xc3e8	Device independent bitmap graphic, 348 x 36 x 32, image size 0			0.37799090764077203
RT_BITMAP	0x403ec8	0x27a18	Device independent bitmap graphic, 966 x 42 x 32, image size 162288, resolution 3582 x 3582 px/m			0.32244591198068107
RT_BITMAP	0x42b8e0	0x62c	Device independent bitmap graphic, 324 x 9 x 4, image size 1476	English	United States	0.2430379746835443
RT_BITMAP	0x42bf0c	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.5818965517241379
RT_BITMAP	0x42bff4	0x4a0	Device independent bitmap graphic, 144 x 15 x 4, image size 1080	English	United States	0.3783783783783784
RT_BITMAP	0x42c494	0x197a	Device independent bitmap graphic, 144 x 15 x 24, image size 6482, resolution 2834 x 2834 px/m	English	United States	0.380098129408157
RT_BITMAP	0x42de10	0xc8	Device independent bitmap graphic, 13 x 12 x 4, image size 96	English	United States	0.51
RT_BITMAP	0x42ded8	0xc8	Device independent bitmap graphic, 13 x 12 x 4, image size 96	English	United States	0.515
RT_BITMAP	0x42dfa0	0xc8	Device independent bitmap graphic, 13 x 12 x 4, image size 96	English	United States	0.43
RT_BITMAP	0x42e068	0xc8	Device independent bitmap graphic, 13 x 12 x 4, image size 96	English	United States	0.44
RT_BITMAP	0x42e130	0x182a	Device independent bitmap graphic, 128 x 16 x 24, image size 6146, resolution 2834 x 2834 px/m	English	United States	0.2924345295829292
RT_BITMAP	0x42f95c	0x468	Device independent bitmap graphic, 128 x 16 x 4, image size 1024	English	United States	0.3058510638297872
RT_BITMAP	0x42fdc4	0x528	Device independent bitmap graphic, 16 x 16 x 8, image size 256	English	United States	0.4803030303030303
RT_BITMAP	0x4302ec	0x528	Device independent bitmap graphic, 16 x 16 x 8, image size 256	English	United States	0.4765151515151515
RT_BITMAP	0x430814	0x158	Device independent bitmap graphic, 32 x 15 x 4, image size 240	English	United States	0.41569767441860467
RT_BITMAP	0x43096c	0x188	Device independent bitmap graphic, 48 x 12 x 4, image size 288	English	United States	0.39285714285714285
RT_BITMAP	0x430af4	0x1e8	Device independent bitmap graphic, 48 x 16 x 4, image size 384	English	United States	0.5081967213114754
RT_BITMAP	0x430cdc	0xad2	Device independent bitmap graphic, 29 x 31 x 24, image size 2730, resolution 2834 x 2834 px/m	English	United States	0.18736462093862816
RT_BITMAP	0x4317b0	0xad2	Device independent bitmap graphic, 29 x 31 x 24, image size 2730, resolution 2834 x 2834 px/m	English	United States	0.1844765342960289
RT_BITMAP	0x432284	0xb0a	Device independent bitmap graphic, 31 x 29 x 24, image size 2786, resolution 2834 x 2834 px/m	English	United States	0.19497523000707714
RT_BITMAP	0x432d90	0x7e2	Device independent bitmap graphic, 25 x 26 x 24, image size 1978, resolution 2834 x 2834 px/m	English	United States	0.24033696729435083
RT_BITMAP	0x433574	0xb0a	Device independent bitmap graphic, 31 x 29 x 24, image size 2786, resolution 2834 x 2834 px/m	English	United States	0.1935598018400566
RT_BITMAP	0x434080	0x134	Device independent bitmap graphic, 17 x 17 x 4, image size 204	English	United States	0.37337662337662336
RT_BITMAP	0x4341b4	0x928	Device independent bitmap graphic, 48 x 16 x 24, image size 0, resolution 2834 x 2834 px/m	English	United States	0.533703071672355
RT_BITMAP	0x434adc	0x32a	Device independent bitmap graphic, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m	English	United States	0.7518518518518519
RT_BITMAP	0x434e08	0x32a	Device independent bitmap graphic, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m	English	United States	0.3790123456790123
RT_BITMAP	0x435134	0xc2a	Device independent bitmap graphic, 64 x 16 x 24, image size 3074, resolution 2834 x 2834 px/m	English	United States	0.42485549132947975
RT_BITMAP	0x435d60	0x20a	Device independent bitmap graphic, 13 x 12 x 24, image size 482, resolution 2834 x 2834 px/m	English	United States	0.9367816091954023
RT_BITMAP	0x435f6c	0x20a	Device independent bitmap graphic, 13 x 12 x 24, image size 482, resolution 2834 x 2834 px/m	English	United States	0.4482758620689655
RT_BITMAP	0x436178	0x20a	Device independent bitmap graphic, 13 x 12 x 24, image size 482, resolution 2834 x 2834 px/m	English	United States	0.33524904214559387
RT_BITMAP	0x436384	0x20a	Device independent bitmap graphic, 13 x 12 x 24, image size 482, resolution 2834 x 2834 px/m	English	United States	0.3371647509578544
RT_BITMAP	0x436590	0x32a	Device independent bitmap graphic, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m	English	United States	0.6320987654320988
RT_BITMAP	0x4368bc	0x2256	Device independent bitmap graphic, 324 x 9 x 24, image size 8750, resolution 2834 x 2834 px/m	English	United States	0.0608646188850967
RT_BITMAP	0x438b14	0x602a	Device independent bitmap graphic, 192 x 32 x 32, image size 24578, resolution 2834 x 2834 px/m	English	United States	0.2250385896498497
RT_BITMAP	0x43eb40	0x2028	Device independent bitmap graphic, 128 x 16 x 32, image size 0	English	United States	0.24708454810495628
RT_BITMAP	0x440b68	0x13da	Device independent bitmap graphic, 35 x 36 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.11570247933884298
RT_BITMAP	0x441f44	0x13da	Device independent bitmap graphic, 35 x 36 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.10999606454151908
RT_BITMAP	0x443320	0x13da	Device independent bitmap graphic, 36 x 35 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.11511216056670602
RT_BITMAP	0x4446fc	0xeb2	Device independent bitmap graphic, 31 x 30 x 32, image size 3722, resolution 2834 x 2834 px/m	English	United States	0.13157894736842105
RT_BITMAP	0x4455b0	0x13da	Device independent bitmap graphic, 36 x 35 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.11983471074380166
RT_BITMAP	0x44698c	0x13da	Device independent bitmap graphic, 35 x 36 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.27371113734750097
RT_BITMAP	0x447d68	0x13da	Device independent bitmap graphic, 35 x 36 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.2699724517906336
RT_BITMAP	0x449144	0x13da	Device independent bitmap graphic, 36 x 35 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.2426210153482881
RT_BITMAP	0x44a520	0xeb2	Device independent bitmap graphic, 31 x 30 x 32, image size 3722, resolution 2834 x 2834 px/m	English	United States	0.3413078149920255
RT_BITMAP	0x44b3d4	0x13da	Device independent bitmap graphic, 36 x 35 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.23868555686737505
RT_BITMAP	0x44c7b0	0x5a66	Device independent bitmap graphic, 77 x 75 x 32, image size 23102, resolution 2834 x 2834 px/m	English	United States	0.046365914786967416
RT_BITMAP	0x452218	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	English	United States	0.44565217391304346
RT_BITMAP	0x4522d0	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	English	United States	0.37962962962962965
RT_ICON	0x452414	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584			0.37968768484561694
RT_ICON	0x462c3c	0xcd63	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.8166568401833432
RT_ICON	0x46f9a0	0x518c9	PC bitmap, Windows 3.x format, 42286 x 2 x 47, image size 334966, cbSize 334025, bits offset 54			0.9976259262031285
RT_ICON	0x4c126c	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336			0.3634124330561884
RT_ICON	0x503294	0x6841	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0003746862003073
RT_ICON	0x509ad8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.3674273858921162
RT_ICON	0x50c080	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.5044559099437148
RT_ICON	0x50d128	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	Great Britain	0.6098360655737705
RT_ICON	0x50dab0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7881205673758865
RT_ICON	0x50df18	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	Great Britain	0.6098360655737705
RT_ICON	0x50e8a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7881205673758865
RT_ICON	0x50ed08	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.33198924731182794
RT_ICON	0x50eff0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.41216216216216217
RT_ICON	0x50f118	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.42905405405405406
RT_ICON	0x50f240	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.2661290322580645
RT_ICON	0x50f528	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.18010752688172044
RT_ICON	0x50f810	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.35135135135135137
RT_ICON	0x50f938	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.06092057761732852
RT_ICON	0x5101e0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.07658959537572255
RT_ICON	0x510748	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.042901234567901236
RT_ICON	0x5113f0	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 768	English	United States	0.10550458715596331
RT_ICON	0x511758	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.6400709219858156
RT_ICON	0x511bc0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5
RT_MENU	0x511ce8	0x11c	data	English	United States	0.573943661971831
RT_DIALOG	0x511e04	0x140	data	English	United States	0.553125
RT_DIALOG	0x511f44	0x190	data	English	United States	0.475
RT_DIALOG	0x5120d4	0x134	data	English	United States	0.6038961038961039
RT_DIALOG	0x512208	0xf0	data	English	United States	0.6125
RT_DIALOG	0x5122f8	0x148	data	English	United States	0.5640243902439024
RT_DIALOG	0x512440	0x2fc	data	English	United States	0.39397905759162305
RT_DIALOG	0x51273c	0x1e2	data	English	United States	0.4979253112033195
RT_DIALOG	0x512920	0x198	data	English	United States	0.5416666666666666
RT_DIALOG	0x512ab8	0x1fe	data	English	United States	0.4666666666666667
RT_DIALOG	0x512cb8	0x190	data	English	United States	0.485
RT_DIALOG	0x512e48	0x198	data	English	United States	0.5416666666666666
RT_DIALOG	0x512fe0	0x222	data	English	United States	0.46886446886446886
RT_DIALOG	0x513204	0x276	data	English	United States	0.42063492063492064
RT_DIALOG	0x51347c	0x218	data	English	United States	0.42723880597014924
RT_DIALOG	0x513694	0x238	data	English	United States	0.3961267605633803
RT_DIALOG	0x5138cc	0x4fc	data	English	United States	0.26880877742946707
RT_DIALOG	0x513dc8	0x13c	data	English	United States	0.5949367088607594
RT_DIALOG	0x513f04	0x1a4	data	English	United States	0.5380952380952381
RT_DIALOG	0x5140a8	0xe6	data	English	United States	0.6347826086956522
RT_DIALOG	0x514190	0x390	data	English	United States	0.4418859649122807
RT_DIALOG	0x514520	0x21c	data	English	United States	0.5037037037037037
RT_DIALOG	0x51473c	0x390	data	English	United States	0.4692982456140351
RT_DIALOG	0x514acc	0x1dc	data	English	United States	0.5441176470588235
RT_DIALOG	0x514ca8	0x346	data	English	United States	0.46897374701670647
RT_DIALOG	0x514ff0	0x334	data	English	United States	0.43658536585365854
RT_DIALOG	0x515324	0x58	data	English	United States	0.8068181818181818
RT_DIALOG	0x51537c	0x23c	data	English	United States	0.5122377622377622
RT_DIALOG	0x5155b8	0x1c2	data	English	United States	0.5066666666666667
RT_DIALOG	0x51577c	0x160	data	English	United States	0.5994318181818182
RT_DIALOG	0x5158dc	0xb2	data	English	United States	0.7191011235955056
RT_DIALOG	0x515990	0x3d4	data	English	United States	0.3408163265306122
RT_DIALOG	0x515d64	0x19e	data	English	United States	0.6280193236714976
RT_DIALOG	0x515f04	0x1a2	data	English	United States	0.5741626794258373
RT_DIALOG	0x5160a8	0x34	data	English	United States	0.8076923076923077
RT_DIALOG	0x5160dc	0x2a8	data	English	United States	0.5338235294117647
RT_DIALOG	0x516384	0x382	data	English	United States	0.48552338530066813
RT_DIALOG	0x516708	0xe8	data	English	United States	0.6336206896551724
RT_DIALOG	0x5167f0	0x34	data	English	United States	0.9038461538461539
RT_STRING	0x516824	0x44	data	English	United States	0.6323529411764706
RT_STRING	0x516868	0x32c	data	English	United States	0.4125615763546798
RT_STRING	0x516b94	0x248	data	English	United States	0.5085616438356164
RT_STRING	0x516ddc	0x84	data	English	United States	0.5833333333333334
RT_STRING	0x516e60	0x2a8	data	English	United States	0.36176470588235293
RT_STRING	0x517108	0x20e	data	English	United States	0.3155893536121673
RT_STRING	0x517318	0x24c	data	English	United States	0.4370748299319728
RT_STRING	0x517564	0x3c	data	English	United States	0.65
RT_STRING	0x5175a0	0x16e	data	English	United States	0.39344262295081966
RT_STRING	0x517710	0xa6	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	English	United States	0.7228915662650602
RT_STRING	0x5177b8	0x184	data	English	United States	0.4742268041237113
RT_STRING	0x51793c	0x66	data	English	United States	0.696078431372549
RT_STRING	0x5179a4	0x1d6	Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0	English	United States	0.35319148936170214
RT_STRING	0x517b7c	0x186	data	English	United States	0.5384615384615384
RT_STRING	0x517d04	0xb2	data	English	United States	0.6179775280898876
RT_STRING	0x517db8	0x48	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	English	United States	0.7083333333333334
RT_STRING	0x517e00	0x18c	data	English	United States	0.398989898989899
RT_STRING	0x517f8c	0x82	StarOffice Gallery theme p, 536899072 objects, 1st n	English	United States	0.7153846153846154
RT_STRING	0x518010	0x2a	data	English	United States	0.5476190476190477
RT_STRING	0x51803c	0x184	data	English	United States	0.48711340206185566
RT_STRING	0x5181c0	0x4ee	data	English	United States	0.375594294770206
RT_STRING	0x5186b0	0x264	data	English	United States	0.3333333333333333
RT_STRING	0x518914	0x2da	data	English	United States	0.3698630136986301
RT_STRING	0x518bf0	0x8a	data	English	United States	0.6594202898550725
RT_STRING	0x518c7c	0xac	data	English	United States	0.45348837209302323
RT_STRING	0x518d28	0xde	data	English	United States	0.536036036036036
RT_STRING	0x518e08	0x4a8	data	English	United States	0.3221476510067114
RT_STRING	0x5192b0	0x228	data	English	United States	0.4003623188405797
RT_STRING	0x5194d8	0x2c	data	English	United States	0.5227272727272727
RT_STRING	0x519504	0x53e	data	English	United States	0.2965722801788376
RT_RCDATA	0x519a44	0x11dab	Delphi compiled form 'TfFolderProperties'			0.5081565956981308
RT_RCDATA	0x52b7f0	0xce6b	Delphi compiled form 'TFormMD'			0.5119126468974131
RT_RCDATA	0x53865c	0xa9cb	Delphi compiled form 'TfSHistory'			0.4406331239791106
RT_RCDATA	0x543028	0x1b681	Delphi compiled form 'TMsgBoxForm'			0.5739686611970746
RT_MESSAGETABLE	0x55e6ac	0x2840	data			0.5283385093167702
RT_GROUP_CURSOR	0x560eec	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x560f00	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x560f14	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x560f28	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x560f3c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x560f50	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x560f64	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x560f78	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x560f8c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x560fa0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x560fb4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x560fc8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x560fdc	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0x561000	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x561014	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x561028	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x56103c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x561050	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x561064	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x561078	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x56108c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x5610a0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x5610b4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x5610c8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x5610dc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x5610f0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x561104	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x561118	0x68	data	English	Great Britain	0.6442307692307693
RT_GROUP_ICON	0x561180	0x22	data	English	United States	1.0588235294117647
RT_GROUP_ICON	0x5611a4	0x22	data	English	United States	1.0588235294117647
RT_GROUP_ICON	0x5611c8	0x5a	data	English	United States	0.7555555555555555
RT_GROUP_ICON	0x561224	0x22	data	English	United States	1.1176470588235294
RT_VERSION	0x561248	0x254	data	English	United States	0.4748322147651007
RT_ANIICON	0x56149c	0x36b6e	PC bitmap, Windows 3.x format, 28224 x 2 x 54, image size 224986, cbSize 224110, bits offset 54			0.9941144973450537
None	0x59800c	0x1f1	data	English	United States	0.17706237424547283
None	0x598200	0x1c	data	English	United States	1.2857142857142858
None	0x59821c	0x18	data	English	United States	1.2916666666666667

Imports

DLL	Import
KERNEL32.dll	GetDateFormatW, GetConsoleMode, GetConsoleOutputCP, SetFilePointerEx, GetTimeZoneInformation, ExitProcess, GetStdHandle, GetFileType, SetStdHandle, VirtualQuery, VirtualAlloc, GetSystemInfo, HeapQueryInformation, GetCommandLineW, GetCommandLineA, FreeLibraryAndExitThread, ExitThread, CreateThread, RtlUnwind, GetCPInfo, CompareStringEx, LCMapStringW, GetDriveTypeW, LCMapStringEx, GetStringTypeW, GetModuleHandleExW, CloseThreadpoolWork, SubmitThreadpoolWork, CreateThreadpoolWork, FreeLibraryWhenCallbackReturns, TryAcquireSRWLockExclusive, QueryPerformanceFrequency, InitOnceBeginInitialize, InitOnceComplete, AreFileApisANSI, FindFirstFileExW, FormatMessageA, RaiseException, GetTimeFormatW, IsValidLocale, EnumSystemLocalesW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, WriteConsoleW, GetStartupInfoW, IsDebuggerPresent, InitializeSListHead, GetSystemTimeAsFileTime, QueryPerformanceCounter, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsProcessorFeaturePresent, SleepConditionVariableSRW, WakeAllConditionVariable, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, GetUserDefaultLCID, SearchPathW, GetProfileIntW, GetTickCount64, GetWindowsDirectoryW, ReadConsoleW, FindResourceExW, SetErrorMode, GetFileTime, GetFileSizeEx, GetFileAttributesExW, GetCurrentDirectoryW, GetFileAttributesW, VirtualProtect, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetLocaleInfoW, GlobalFlags, LocalReAlloc, GlobalHandle, GlobalReAlloc, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSection, GlobalGetAtomNameW, InitializeCriticalSectionAndSpinCount, GetThreadLocale, lstrcmpiW, DuplicateHandle, WriteFile, UnlockFile, SetFilePointer, SetEndOfFile, ReadFile, LockFile, GetVolumeInformationW, GetFullPathNameW, GetFileSize, FlushFileBuffers, CreateFileW, FileTimeToSystemTime, SystemTimeToTzSpecificLocalTime, FileTimeToLocalFileTime, lstrcpyW, WritePrivateProfileStringW, GetPrivateProfileStringW, GetPrivateProfileIntW, lstrcmpA, GetCurrentThread, ResumeThread, SetThreadPriority, CompareStringW, GlobalFindAtomW, GlobalAddAtomW, lstrcmpW, GlobalDeleteAtom, LoadLibraryW, LoadLibraryA, LoadLibraryExW, GetProcAddress, GetModuleHandleA, FreeLibrary, GetSystemDirectoryW, GetCurrentThreadId, EncodePointer, OutputDebugStringA, GetCurrentProcessId, CopyFileW, MulDiv, GlobalSize, SetLastError, GetExitCodeProcess, IsWow64Process, GetModuleHandleW, CreateProcessW, GlobalFree, GetVersionExW, LocalAlloc, WaitForSingleObject, FindClose, GetModuleFileNameW, GetCurrentProcess, FindNextFileW, FindFirstFileW, GlobalMemoryStatusEx, SizeofResource, Process32FirstW, GetDiskFreeSpaceExW, Process32NextW, CreateToolhelp32Snapshot, GetUserDefaultLocaleName, GetLocaleInfoEx, GetTickCount, VerifyVersionInfoW, VerSetConditionMask, LocalFree, FormatMessageW, GlobalUnlock, GlobalLock, GlobalAlloc, MoveFileExW, CloseHandle, OutputDebugStringW, CreateMutexW, RemoveDirectoryW, GetTempFileNameW, DeleteFileW, MultiByteToWideChar, GetTempPathW, GetEnvironmentVariableW, CreateDirectoryW, WideCharToMultiByte, GetProcessHeap, DeleteCriticalSection, DecodePointer, HeapAlloc, FindResourceW, LoadResource, HeapReAlloc, LockResource, GetLastError, Sleep, HeapSize, InitializeCriticalSectionEx, LeaveCriticalSection, EnterCriticalSection, HeapFree
USER32.dll	GetKeyNameTextW, EnumDisplayMonitors, SystemParametersInfoW, LoadCursorW, SetLayeredWindowAttributes, MapDialogRect, SetWindowContextHelpId, SetCursor, ShowOwnedPopups, PostQuitMessage, DrawIconEx, IsRectEmpty, InflateRect, DrawFocusRect, GetSysColorBrush, SetWindowRgn, DrawFrameControl, DrawEdge, GetCursorPos, TranslateMessage, GetMessageW, SetMenuItemInfoW, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, EnableMenuItem, CheckMenuItem, OffsetRect, SetRectEmpty, SendDlgItemMessageA, LoadMenuW, GetDesktopWindow, GetActiveWindow, GetNextDlgTabItem, EndDialog, CreateDialogIndirectParamW, IsDialogMessageW, SetWindowTextW, CheckDlgButton, MoveWindow, LockWindowUpdate, MapVirtualKeyW, GetDoubleClickTime, GetIconInfo, CopyIcon, GetMenuDefaultItem, UnregisterClassW, EnableWindow, ShowWindow, GetMonitorInfoW, MonitorFromWindow, WinHelpW, GetScrollInfo, SetScrollInfo, CallNextHookEx, UnhookWindowsHookEx, SetWindowsHookExW, GetWindow, GetTopWindow, GetClassLongW, SetWindowLongW, PtInRect, EqualRect, CopyRect, MapWindowPoints, AdjustWindowRectEx, GetWindowTextLengthW, GetWindowTextW, RemovePropW, GetPropW, SetPropW, ShowScrollBar, SetMenuDefaultItem, SetClipboardData, EmptyClipboard, SetParent, MonitorFromPoint, IsZoomed, SetCapture, ReleaseCapture, DeleteMenu, MessageBeep, WindowFromPoint, NotifyWinEvent, SetCursorPos, SetRect, UnionRect, BringWindowToTop, DestroyMenu, SetScrollRange, GetScrollPos, GetMenuItemInfoW, CharUpperW, IntersectRect, RealChildWindowFromPoint, CopyImage, GetAsyncKeyState, CreatePopupMenu, TrackMouseEvent, DestroyIcon, LoadImageW, OpenClipboard, EnableScrollBar, SendMessageW, IsIconic, AppendMenuW, GetClientRect, RemoveMenu, LoadIconW, DrawIcon, GetSystemMetrics, GetWindowRect, PostMessageW, GetSystemMenu, InvalidateRect, KillTimer, SetTimer, GetParent, GetMenuStringW, GetMenuState, GetSubMenu, GetMenuItemID, GetMenuItemCount, InsertMenuW, IsWindowEnabled, MessageBoxW, GetWindowLongW, GetWindowThreadProcessId, GetLastActivePopup, DrawTextW, DrawTextExW, GrayStringW, TabbedTextOutW, GetDC, GetWindowDC, ReleaseDC, BeginPaint, EndPaint, ClientToScreen, ScreenToClient, GetSysColor, FillRect, DrawStateW, UpdateWindow, GetClassNameW, LoadBitmapW, RegisterWindowMessageW, DispatchMessageW, PeekMessageW, GetMessagePos, GetMessageTime, DefWindowProcW, CallWindowProcW, RegisterClassW, GetClassInfoW, GetClassInfoExW, CreateWindowExW, IsWindow, IsMenu, IsChild, DestroyWindow, SetWindowPos, GetWindowPlacement, SetWindowPlacement, BeginDeferWindowPos, DeferWindowPos, EndDeferWindowPos, IsWindowVisible, GetDlgItem, GetDlgCtrlID, SetFocus, GetFocus, GetKeyState, GetCapture, GetMenu, SetMenu, TrackPopupMenu, SetActiveWindow, GetForegroundWindow, SetForegroundWindow, ValidateRect, RedrawWindow, ScrollWindow, SetScrollPos, ModifyMenuW, DestroyAcceleratorTable, SetClassLongW, GetUpdateRect, CloseClipboard, WaitMessage, CharNextW, CopyAcceleratorTableW, InvalidateRgn, GetNextDlgGroupItem, IsClipboardFormatAvailable, ToUnicodeEx, GetKeyboardLayout, GetKeyboardState, LoadAcceleratorsW, CreateAcceleratorTableW, UpdateLayeredWindow, HideCaret, InvertRect, FrameRect, SubtractRect, RegisterClipboardFormatW, CharUpperBuffW, TranslateAcceleratorW, InsertMenuItemW, UnpackDDElParam, ReuseDDElParam, PostThreadMessageW, IsCharLowerW, MapVirtualKeyExW, DrawMenuBar, DefFrameProcW, DefMDIChildProcW, TranslateMDISysAccel, GetComboBoxInfo, CreateMenu, DestroyCursor, GetWindowRgn, GetScrollRange
GDI32.dll	LineTo, PtVisible, RectVisible, RestoreDC, SaveDC, SelectClipRgn, ExtSelectClipRgn, SelectObject, SelectPalette, SetBkColor, SetBkMode, SetMapMode, SetLayout, SetPolyFillMode, SetROP2, SetTextColor, SetTextAlign, MoveToEx, TextOutW, ExtTextOutW, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx, OffsetViewportOrgEx, OffsetWindowOrgEx, ScaleViewportExtEx, ScaleWindowExtEx, CombineRgn, CreateEllipticRgn, CreateRectRgnIndirect, Ellipse, GetBkColor, GetTextColor, GetTextExtentPoint32W, IntersectClipRect, CreatePolygonRgn, Polygon, Polyline, GetTextMetricsW, CreateCompatibleBitmap, CreateDIBitmap, EnumFontFamiliesW, GetTextCharsetInfo, GetMapMode, SetRectRgn, DPtoLP, RealizePalette, SetPixel, StretchBlt, CreateDIBSection, SetDIBColorTable, CreateRoundRectRgn, Rectangle, GetRgnBox, OffsetRgn, RoundRect, CreatePalette, GetPaletteEntries, EnumFontFamiliesExW, GetNearestPaletteIndex, GetSystemPaletteEntries, LPtoDP, ExtFloodFill, SetPaletteEntries, FillRgn, FrameRgn, GetBoundsRect, PtInRegion, GetViewportOrgEx, GetWindowOrgEx, SetPixelV, GetTextFaceW, GetWindowExtEx, GetViewportExtEx, GetStockObject, GetPixel, GetObjectType, GetClipBox, ExcludeClipRect, Escape, DeleteObject, CreateRectRgn, CreatePatternBrush, CreatePen, CreateHatchBrush, DeleteDC, CreateFontIndirectW, CreateSolidBrush, GetObjectW, CopyMetaFileW, CreateDCW, GetDeviceCaps, BitBlt, CreateBitmap, CreateCompatibleDC, PatBlt, GetLayout
MSIMG32.dll	AlphaBlend, TransparentBlt
WINSPOOL.DRV	DocumentPropertiesW, OpenPrinterW, ClosePrinter
ADVAPI32.dll	CryptDestroyHash, RegQueryValueExA, RegEnumValueW, RegQueryValueW, RegEnumKeyW, RegDeleteValueW, RegDeleteKeyW, CryptAcquireContextW, CryptCreateHash, CryptHashData, RegOpenKeyExA, CryptGetHashParam, CryptReleaseContext, RegCreateKeyExW, RegSetValueExW, RegQueryInfoKeyW, RegEnumKeyExW, RegOpenKeyExW, RegGetValueW, RegQueryValueExW, RegCloseKey
SHELL32.dll	DragFinish, DragQueryFileW, SHAppBarMessage, SHGetFileInfoW, SHGetDesktopFolder, SHBrowseForFolderW, SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHGetMalloc, ShellExecuteW, SHGetKnownFolderPath, SHGetFolderPathW
COMCTL32.dll	InitCommonControlsEx
SHLWAPI.dll	PathRemoveFileSpecW, StrFormatKBSizeW, PathStripToRootW, PathIsUNCW, PathFindFileNameW, PathFindExtensionW, PathAppendW, PathIsDirectoryEmptyW, PathFileExistsW, PathIsDirectoryW
UxTheme.dll	DrawThemeText, IsAppThemed, OpenThemeData, CloseThemeData, GetThemePartSize, GetThemeSysColor, DrawThemeBackground, GetThemeColor, GetCurrentThemeName, DrawThemeParentBackground, GetWindowTheme, IsThemeBackgroundPartiallyTransparent
ole32.dll	RegisterDragDrop, IsAccelerator, OleTranslateAccelerator, OleDestroyMenuDescriptor, OleCreateMenuDescriptor, OleUninitialize, OleInitialize, CoFreeUnusedLibraries, CoInitializeEx, OleLockRunning, RevokeDragDrop, CoLockObjectExternal, OleGetClipboard, DoDragDrop, OleIsCurrentClipboard, CreateILockBytesOnHGlobal, StgOpenStorageOnILockBytes, StgCreateDocfileOnILockBytes, CoGetClassObject, CoDisconnectObject, CLSIDFromProgID, CLSIDFromString, CoCreateGuid, ReleaseStgMedium, OleDuplicateData, CoTaskMemAlloc, CoCreateInstance, CoUninitialize, CoInitialize, CreateStreamOnHGlobal, CoTaskMemFree, CoRevokeClassObject, CoRegisterMessageFilter, OleFlushClipboard
OLEAUT32.dll	SafeArrayDestroy, VariantCopy, VariantTimeToSystemTime, SystemTimeToVariantTime, VariantChangeType, VariantClear, VariantInit, SysAllocStringLen, SysFreeString, SysAllocStringByteLen, SysAllocString, SysStringLen, OleCreateFontIndirect, LoadTypeLib, VarBstrFromDate
oledlg.dll	OleUIBusyW
gdiplus.dll	GdipSetInterpolationMode, GdipCreateBitmapFromHBITMAP, GdipDrawImageI, GdipBitmapUnlockBits, GdipBitmapLockBits, GdipCreateBitmapFromScan0, GdipGetImagePaletteSize, GdipGetImagePalette, GdipGetImagePixelFormat, GdipGetImageHeight, GdipGetImageWidth, GdipGetImageGraphicsContext, GdipCreateBitmapFromStream, GdiplusShutdown, GdiplusStartup, GdipLoadImageFromStream, GdipDeleteGraphics, GdipCreateFromHDC, GdipFree, GdipDisposeImage, GdipDrawImageRectI, GdipAlloc, GdipCloneImage
WINHTTP.dll	WinHttpQueryDataAvailable, WinHttpCloseHandle, WinHttpSetOption, WinHttpConnect, WinHttpCrackUrl, WinHttpSendRequest, WinHttpOpenRequest, WinHttpReadData, WinHttpQueryHeaders, WinHttpOpen, WinHttpReceiveResponse, WinHttpAddRequestHeaders
WININET.dll	InternetOpenW, HttpQueryInfoW, InternetCloseHandle, InternetReadFile, InternetOpenUrlW
VERSION.dll	VerQueryValueW
ntdll.dll	RtlGetVersion
OLEACC.dll	AccessibleObjectFromWindow, LresultFromObject, CreateStdAccessibleObject
IMM32.dll	ImmReleaseContext, ImmGetOpenStatus, ImmGetContext
WINMM.dll	PlaySoundW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:34:36.477385044 CET	49708	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:34:36.482224941 CET	30203	49708	181.71.216.203	192.168.2.8
Jan 10, 2025 11:34:36.482372046 CET	49708	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:34:36.533483982 CET	49708	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:34:36.538310051 CET	30203	49708	181.71.216.203	192.168.2.8
Jan 10, 2025 11:34:36.540683985 CET	49708	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:34:36.546595097 CET	30203	49708	181.71.216.203	192.168.2.8
Jan 10, 2025 11:34:57.878804922 CET	30203	49708	181.71.216.203	192.168.2.8
Jan 10, 2025 11:34:57.878885984 CET	49708	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:34:57.891272068 CET	49708	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:34:57.896035910 CET	30203	49708	181.71.216.203	192.168.2.8
Jan 10, 2025 11:34:58.003422022 CET	49709	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:34:58.008307934 CET	30203	49709	181.71.216.203	192.168.2.8
Jan 10, 2025 11:34:58.008398056 CET	49709	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:34:58.009429932 CET	49709	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:34:58.014194012 CET	30203	49709	181.71.216.203	192.168.2.8
Jan 10, 2025 11:34:58.014282942 CET	49709	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:34:58.019100904 CET	30203	49709	181.71.216.203	192.168.2.8
Jan 10, 2025 11:35:19.357760906 CET	30203	49709	181.71.216.203	192.168.2.8
Jan 10, 2025 11:35:19.361056089 CET	49709	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:35:19.361207962 CET	49709	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:35:19.365910053 CET	30203	49709	181.71.216.203	192.168.2.8
Jan 10, 2025 11:35:19.472197056 CET	49711	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:35:19.477089882 CET	30203	49711	181.71.216.203	192.168.2.8
Jan 10, 2025 11:35:19.477637053 CET	49711	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:35:19.478239059 CET	49711	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:35:19.483026981 CET	30203	49711	181.71.216.203	192.168.2.8
Jan 10, 2025 11:35:19.483705997 CET	49711	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:35:19.488581896 CET	30203	49711	181.71.216.203	192.168.2.8
Jan 10, 2025 11:35:40.875828028 CET	30203	49711	181.71.216.203	192.168.2.8
Jan 10, 2025 11:35:40.875957966 CET	49711	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:35:40.876197100 CET	49711	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:35:40.880913973 CET	30203	49711	181.71.216.203	192.168.2.8
Jan 10, 2025 11:35:40.988352060 CET	49715	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:35:40.993264914 CET	30203	49715	181.71.216.203	192.168.2.8
Jan 10, 2025 11:35:40.993382931 CET	49715	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:35:40.994167089 CET	49715	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:35:40.998997927 CET	30203	49715	181.71.216.203	192.168.2.8
Jan 10, 2025 11:35:40.999149084 CET	49715	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:35:41.004002094 CET	30203	49715	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:02.374875069 CET	30203	49715	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:02.374953032 CET	49715	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:02.375133991 CET	49715	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:02.379872084 CET	30203	49715	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:02.489751101 CET	49716	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:02.494585037 CET	30203	49716	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:02.494683027 CET	49716	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:02.496150970 CET	49716	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:02.500884056 CET	30203	49716	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:02.500936031 CET	49716	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:02.505681038 CET	30203	49716	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:09.082622051 CET	49716	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:09.087585926 CET	30203	49716	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:09.087657928 CET	49716	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:09.092533112 CET	30203	49716	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:18.128926992 CET	49716	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:18.133755922 CET	30203	49716	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:18.141215086 CET	49716	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:18.145992994 CET	30203	49716	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:23.862848997 CET	30203	49716	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:23.863038063 CET	49716	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:23.863209963 CET	49716	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:23.868000031 CET	30203	49716	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:23.972765923 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:23.977649927 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:23.979827881 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:23.979827881 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:23.984627008 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:23.990833998 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:23.995754957 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:29.961304903 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:29.966114998 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:29.966223001 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:29.971031904 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:31.769467115 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:31.774336100 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:31.774391890 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:31.779211044 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:32.862766981 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:32.867623091 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:32.867714882 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:32.872545004 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:45.363238096 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:45.363320112 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:45.363523006 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:45.368333101 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:45.472752094 CET	49718	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:45.477622986 CET	30203	49718	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:45.477735996 CET	49718	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:45.478856087 CET	49718	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:45.483658075 CET	30203	49718	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:45.483715057 CET	49718	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:45.488535881 CET	30203	49718	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:46.175221920 CET	49718	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:46.180191040 CET	30203	49718	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:46.180363894 CET	49718	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:46.185194969 CET	30203	49718	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:57.644216061 CET	49718	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:57.649178982 CET	30203	49718	181.71.216.203	192.168.2.8
Jan 10, 2025 11:36:57.649234056 CET	49718	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:36:57.654057026 CET	30203	49718	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:07.497226954 CET	30203	49718	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:07.497247934 CET	30203	49718	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:07.497307062 CET	49718	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:07.497334957 CET	49718	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:07.497379065 CET	30203	49718	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:07.497423887 CET	49718	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:07.497451067 CET	49718	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:07.502255917 CET	30203	49718	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:07.613116980 CET	49719	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:07.618294954 CET	30203	49719	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:07.618391991 CET	49719	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:07.619137049 CET	49719	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:07.623982906 CET	30203	49719	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:07.624047041 CET	49719	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:07.628917933 CET	30203	49719	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:11.144452095 CET	49719	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:11.149386883 CET	30203	49719	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:11.149446011 CET	49719	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:11.154359102 CET	30203	49719	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:28.989156008 CET	30203	49719	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:28.989619017 CET	49719	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:28.989908934 CET	49719	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:28.994657993 CET	30203	49719	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:29.114896059 CET	49720	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:29.119868994 CET	30203	49720	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:29.119955063 CET	49720	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:29.121458054 CET	49720	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:29.126208067 CET	30203	49720	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:29.126261950 CET	49720	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:29.131066084 CET	30203	49720	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:43.848562956 CET	49720	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:43.853518009 CET	30203	49720	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:43.853583097 CET	49720	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:43.858769894 CET	30203	49720	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:44.253432035 CET	49720	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:44.258399010 CET	30203	49720	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:44.258965015 CET	49720	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:44.263708115 CET	30203	49720	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:50.501497984 CET	30203	49720	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:50.501730919 CET	49720	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:50.501893044 CET	49720	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:50.506740093 CET	30203	49720	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:50.613679886 CET	49721	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:50.618575096 CET	30203	49721	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:50.618885994 CET	49721	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:50.619565010 CET	49721	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:50.624336958 CET	30203	49721	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:50.624422073 CET	49721	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:50.629163980 CET	30203	49721	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:55.035042048 CET	49721	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:55.039915085 CET	30203	49721	181.71.216.203	192.168.2.8
Jan 10, 2025 11:37:55.040148020 CET	49721	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:37:55.045003891 CET	30203	49721	181.71.216.203	192.168.2.8
Jan 10, 2025 11:38:05.708224058 CET	49721	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:38:05.713083982 CET	30203	49721	181.71.216.203	192.168.2.8
Jan 10, 2025 11:38:05.713179111 CET	49721	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:38:05.718498945 CET	30203	49721	181.71.216.203	192.168.2.8
Jan 10, 2025 11:38:12.005848885 CET	30203	49721	181.71.216.203	192.168.2.8
Jan 10, 2025 11:38:12.005908966 CET	49721	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:38:12.006161928 CET	49721	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:38:12.011136055 CET	30203	49721	181.71.216.203	192.168.2.8
Jan 10, 2025 11:38:12.113303900 CET	49722	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:38:12.118125916 CET	30203	49722	181.71.216.203	192.168.2.8
Jan 10, 2025 11:38:12.118236065 CET	49722	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:38:12.119105101 CET	49722	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:38:12.123889923 CET	30203	49722	181.71.216.203	192.168.2.8
Jan 10, 2025 11:38:12.123958111 CET	49722	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:38:12.128726006 CET	30203	49722	181.71.216.203	192.168.2.8
Jan 10, 2025 11:38:19.165263891 CET	49722	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:38:19.170177937 CET	30203	49722	181.71.216.203	192.168.2.8
Jan 10, 2025 11:38:19.170298100 CET	49722	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:38:19.175090075 CET	30203	49722	181.71.216.203	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:34:36.457285881 CET	61976	53	192.168.2.8	1.1.1.1
Jan 10, 2025 11:34:36.473789930 CET	53	61976	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 11:34:36.457285881 CET	192.168.2.8	1.1.1.1	0x2aa3	Standard query (0)	newstaticfreepoint24.ddns-ip.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 11:34:36.473789930 CET	1.1.1.1	192.168.2.8	0x2aa3	No error (0)	newstaticfreepoint24.ddns-ip.net		181.71.216.203	A (IP address)	IN (0x0001)	false

Target ID:	1
Start time:	05:34:10
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\AdobeReaderPDFonline.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AdobeReaderPDFonline.exe"
Imagebase:	0x400000
File size:	5'835'776 bytes
MD5 hash:	AF1D0F01B01DA4DA3A9A54B2BEE820E9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:34:32
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:	0x110000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.3922060213.0000000007F43000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.3918431665.0000000006B30000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.3918792657.0000000006DA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	20.3%
Total number of Nodes:	79
Total number of Limit Nodes:	5

Executed Functions

Function 025E1939 Relevance: 38.9, APIs: 1, Strings: 21, Instructions: 447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
O4:2, xrefs: 025F1553
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
_V, xrefs: 025F139B
R, xrefs: 025F13E5
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: M$MIMK$O4:2$P$R$R$_V$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 0-127553305
Opcode ID: 4b91097f457b63b63a7f751f9f8793481fcf1dab363cf3a22e310d5746cf24c4
Instruction ID: f8e95e5c20d8779398b7451ca748cdc3a6591b8dcfdeb20a691595782525701d
Opcode Fuzzy Hash: 4b91097f457b63b63a7f751f9f8793481fcf1dab363cf3a22e310d5746cf24c4
Instruction Fuzzy Hash: 56F154A2D089A48EF7208B24DC54BEB7B76EF81310F0481FED54D97281E6791AC5CF66

Function 025F0B6E Relevance: 33.7, APIs: 1, Strings: 18, Instructions: 415
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 4f9abf4db52cd044cb545b692a2a7a2cf35f04f166506c23455d59c779f8689a
Instruction ID: 656e8d0a66aedeebccaf336048d1301f784e8d2f3a9e86064969e002e9b4af51
Opcode Fuzzy Hash: 4f9abf4db52cd044cb545b692a2a7a2cf35f04f166506c23455d59c779f8689a
Instruction Fuzzy Hash: B8E146B2D046949FF7208628DC58BEB7B79EF81310F0481FAD54D97680D67A4AC5CF62

Function 025F0E2E Relevance: 33.6, APIs: 1, Strings: 18, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 0-3061001137
Opcode ID: e1c221bc52062d45e6f046c7828969b7b4cb86fda0cae94f55a7e19a11ddb90a
Instruction ID: f2d1ddfa62d573b2669716a85ac38383b0b0cddfc45f3871006e0fcb3f8dd4be
Opcode Fuzzy Hash: e1c221bc52062d45e6f046c7828969b7b4cb86fda0cae94f55a7e19a11ddb90a
Instruction Fuzzy Hash: 6DE100B1D089A48BF720CA28DC94BEB7B75EF81301F0841FAD54DA7281D6795AC5CF62

Function 025F0BB0 Relevance: 33.6, APIs: 1, Strings: 18, Instructions: 376
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 025F1C52

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 9faf7a50581138339ae4a081f12b030bfce7dc37ba3eb101fa84b815c36da5d7
Instruction ID: f6260d7aaf2ce04cc33102996e71ea79d3b74491cdf0302e1a7dac4fe87613ec
Opcode Fuzzy Hash: 9faf7a50581138339ae4a081f12b030bfce7dc37ba3eb101fa84b815c36da5d7
Instruction Fuzzy Hash: 8BE1E1B1D086948BF7208A24DC54BEB7B7AEB81310F0481FAD94D97281D67A5EC5CF62

Function 025F0A21 Relevance: 33.6, APIs: 1, Strings: 18, Instructions: 341
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 025F1C52

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 844acb77baab3334217359fd4bd7146508c1f0573df98ef6f0fcbd0fdb792f02
Instruction ID: 229d32340a32a1490438c6f9b937779faa8eac729c3d705fd4b31c2a30dd239d
Opcode Fuzzy Hash: 844acb77baab3334217359fd4bd7146508c1f0573df98ef6f0fcbd0fdb792f02
Instruction Fuzzy Hash: 20D12471D086A88AE7218B28CC54BEBBB75EF81314F0441FAD54CA7291E6794BC5CF52

Function 025F1199 Relevance: 33.6, APIs: 1, Strings: 18, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: ad9246120097d03c1fcde15b0df210fc02c864022a60e2cdd9f72abdb5056d98
Instruction ID: 1144d124f6b66c51d8d2251a208369dc6852110ffb9eb935fa42295f15555c3e
Opcode Fuzzy Hash: ad9246120097d03c1fcde15b0df210fc02c864022a60e2cdd9f72abdb5056d98
Instruction Fuzzy Hash: CFC165A1E08A94CEF7208628DC58BEB7B75EF91300F0481FAD54C97681D67A5AC5CF62

Function 025F11A6 Relevance: 33.6, APIs: 1, Strings: 18, Instructions: 321
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: ec17dff62597b6a56d606bb1627ea0af0afdf44167222fee6fc6000b538e854d
Instruction ID: 1665e632765aca8fd8b62f505c0d2254bba37b12a8381d3abebdfac4d4492b15
Opcode Fuzzy Hash: ec17dff62597b6a56d606bb1627ea0af0afdf44167222fee6fc6000b538e854d
Instruction Fuzzy Hash: 86C146A1E08A94CEF7208628DC58BEB7B75EF91300F0441FAD54C97681D67A5AC5CF62

Function 025F1221 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 292
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 77100f7d9f386dfce3410828bc7566292ac64bea5d821fc376af2cac4c212ac8
Instruction ID: 028705ca23fd4164b1708d5be8c4b4d457f4a637763d060f72c9f6167bb5aa50
Opcode Fuzzy Hash: 77100f7d9f386dfce3410828bc7566292ac64bea5d821fc376af2cac4c212ac8
Instruction Fuzzy Hash: 5AB156A1D08A948EF720C728DC58BEB7B75EF92300F0440FAD54D97281E67A4AC5CF62

Function 025F12C3 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 450a28ff0971309f2bcbee9528c331083f677f107c0e6b732b32f2ed8d4abd08
Instruction ID: 884d47b80dc28cc9f8ff9032f94df1da216298a53285a19e9e2722bf17467227
Opcode Fuzzy Hash: 450a28ff0971309f2bcbee9528c331083f677f107c0e6b732b32f2ed8d4abd08
Instruction Fuzzy Hash: 12B143A1D08A948EF720C728DC58BEB7B75EF91310F0480FAD54D97281E67A5AC5CF62

Function 025F1559 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 6b352f522020a5d3b62cd0d01a9c5dbe7ac3a43daff5323f8a211830601bc714
Instruction ID: 8ce6d640800f68668cc9c6ab4ead18f8a1377d19abe334dd0ebb504d9aae183f
Opcode Fuzzy Hash: 6b352f522020a5d3b62cd0d01a9c5dbe7ac3a43daff5323f8a211830601bc714
Instruction Fuzzy Hash: 98B133A1D08A948EF720CB28DC54BEB7B75EF91300F0481FAD54D97281E67A5AC5CF62

Function 025F12CE Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 7ae49a5e9895490fa8d78dc0634f2fba44b2f46e4b7574fb95dbbe602f4080e3
Instruction ID: 6cd30ad9482765cee0c751f4218bd696e1fdc17a2d1ae67414fd64897e2db519
Opcode Fuzzy Hash: 7ae49a5e9895490fa8d78dc0634f2fba44b2f46e4b7574fb95dbbe602f4080e3
Instruction Fuzzy Hash: 43B143A1D08A948EF720CB28DC58BEB7B75EF91310F0480FAD54C97281D67A5AC5CF62

Function 025F0C1F Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: a68b88ba80c756c6d3376b203e6367bb91a31999e76156b31795c67d9675c94e
Instruction ID: b4a42ff9ce9895c2ffe5ba4fff2723ef57966bec80769a80aa68cd0a44310415
Opcode Fuzzy Hash: a68b88ba80c756c6d3376b203e6367bb91a31999e76156b31795c67d9675c94e
Instruction Fuzzy Hash: 45A114B1D08A948AF7208628DC54BEB7B75EF81310F0480FAD54D97281D67E5BC5CF62

Function 025F1568 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 4dc115ffeb37aafbb2e463a6b0d351b07e23a2d30ee89e178fb50e0f0a8d98e4
Instruction ID: 2500e1dd25975d5ae3c61f2e1b9a1ab52bfb1a69f3a7696b11deb4d3d586d5d2
Opcode Fuzzy Hash: 4dc115ffeb37aafbb2e463a6b0d351b07e23a2d30ee89e178fb50e0f0a8d98e4
Instruction Fuzzy Hash: 54B144A1D08A948EF720CB28DC54BEB7B75EF91300F0481FAD54D97281D67A5AC5CF62

Function 025F1011 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 272
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: eb602ab7a5bd0a0f96ed443d38e08708acdc1dc6f3f35ce2c2f0980cf2525c6a
Instruction ID: b7a899d97010512ae843a5773e3bcb31ffab55ad80a2aa5f3b41362b4124b049
Opcode Fuzzy Hash: eb602ab7a5bd0a0f96ed443d38e08708acdc1dc6f3f35ce2c2f0980cf2525c6a
Instruction Fuzzy Hash: BFA123B1D08A94CAF7208628DC54BEB7B79EF81311F0484FAD54D9B280D67A4AC5CF66

Function 025F102F Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 267COMMON

Download Yara Rule

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 428ac052a11de3c078f9d5d5212d8a1d832b49f95c74f54b736ba9323b8c0072
Instruction ID: 9aaf9068e02ce2f328c63287398bb2e0b230c33533f524d7ebb98096081e0b22
Opcode Fuzzy Hash: 428ac052a11de3c078f9d5d5212d8a1d832b49f95c74f54b736ba9323b8c0072
Instruction Fuzzy Hash: 33A135A1D08A98CAF720C628DC54BEB7B79EF81311F0485FAD54D97280D67A4E85CF62

Function 025F1038 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 261COMMON

Download Yara Rule

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 03ab64d6063661881393cc00a5524f68bbb2e81e346ac86748cd5ec091c39a41
Instruction ID: a51679be02b918c84c090750d2227d021afca82756aeaf6b5052505ff1ed4e9a
Opcode Fuzzy Hash: 03ab64d6063661881393cc00a5524f68bbb2e81e346ac86748cd5ec091c39a41
Instruction Fuzzy Hash: 93A124A1D08A98CAF720C628DC54BEB7B79EF81311F0480FAD54D97280D67A4A85CF62

Function 025F0B2C Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 255COMMON

Download Yara Rule

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 6b39e11121b392127d06cf377709e9d89d143386aba3d7696546a4fe9b077b66
Instruction ID: 462682e2632d8591faae96c15b8f01cb2c60f5e53af5b4eda3fcde23c3d69b67
Opcode Fuzzy Hash: 6b39e11121b392127d06cf377709e9d89d143386aba3d7696546a4fe9b077b66
Instruction Fuzzy Hash: EDA123A1D08A94CAF720CA28DC54BEB7B75EF81310F0481FAD54D9B281D67A4B85CF66

Function 025F0B3F Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 252COMMON

Download Yara Rule

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 6ccafa5a5aee1c6d9ed91c0494dc628e9c5212c18d4d6f9c060404cd3aaaa9c1
Instruction ID: 87fc902dce17c25ad4ce076adfc84d3c0cc3cb2dcf6b6195095dd57fb4d47afa
Opcode Fuzzy Hash: 6ccafa5a5aee1c6d9ed91c0494dc628e9c5212c18d4d6f9c060404cd3aaaa9c1
Instruction Fuzzy Hash: 1DA123A1D08A94CAF720CB28DC54BEB7B75EF81310F0480FAD54D9B281D67A4B85CF66

Function 025F0BF7 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 251COMMON

Download Yara Rule

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: c3ba95c9985a528c8395025ee777458acef502c17568c998b85545f98975520e
Instruction ID: 754c89c3b9d1beeeaa4fb57900c5aa949df66466ec29ebe91f3f3f4e6f61e55d
Opcode Fuzzy Hash: c3ba95c9985a528c8395025ee777458acef502c17568c998b85545f98975520e
Instruction Fuzzy Hash: A8A115A1D08A94CAF720C728DC54BEB7B75EF81311F0480FAD54D9B281D67A4B85CF66

Function 025F176D Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 226threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 025F1C52

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 262c9e69a9af4f7a6771bf3a41cd071edb71207ecbf4ae50d51cc4e12f1610d1
Instruction ID: 95e82223ee598a739a58c38a4db2832b38ce4b78a13aec56d97b5baae4071804
Opcode Fuzzy Hash: 262c9e69a9af4f7a6771bf3a41cd071edb71207ecbf4ae50d51cc4e12f1610d1
Instruction Fuzzy Hash: C59113A1D08A98CAF720C728DC547EB7B76EF91300F0481FAD58D97281D67A5AC5CF26

Function 025F1BDF Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 215threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 025F1C52

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: f4366d7d480c33f4f1ba2575da66eff30d07d3e7dccff87c809ef680102040f6
Instruction ID: 0ccb0a9581f7b5cdc7ca06eeda8a976b90ff83b08010a78fc6fa23c3198e3244
Opcode Fuzzy Hash: f4366d7d480c33f4f1ba2575da66eff30d07d3e7dccff87c809ef680102040f6
Instruction Fuzzy Hash: 968123A1D08A988BF720C728DC547EB7B75EF91310F0480FAD54C972C1E6BA5A85CF66

Function 0266D9D8 Relevance: 21.4, APIs: 1, Strings: 13, Instructions: 378COMMON

Download Yara Rule

Strings

e, xrefs: 0266E114
t, xrefs: 0266E0F1
^S, xrefs: 0266DAF7
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
H8=C, xrefs: 0266DA44
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8
r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
i, xrefs: 0266E106

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: C$F$H8=C$W$^S$a$e$e$e$i$l$r$t
API String ID: 0-237805612
Opcode ID: 00c59835e8e1050ecda41eeea107b807dfeafe649c26c04a9c72a3e119238141
Instruction ID: 84e33b69c7c36dc27146422eb43f0a8463a6c52a88a0be91bb266a1a8f5ce981
Opcode Fuzzy Hash: 00c59835e8e1050ecda41eeea107b807dfeafe649c26c04a9c72a3e119238141
Instruction Fuzzy Hash: E5D135B2D041549FE7248A24DC58BFB7B79EB82310F1841BED84D56280EA795AC5CFA3

Function 0266D635 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 233COMMON

Download Yara Rule

Strings

e, xrefs: 0266E114
t, xrefs: 0266E0F1
^S, xrefs: 0266DAF7
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F;G=, xrefs: 0266D636
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8
r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
i, xrefs: 0266E106

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$F;G=$W$^S$a$e$e$e$i$l$r$t
API String ID: 2962429428-3879827509
Opcode ID: 6a0874f6a96ba9ad920a94acfb1c6de61c696c6c3bd7bfc6a37e03b425dc2eea
Instruction ID: 6929ccd2a11e3d727de4350b86b3063ee9fa45746a10c35e0f94a6c3d589d136
Opcode Fuzzy Hash: 6a0874f6a96ba9ad920a94acfb1c6de61c696c6c3bd7bfc6a37e03b425dc2eea
Instruction Fuzzy Hash: C68145B2D081649FF7248A24DC4CBFB7B69EB52310F1841FAD84D56281D6395AC6CBA3

Function 0266CFF4 Relevance: 20.1, APIs: 1, Strings: 12, Instructions: 564COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0266E09D

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
^S, xrefs: 0266DAF7
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$^S$a$e$e$e$i$l$r$t
API String ID: 2962429428-2762100914
Opcode ID: c2660635d0efa29323aea206999c3c5358ab896eddd1afe683cc5fb7140cfaa0
Instruction ID: 7c415c2d9035f0bd2f7d56dc8bd13a3ea1e16617b9b2777af22be193bdceac77
Opcode Fuzzy Hash: c2660635d0efa29323aea206999c3c5358ab896eddd1afe683cc5fb7140cfaa0
Instruction Fuzzy Hash: BC1238B2E041649FF7248A14DC98BFB7B79EB81314F1440FAD84D97280D6395EC6CE62

Function 0266D740 Relevance: 19.8, APIs: 1, Strings: 12, Instructions: 340COMMON

Download Yara Rule

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
^S, xrefs: 0266DAF7
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: C$F$W$^S$a$e$e$e$i$l$r$t
API String ID: 0-2762100914
Opcode ID: 3d8f094e8f90a333e05ed6f011ed24216db16322cda782de8138d18670aabaff
Instruction ID: f97a9a79bbc955d8df8f65836e15623a53060055f78abd5cbf12399c39905324
Opcode Fuzzy Hash: 3d8f094e8f90a333e05ed6f011ed24216db16322cda782de8138d18670aabaff
Instruction Fuzzy Hash: 00C105B2D041549FE7248A24DC58BFB7B79EB81310F1881FED84D56280EA795EC5CFA2

Function 0266D777 Relevance: 19.8, APIs: 1, Strings: 12, Instructions: 329COMMON

Download Yara Rule

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
^S, xrefs: 0266DAF7
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: C$F$W$^S$a$e$e$e$i$l$r$t
API String ID: 0-2762100914
Opcode ID: 9fdbb2f0118defb4edc0d81d104ee07fa9c9432a95b9f09d5718fd3e8c55a5fa
Instruction ID: 7eb8e3bfa5e1322231933f6f796427228ac9e6ffbe0f619561875f1b5f16773d
Opcode Fuzzy Hash: 9fdbb2f0118defb4edc0d81d104ee07fa9c9432a95b9f09d5718fd3e8c55a5fa
Instruction Fuzzy Hash: 6BB123B2D041549FE7248A24DC58BFB7B79EB81310F1881FED84D56280EA795EC5CFA2

Function 0266D8FE Relevance: 19.8, APIs: 1, Strings: 12, Instructions: 315COMMON

Download Yara Rule

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
^S, xrefs: 0266DAF7
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: C$F$W$^S$a$e$e$e$i$l$r$t
API String ID: 0-2762100914
Opcode ID: 9fefafab28df8df4b5e843904999e313636231e0d8ddd652684e5b72142e3c68
Instruction ID: 3f4c28ad9c4f3064c48f0c6378d4ae3dc797cf39c68615c033de8ff8bb0e5e97
Opcode Fuzzy Hash: 9fefafab28df8df4b5e843904999e313636231e0d8ddd652684e5b72142e3c68
Instruction Fuzzy Hash: F2B126A2D041645FF7248A24DC58BFB7B79EB81310F1881FED84D56680EA395EC5CBA2

Function 0266D93C Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 236COMMON

Download Yara Rule

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
^S, xrefs: 0266DAF7
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: C$F$W$^S$a$e$e$e$i$l$r$t
API String ID: 0-2762100914
Opcode ID: 96b7814d178f63d1576fa13cf4ae031935ecf2038c7d45d255c394c1c043f7cb
Instruction ID: 92401aff5483e21390c35c2fcd847941f17f5e112e22c3b8871ec7224a5282fb
Opcode Fuzzy Hash: 96b7814d178f63d1576fa13cf4ae031935ecf2038c7d45d255c394c1c043f7cb
Instruction Fuzzy Hash: EE8116B2E081549FF7248624DC48BFB7B79EB42314F1841FAD84D16681D6395AC5CFA3

Function 0266D643 Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 233COMMON

Download Yara Rule

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
^S, xrefs: 0266DAF7
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$^S$a$e$e$e$i$l$r$t
API String ID: 2962429428-2762100914
Opcode ID: 34729be37f6c3bd406fd90a105da1bcf0d4d4435e21c33022e09b02d02dc0367
Instruction ID: f0ac4596c856e78170d2d4474639b3ecce7c4d2ca4911124afb4a187fafd8852
Opcode Fuzzy Hash: 34729be37f6c3bd406fd90a105da1bcf0d4d4435e21c33022e09b02d02dc0367
Instruction Fuzzy Hash: 228145B2D081649FF7248A24DC4CBFB7B69EB52314F0841FAD84D56241D6395AC6CBA3

Function 0266D6E3 Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 228COMMON

Download Yara Rule

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
^S, xrefs: 0266DAF7
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$^S$a$e$e$e$i$l$r$t
API String ID: 2962429428-2762100914
Opcode ID: 2e23f332cf63429ca4a26cfec203cd53bf8d6e816ebed2cc19355ed3ad1b9437
Instruction ID: 21a7a2d134e7b46f626b04e03e69cffd520bbbe1619338c39d23658e69207ca0
Opcode Fuzzy Hash: 2e23f332cf63429ca4a26cfec203cd53bf8d6e816ebed2cc19355ed3ad1b9437
Instruction Fuzzy Hash: 817145B2D041649FF7248624DC4CBFB7B69EB82324F0841FAD84D56241D6395AD6CFA3

Function 0266D68A Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 215COMMON

Download Yara Rule

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
^S, xrefs: 0266DAF7
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$^S$a$e$e$e$i$l$r$t
API String ID: 2962429428-2762100914
Opcode ID: f805b92a8df69b882ac700561a16d1355f248f72cbfa867d9881f1a808b9ef1a
Instruction ID: d63135beb24a6b16e871fbf198dabeeea2358f79ef8566b5578116ad02e43e40
Opcode Fuzzy Hash: f805b92a8df69b882ac700561a16d1355f248f72cbfa867d9881f1a808b9ef1a
Instruction Fuzzy Hash: F77157B2D081A49BF7248624CC4CBFB7B69EB52314F0841FED88D56241D6395AC6CFA3

Function 0266D6A3 Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 204COMMON

Download Yara Rule

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
^S, xrefs: 0266DAF7
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$^S$a$e$e$e$i$l$r$t
API String ID: 2962429428-2762100914
Opcode ID: ff6721c2aa13f1da27ba2afcfea939601ae9df158979821c7f65d3d399faf5d2
Instruction ID: 42015c4d11165324d112faf97ddb9b32e468b8239cc183b4cbaeaec1ae1d67c8
Opcode Fuzzy Hash: ff6721c2aa13f1da27ba2afcfea939601ae9df158979821c7f65d3d399faf5d2
Instruction Fuzzy Hash: 066135B2D081A49BF7248624DC4CBFB7B69EB52314F0841FAD84D56281D6395AC6CFA3

Function 0266D3F8 Relevance: 18.2, APIs: 1, Strings: 11, Instructions: 217COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0266E09D

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$a$e$e$e$i$l$r$t
API String ID: 2962429428-2654231525
Opcode ID: 12d4ac92812902d35f11563bf134e8cec607426211f35c7d6c45573c4d62ab76
Instruction ID: bf8f96e514b5353f64015f9d4a9e736baef951ace2a50a7afe1500989a9891c2
Opcode Fuzzy Hash: 12d4ac92812902d35f11563bf134e8cec607426211f35c7d6c45573c4d62ab76
Instruction Fuzzy Hash: 5D7124B2D045649EFB248625DC88BFB7A79EB81310F0481FAD84C56681D63D5FC6CFA2

Function 0266CF4C Relevance: 18.2, APIs: 1, Strings: 11, Instructions: 209COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0266E09D

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$a$e$e$e$i$l$r$t
API String ID: 2962429428-2654231525
Opcode ID: 0963571aca47cc684f492eecebc47fdd7829cf7d167129590bc02a9dfd95ca83
Instruction ID: 0daa4b92ddfc69b635fcebea8c0d5121743e03b70cf1f4162b8e4f8fce435517
Opcode Fuzzy Hash: 0963571aca47cc684f492eecebc47fdd7829cf7d167129590bc02a9dfd95ca83
Instruction Fuzzy Hash: 027102B2D045649EF7248624DC8CBFBBB79EB81314F0480FAD84C56680D6395BC5CF62

Function 0266D3A3 Relevance: 18.2, APIs: 1, Strings: 11, Instructions: 206COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0266E09D

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$a$e$e$e$i$l$r$t
API String ID: 2962429428-2654231525
Opcode ID: d748881329fcc699b7eff3dbd0337168da592cad4379649b7d7258a8b5b846e7
Instruction ID: ce20e196e0fee3a89faf8dea2c3a5de7593d8d033f906db669dfdf1a71409261
Opcode Fuzzy Hash: d748881329fcc699b7eff3dbd0337168da592cad4379649b7d7258a8b5b846e7
Instruction Fuzzy Hash: 8B7127B2D085649AF7248624CC4CBFB7B39EB82314F0481FAD84D66681D6395FC5CFA2

Function 0266CFFF Relevance: 18.2, APIs: 1, Strings: 11, Instructions: 198COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0266E09D

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$a$e$e$e$i$l$r$t
API String ID: 2962429428-2654231525
Opcode ID: e07dcfd96d2cdcffd84f4207917f34735266ddea4115ee044be62df936208b28
Instruction ID: adc6d135d092ed245951475d9600139faad11ba5029857085e7177e8fa6b38ad
Opcode Fuzzy Hash: e07dcfd96d2cdcffd84f4207917f34735266ddea4115ee044be62df936208b28
Instruction Fuzzy Hash: 1F6124B2D081589AF7248624DC88BFB7B79EB81314F0481FAD84C56681D63D5FC6CFA2

Function 0266CF51 Relevance: 18.2, APIs: 1, Strings: 11, Instructions: 193COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0266E09D

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$a$e$e$e$i$l$r$t
API String ID: 2962429428-2654231525
Opcode ID: 4f5e601d6170a687474205e62f0dd72f00cc7031b49dcb9bd09c47f6c99f16a2
Instruction ID: 33ac3e273b9c96de3d2bbef2e8a54f6b9c88d5f63d96735dfb82c2a6efcf5c19
Opcode Fuzzy Hash: 4f5e601d6170a687474205e62f0dd72f00cc7031b49dcb9bd09c47f6c99f16a2
Instruction Fuzzy Hash: 0A6115B2D045649AF7248625DC4CBFBBB79EB81310F0481FAD84C56680D63D5BC5CF62

Function 025EAA05 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 401processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 025EBE3D

Strings

e|, xrefs: 025EAAF8
jjjj, xrefs: 025EBE2E
3, xrefs: 025EAB49

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: e|$jjjj$3
API String ID: 963392458-3664671931
Opcode ID: 3dba41fc32f6e05c665d24cecdc361cbec0803541761e3f51412b788bc7c96c6
Instruction ID: 316da7f59538240f5af058948c97cf7bf062741ec584898f82da4a9bd9dec851
Opcode Fuzzy Hash: 3dba41fc32f6e05c665d24cecdc361cbec0803541761e3f51412b788bc7c96c6
Instruction Fuzzy Hash: C5F19EB1D042699BEB288B14DD95BEAB7B5FF85304F0481FAD80EA3240D6799FC1CE51

Function 025E4863 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 391COMMON

Download Yara Rule

Strings

HOK8, xrefs: 025F938B
Qj@h, xrefs: 025F9A90

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: HOK8$Qj@h
API String ID: 0-1820051497
Opcode ID: c7aff2d1236d7e88610a91171504af3979652f6d5e6f6fdfdc99b12935a21c3c
Instruction ID: 1b72033d778d045be44fb88aaa5a767f3a2254f73b943e84cff3ecc87d7eadf5
Opcode Fuzzy Hash: c7aff2d1236d7e88610a91171504af3979652f6d5e6f6fdfdc99b12935a21c3c
Instruction Fuzzy Hash: 82E102B2D015259BEB648A15DC84BEBBB75FF80310F0440FAD90D66680E6785FC1CFA5

Function 025EA76F Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 251COMMON

Download Yara Rule

Strings

[W, xrefs: 025FF8DA
48G7, xrefs: 025FF852

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: 48G7$[W
API String ID: 0-2613270748
Opcode ID: a6b5139e280069978d9ca34c33c6342866b36cd27806f56c680c101bf1cfd011
Instruction ID: 0a506768f3b6120e6c6938e4b86a8e74ca6cc5fdad893f2c369a0284c21293e7
Opcode Fuzzy Hash: a6b5139e280069978d9ca34c33c6342866b36cd27806f56c680c101bf1cfd011
Instruction Fuzzy Hash: 4C8178B2D006145EF7148B64DC84BFB7779EB80310F1441FAD90DA6A80E67D6FC1CA66

Function 025E48D4 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240COMMON

Download Yara Rule

Strings

HOK8, xrefs: 025F938B
Qj@h, xrefs: 025F9A90

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: HOK8$Qj@h
API String ID: 0-1820051497
Opcode ID: 98066c8ae52f604843d6b1fd0d87446528c330490a37089092e9a8eb25c32d44
Instruction ID: 7e72365a8dceeb2f4bd53f959d58b057d972039ddc0cab00bff69659d07fc2d9
Opcode Fuzzy Hash: 98066c8ae52f604843d6b1fd0d87446528c330490a37089092e9a8eb25c32d44
Instruction Fuzzy Hash: CA910FB1D016698BEB688B18DC50BEABB75FB81304F0440FAD54EA7281E6385FC1CF55

Function 026683D9 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7
APMD, xrefs: 026683D9

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: APMD$Qh?
API String ID: 71445658-3826885610
Opcode ID: 167adee28c880babfaa74f7941a2c221eba143b42238af1e88efce5925f70ed0
Instruction ID: 927881980dace9c0d8b2bc515390265386814b822721e38c7c2b64b84e602fb2
Opcode Fuzzy Hash: 167adee28c880babfaa74f7941a2c221eba143b42238af1e88efce5925f70ed0
Instruction Fuzzy Hash: D87136A2D146249BF7208A24DC88BF77779EF91310F1440BAD94D97281D27D5FC6CBA2

Function 02666AD6 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 444COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Strings

:O=O, xrefs: 026672DF

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID: :O=O
API String ID: 4241100979-1235163547
Opcode ID: b7490c10584c8ba5c28c84b1d3d716211eac9895d26977e3e5d13635d7d9961f
Instruction ID: 5ac9027744b01eeca8d44894ee76b3f78c6c9f2f64b04097ef3c1261d550352c
Opcode Fuzzy Hash: b7490c10584c8ba5c28c84b1d3d716211eac9895d26977e3e5d13635d7d9961f
Instruction Fuzzy Hash: 0EF1C2F2D041649FF7258B14DC99BFAB779EB80314F1441FAE949A6240E6386FC2CA91

Function 025FE508 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 419COMMON

Download Yara Rule

Strings

[W, xrefs: 025FF8DA

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: [W
API String ID: 0-2887293924
Opcode ID: 135efd5f9b170df56fc45e8e61961e0456c4ac0460e2d60b1f62092de0cd6adc
Instruction ID: dd2ea9c14ea2a6b8c0cf52f90c6d6f80f0671a9a0a49639bbe1148e274bafb79
Opcode Fuzzy Hash: 135efd5f9b170df56fc45e8e61961e0456c4ac0460e2d60b1f62092de0cd6adc
Instruction Fuzzy Hash: DED158E2D142149AF7648A24EC49AFB7779FF80310F0441BAE90D97A80E6795FC1CB66

Function 026686F9 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 328COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: Qh?
API String ID: 0-2306691335
Opcode ID: b43673e0d0d64f63a420768b71839fe48d162405696a74acec7a03a0c9f5c81c
Instruction ID: e8388196c4ec51592e101fb87e6e8466cc66eda1d9c6b2a355ea86d55f8650cd
Opcode Fuzzy Hash: b43673e0d0d64f63a420768b71839fe48d162405696a74acec7a03a0c9f5c81c
Instruction Fuzzy Hash: 4DB12AA2D146289BF7248A24DC48BFB7779EF90310F0440BAD84D97280E67D5EC5CF66

Function 0266854F Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 321COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: Qh?
API String ID: 0-2306691335
Opcode ID: 48fd78297c41da2610b927695faf6bd15d34286bcc2f98b97441e76f891340ee
Instruction ID: c29056377bf9555acac9a3da86d97000bbe891ecde03bf179252df179dcc6696
Opcode Fuzzy Hash: 48fd78297c41da2610b927695faf6bd15d34286bcc2f98b97441e76f891340ee
Instruction Fuzzy Hash: 0EB139A2D046689AF7208B24DC88BFB7B75EF91310F0441FAD94D97281E67D1EC5CB62

Function 026035B9 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

MA=5, xrefs: 0260347E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: MA=5
API String ID: 0-87635094
Opcode ID: a6312808692b1f1b699c53d0535f4c5b76d37a8d75a27af7a8ae56b2ded731da
Instruction ID: 00a703a417adc857fce6794f4662f23ce6622d99952829a43fb8e9480420fc2e
Opcode Fuzzy Hash: a6312808692b1f1b699c53d0535f4c5b76d37a8d75a27af7a8ae56b2ded731da
Instruction Fuzzy Hash: CBB114F2E051249BE7288A14DC84AFB7779EFC1311F1481FAD80E96780E6785FD2CA52

Function 026683C8 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: f4f81889b03a9f5161e3f212acfe2d5f51fc9e55ad3ba89e5638efb347f5b5ae
Instruction ID: 8c8c511af1ff6a33ba7a0a1e64a4a7ab9819bdce11b6d61da4778dd7d4e5a21a
Opcode Fuzzy Hash: f4f81889b03a9f5161e3f212acfe2d5f51fc9e55ad3ba89e5638efb347f5b5ae
Instruction Fuzzy Hash: BE9137A2D146249BF7248A24DC88BF77779EF90310F0480BAD80D97281D27D5FC6CBA2

Function 025FE98E Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 261COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 025FFF17

Strings

LL<P, xrefs: 025FEA74

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID: LL<P
API String ID: 1726664587-2443076662
Opcode ID: 140d349709f0c188a45a753ea468bdd23ee5d111cf0563b88cae3c81dbf1d2af
Instruction ID: d5c6a29f415000909df1b510c9be8d6a9ea8187d0acae10591a4153ce7d8daaf
Opcode Fuzzy Hash: 140d349709f0c188a45a753ea468bdd23ee5d111cf0563b88cae3c81dbf1d2af
Instruction Fuzzy Hash: A19157F1C052659EE7608B60CC95AFABB74FF41310F1480FED98D96690E2396EC5CB62

Function 026682A4 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: Qh?
API String ID: 0-2306691335
Opcode ID: c3f54e879e29621184847182744fdc9b3c4e75ffabb6fa9adb560d714531102d
Instruction ID: ae27175cd5e597af0d9c46359e73a6d74bf1efc58a7f23f1ebfef4b66f950000
Opcode Fuzzy Hash: c3f54e879e29621184847182744fdc9b3c4e75ffabb6fa9adb560d714531102d
Instruction Fuzzy Hash: 19814AA2D006649BF7248A24DC48BF77A38EF91310F0441BAD94D976C1E67D5FC6CBA2

Function 02669A2F Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 253registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 5aa22d61769fb6425d8b90f67b7e038c0045611de96a62be7ff71977fbe81d6c
Instruction ID: 80b69f1c1b0d43b6b69f77199f25afc784650c53a1b798e7687403ee0b534357
Opcode Fuzzy Hash: 5aa22d61769fb6425d8b90f67b7e038c0045611de96a62be7ff71977fbe81d6c
Instruction Fuzzy Hash: AA8124B2C056249FF7288A14DC88BFBBB79EF44310F0441BADD4E66680E6391EC1CE52

Function 0266835C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 245COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: cc4ac58f0ea004a15037403d0605ae9a7d8642fae7b2974e8debeb759e1155f7
Instruction ID: 816ccdd1b8763ee5ad045cd037e9c354f2abf8f777ec39f62d08def3ae58f89d
Opcode Fuzzy Hash: cc4ac58f0ea004a15037403d0605ae9a7d8642fae7b2974e8debeb759e1155f7
Instruction Fuzzy Hash: BB8128A2D046249BF7208A24DC48BF77B39EF91310F1441BAD84DA7281D27D5FC6CBA2

Function 026697AE Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: Qh?
API String ID: 0-2306691335
Opcode ID: f188b4904d59c0088afb34655b009d17616b34ac658a029cb1d9d615047c51d4
Instruction ID: b99b48eb553dfcb8d144a4aaf9c2162949f061c86ef061494dc10c4191b7be18
Opcode Fuzzy Hash: f188b4904d59c0088afb34655b009d17616b34ac658a029cb1d9d615047c51d4
Instruction Fuzzy Hash: BE7125B2D156249EF7288A15DC88BFBBB78EF44311F0441BADD0E66280E6781EC1CF52

Function 026685B2 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: Qh?
API String ID: 0-2306691335
Opcode ID: 4d9858ad6bbb029d9ab5dbe0eaaf46d71c6d0f0bd1886e624933c3c2f9b6954d
Instruction ID: 1278313b2a039718437f41e42b23bf59d118bcf1338fbb1b0eb6a460edeaa240
Opcode Fuzzy Hash: 4d9858ad6bbb029d9ab5dbe0eaaf46d71c6d0f0bd1886e624933c3c2f9b6954d
Instruction Fuzzy Hash: C17139A2D042689BF7208A64DC88BFB7A79EF91310F0041BBD94D972C1D6795FC5CB62

Function 02668337 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: Qh?
API String ID: 0-2306691335
Opcode ID: cdf9eb6f4b8743255cdc78b4b680ae2e7960c797c81e83628a7952e3ad9dd269
Instruction ID: 6e145baa54ca789c1e58c769a3570f3809fbc965ba45ef8ba412cb806e46ec55
Opcode Fuzzy Hash: cdf9eb6f4b8743255cdc78b4b680ae2e7960c797c81e83628a7952e3ad9dd269
Instruction Fuzzy Hash: 997148A2D042649BF7248A24DC88BF77B35EF91310F0441BAD54D672C1E6795FC6CB62

Function 026697B8 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: Qh?
API String ID: 0-2306691335
Opcode ID: ef1f894bd7de6b5c5357bded858276bcb0d49cf3a38b8bbd6c22435cb5206894
Instruction ID: 21a5bc4fde54e950bf73d58fe1c2dae45f38773e627eedbbe7caade335ba1b96
Opcode Fuzzy Hash: ef1f894bd7de6b5c5357bded858276bcb0d49cf3a38b8bbd6c22435cb5206894
Instruction Fuzzy Hash: 7D7113B2D156249EF7288A14DC88BFBBB78EF45310F0441BADD4E66680E6781EC5CF52

Function 026697C5 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: Qh?
API String ID: 0-2306691335
Opcode ID: dbc7fcbb021754ba02121b2d7054a2945ad6d210af2909f92f1353d23594d1a3
Instruction ID: 517dc4573cf55b832b5b9e09ec6b5942f923f131bcfd10fb5b7c7938d90aedfe
Opcode Fuzzy Hash: dbc7fcbb021754ba02121b2d7054a2945ad6d210af2909f92f1353d23594d1a3
Instruction Fuzzy Hash: 547112B2D156249EF7288A14DC88BFBBB78EF44310F0441BADD4E66280E6781EC5CF52

Function 02669955 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: Qh?
API String ID: 0-2306691335
Opcode ID: 7df50ef1ead95016a3011bea91cbca48bf0bc159ba4a31cac764b7adb977cd33
Instruction ID: 9d4aac82701a5d7320011d3cee362fa46577089078641baf57ee677dd31e7786
Opcode Fuzzy Hash: 7df50ef1ead95016a3011bea91cbca48bf0bc159ba4a31cac764b7adb977cd33
Instruction Fuzzy Hash: 2E7117B2D056249EE7248B65DC88BFBBB75EF45311F0401BADC4D66281E6781EC1CFA2

Function 02668689 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 64e73b324a754662f6397a4c49ee7515b7ee6af3abf85df74695dbba4c72fa27
Instruction ID: f40bebb7a12ff33dad7fab7fe72f84440b48b285ab17b4c854cf456d5f5fed33
Opcode Fuzzy Hash: 64e73b324a754662f6397a4c49ee7515b7ee6af3abf85df74695dbba4c72fa27
Instruction Fuzzy Hash: 576137A2D04264ABF7208A64DC88BE77A79EF91310F0041BAD54D972C1D6795FC6CB62

Function 02668743 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: bdc32cf3d8bb217a39d6c2c2d29b6ab9e2e8835a8293f2f266288eec2ff1c12e
Instruction ID: 57d947996dc4da14bcb0f2b9446870fa4fac8eed0e9ffba1d1d160cc9835d132
Opcode Fuzzy Hash: bdc32cf3d8bb217a39d6c2c2d29b6ab9e2e8835a8293f2f266288eec2ff1c12e
Instruction Fuzzy Hash: CE6148A2D042649BF7208A64DC88BF77A39EF91310F0041BAD94D972C1D2795FC6CB63

Function 025F95B4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,00001000,00000040,?), ref: 025F9AA6

Strings

Qj@h, xrefs: 025F9A90

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ProtectVirtual
String ID: Qj@h
API String ID: 544645111-2762301250
Opcode ID: 3717cbc6e8c0853333f6f627db32d5dcb435c8902d2bf3379e64c43ca49130ac
Instruction ID: 0346a668a835caa0d714a0b958a16fbe7a4e57c96fde5624b7f3e646792cb6cc
Opcode Fuzzy Hash: 3717cbc6e8c0853333f6f627db32d5dcb435c8902d2bf3379e64c43ca49130ac
Instruction Fuzzy Hash: 9F7112B2D096189FE754CA28CC80AEAB7B9FF85300F1480FAD94D57685D6386EC1CE61

Function 02667155 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Part of subcall function 02667D28: CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 02667E45

Strings

:O=O, xrefs: 026672DF

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID: :O=O
API String ID: 4241100979-1235163547
Opcode ID: 8648a33ec8c010cb08e916d5a6a5ee664dab7af7847df3e183da176a33de1e3d
Instruction ID: c73b9dc7e0eac78755061f0cba3f568537f24a67d49cc22c4ec848f3ec3cfd0c
Opcode Fuzzy Hash: 8648a33ec8c010cb08e916d5a6a5ee664dab7af7847df3e183da176a33de1e3d
Instruction Fuzzy Hash: A0515BF2D041545FF7258A24DC89AFBBB79EF81314F0440BEE84D96640E539ABC6CE62

Function 02668B7F Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 173registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 613611480924e13e69686bd9e5aadd932961cdc189dc9b231654ba47b64b8a74
Instruction ID: a725ca0e9280250df2edd56f86651c7834a127ba03fa2ef27ed45b5a1cefcefd
Opcode Fuzzy Hash: 613611480924e13e69686bd9e5aadd932961cdc189dc9b231654ba47b64b8a74
Instruction Fuzzy Hash: DA5126A2D04268AAE7248B25CC58BFB7779EF81300F1040F9D98D67240E6785EC6CF62

Function 026695FC Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 167registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: fa11ac3b6f2baedc44f03ad66f4aeb87b5c5fc57b0ad4d4cf41d8eec483e9db4
Instruction ID: 82f6fbe6607a8a31f149bd361900a84896237fdff2bd06ba32ca2197cfa69fc4
Opcode Fuzzy Hash: fa11ac3b6f2baedc44f03ad66f4aeb87b5c5fc57b0ad4d4cf41d8eec483e9db4
Instruction Fuzzy Hash: 415105F3D106296FF3248A14DC88BF77A68EB91314F0540BAD90D66680D67D5FC18EA2

Function 02664AFD Relevance: 3.2, Strings: 2, Instructions: 677COMMON

Download Yara Rule

Strings

uCV, xrefs: 02664C36
BE?@, xrefs: 02664B51

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: BE?@$uCV
API String ID: 0-1269530686
Opcode ID: 7e20158170f11d7449429adae57f0f38aa0d1dbe5898be55dc8d1b8f63c02f0a
Instruction ID: fb99ac1309c5331736e0a11b89d34cd46664e627b01899bf07c6d70bf6ef148f
Opcode Fuzzy Hash: 7e20158170f11d7449429adae57f0f38aa0d1dbe5898be55dc8d1b8f63c02f0a
Instruction Fuzzy Hash: 3352B512E2466987DB78CB39DC116AFA2B3EF58300F05D4FD940DE7664F6704A899B0A

Function 02664A58 Relevance: 1.9, Strings: 1, Instructions: 678COMMON

Download Yara Rule

Strings

uCV, xrefs: 02664C36

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: uCV
API String ID: 0-3959665651
Opcode ID: 23d58b488787481adfdcf1e5d9fb0c6fd92abbf23af05cb47b6cb62d2484896d
Instruction ID: 5be224e718d0c6561667481bf28c5e092aab85c7bb65fb979a33879328525eb9
Opcode Fuzzy Hash: 23d58b488787481adfdcf1e5d9fb0c6fd92abbf23af05cb47b6cb62d2484896d
Instruction Fuzzy Hash: FB52B512E2466987DB78CB39DC116AFA2B3EF58300F05D4FD940DE7664F6704AC99B0A

Function 026649EA Relevance: 1.9, Strings: 1, Instructions: 670COMMON

Download Yara Rule

Strings

uCV, xrefs: 02664C36

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: uCV
API String ID: 0-3959665651
Opcode ID: 74a83ff51e6cb037361ef7cd7d432925d8366120107e6349fb4a6035ecb5944b
Instruction ID: 19c363f33c0c6ee0236730c862d008d5a4efe4fe7c4c8c63e99a3b8815b11aa8
Opcode Fuzzy Hash: 74a83ff51e6cb037361ef7cd7d432925d8366120107e6349fb4a6035ecb5944b
Instruction Fuzzy Hash: 4452C512E2466987DB78CB39DC116AFA2B3EF58300F05D4FD940DE7664F6704AC99B0A

Function 0266479B Relevance: 1.9, Strings: 1, Instructions: 664COMMON

Download Yara Rule

Strings

uCV, xrefs: 02664C36

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: uCV
API String ID: 0-3959665651
Opcode ID: c3de9c4c0d85e25a716f76ce3e7cb6f307d614f17d08f5a3893c167765f33851
Instruction ID: 3c82fceb85a017f8008ca74d83d5306541af25bfcae04f3da165a85cfcdaec70
Opcode Fuzzy Hash: c3de9c4c0d85e25a716f76ce3e7cb6f307d614f17d08f5a3893c167765f33851
Instruction Fuzzy Hash: F252B612E2466987DB78CB39DC1169FA2B3EF58300F05D4FD940DE7664F6704A899B0E

Function 0266481A Relevance: 1.9, Strings: 1, Instructions: 664COMMON

Download Yara Rule

Strings

uCV, xrefs: 02664C36

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: uCV
API String ID: 0-3959665651
Opcode ID: 4d4103673ccb6d33ac9df3bb48d9cfd2c2432435b8c4ba2e8ade471748871692
Instruction ID: 5f3f54c273c1a739ebd9890d84cac5f1404e0a6086b5feeec767870d7951a1c5
Opcode Fuzzy Hash: 4d4103673ccb6d33ac9df3bb48d9cfd2c2432435b8c4ba2e8ade471748871692
Instruction Fuzzy Hash: C952B512E2466987DB78CB39DC116AFA2B3EF58300F05D4FD940DE7664F6704A899B0E

Function 026647BA Relevance: 1.9, Strings: 1, Instructions: 651COMMON

Download Yara Rule

Strings

uCV, xrefs: 02664C36

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: uCV
API String ID: 0-3959665651
Opcode ID: 892c261b7b1d5bb0688400d1fff9cba0ae01cce9dd37d30fa1fe7d070eeec8b8
Instruction ID: e8069d1286fcc7ff1f9cf6331f804de045f082e095c2810cf200129a67b9b2ac
Opcode Fuzzy Hash: 892c261b7b1d5bb0688400d1fff9cba0ae01cce9dd37d30fa1fe7d070eeec8b8
Instruction Fuzzy Hash: CE52B512E2466987DB78CB39DC1169FA2B3EF58300F05D8FD940DE7664F6704A899B0E

Function 02664B81 Relevance: 1.9, Strings: 1, Instructions: 645COMMON

Download Yara Rule

Strings

uCV, xrefs: 02664C36

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: uCV
API String ID: 0-3959665651
Opcode ID: 8be073f0a1baad99046e8a43ec4a45ab7dc1f7d127048612cfb83b5a67bbf133
Instruction ID: c6da4a4dac591d15c24a711ba80f8303f9594ad5aff4b51d79e43adb7a9f4c0a
Opcode Fuzzy Hash: 8be073f0a1baad99046e8a43ec4a45ab7dc1f7d127048612cfb83b5a67bbf133
Instruction Fuzzy Hash: 6C52B512E2466987DB78CB39DC1169FA2B3EF58300F05D8FD940DE7664F6704A899B0E

Function 0266788D Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Part of subcall function 02667D28: CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 02667E45

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: e4060d40adc3fd9f9ed1e4c773bfb6e8265e28c089cea169c4f019777d9c2072
Instruction ID: aa222cf1bdf92c42e798bdf789b9c44d54de58644ca6f9a4f45aa97e301313ee
Opcode Fuzzy Hash: e4060d40adc3fd9f9ed1e4c773bfb6e8265e28c089cea169c4f019777d9c2072
Instruction Fuzzy Hash: FA81C0B1D006699FEB24CB14DC98BFABBB5EB44304F1481FAD909A7241D638AFC1CE55

Function 02603955 Relevance: 1.7, APIs: 1, Instructions: 177threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 02603D9D

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: abcf63d8226c3dbeb080eb768e63af40779c3bb78f66a8427a3b78640d74467b
Instruction ID: df9d4b7d41c8c8cfcdd98cc4638f72901962cf20bde09275c0f3000ca053b8c9
Opcode Fuzzy Hash: abcf63d8226c3dbeb080eb768e63af40779c3bb78f66a8427a3b78640d74467b
Instruction Fuzzy Hash: 7D51D4B1D041289BE728CA15CDC4EEBB775EF85315F0481FAD90D66780DA386ED2CE91

Function 02603A1D Relevance: 1.7, APIs: 1, Instructions: 157threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 02603D9D

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 341ff460e2f77d12f63157f66db0c08ed40ac0c723c1733ba32e94161a2d06eb
Instruction ID: 13d8a58adc88bfb5a88380dfcf50c672c9d910c7d35814d8a7a88c5f2a7c242b
Opcode Fuzzy Hash: 341ff460e2f77d12f63157f66db0c08ed40ac0c723c1733ba32e94161a2d06eb
Instruction Fuzzy Hash: 6951E4B1D041188BEB28CA15CD91AEBB775EB81301F0481FAD90E67780D678AFD2CF51

Function 025E65E7 Relevance: 1.6, APIs: 1, Instructions: 315memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 025E6AF4

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 93444332c1aa5a8f9d50233748abbb2f679c7cd79ccba3a6c88cbf5bd95cd00f
Instruction ID: cb8cce624b28b0bfd0cddc19eb89a3c285de4a0380e7885faa09f06ef7c7c9f0
Opcode Fuzzy Hash: 93444332c1aa5a8f9d50233748abbb2f679c7cd79ccba3a6c88cbf5bd95cd00f
Instruction Fuzzy Hash: F6B1DEB2D005249FFB288A04DC94BFB7B79FB90354F1481FAD90E56680DA385EC5CE96

Function 025E5992 Relevance: 1.5, APIs: 1, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 11af34889a470fcc8d3430187de7d69d5551f8e1e489104c391bd929b849914f
Instruction ID: 43326b6547a9596237ce74ba411255a736c7e0474260ff41dd57f69129849960
Opcode Fuzzy Hash: 11af34889a470fcc8d3430187de7d69d5551f8e1e489104c391bd929b849914f
Instruction Fuzzy Hash: 5D7120F2C001159FFB288A14DC99BFB7B69FB90318F1441FAD90A96180D7795EC6CE16

Function 025E573A Relevance: 1.4, APIs: 1, Instructions: 199memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 025E6AF4

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fc6b240b6f351846ffd7a7794550524a6f3ac805bb9cb14504d8c3c7ee1fbdb1
Instruction ID: 977ece7d310fe28d597abec8acd61c2fbd2067633e18065c5cdf1b1ed5d77367
Opcode Fuzzy Hash: fc6b240b6f351846ffd7a7794550524a6f3ac805bb9cb14504d8c3c7ee1fbdb1
Instruction Fuzzy Hash: 6D6133B2C041199EFB288A10EC98BF7776DFB90358F1441BAD80A966C0D77D5EC4CE56

Function 0266464D Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6cd54db9be411a05a742f554497d9800039274be18cd1bdd1adc06b5a97e37
Instruction ID: 030000cdb02d69d31ec4b867f1090daf53d22426b582100dc708646206e9453b
Opcode Fuzzy Hash: fb6cd54db9be411a05a742f554497d9800039274be18cd1bdd1adc06b5a97e37
Instruction Fuzzy Hash: 6D42A512A2466987DB78DB79DC1129FA2B3EF58300F04D8FD940DE7664F6704AC99B0E

Function 02664C48 Relevance: .6, Instructions: 589COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 498e567e7dbefb98ab3da0dd403db206ebe1e9db4f5ba87e310e0d4cf3e87e22
Instruction ID: 199088dfb531efa13309c6e59d16ca0a6d7bc37a9ce801aefdb1afdd0adae4c5
Opcode Fuzzy Hash: 498e567e7dbefb98ab3da0dd403db206ebe1e9db4f5ba87e310e0d4cf3e87e22
Instruction Fuzzy Hash: 9E429412A2466987DB78DB79DC1129FA2B3AF58300F04D8FD940DE7664F6704A899B0E

Function 02664D11 Relevance: .6, Instructions: 584COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ff73659fe7e3f0c7468fab5d9e9dcf90faffb637ec7c4c2459f30e688cc82c
Instruction ID: 9bdddbe948fa03a7417f7104a761f9d8d76aa7b68ce3120afb97be612c284933
Opcode Fuzzy Hash: 07ff73659fe7e3f0c7468fab5d9e9dcf90faffb637ec7c4c2459f30e688cc82c
Instruction Fuzzy Hash: 5A42A412A2466987DB78CB79DC1129FA2B3EF58300F04D8FD940DE7664F6704AC99B0E

Function 02664D22 Relevance: .6, Instructions: 582COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5aeab3714a05b3a0dae3d9a99c49b617bd5c1769e61475138dde2c4926b365
Instruction ID: 6e2ff7cdea0e98dbd85c3a0d6c5f81dc4dcf9f4d3aa6c70ec031abc710f0b1fa
Opcode Fuzzy Hash: 9e5aeab3714a05b3a0dae3d9a99c49b617bd5c1769e61475138dde2c4926b365
Instruction Fuzzy Hash: 5E42A312A2466987DB78CB79DC1129FA2B3EF58300F04D8FD940DF7664F6704A899B0E

Function 02664C5A Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2102b9983f4e5aad6f780c3bb305f90e62864f9985524531b830f2548971782
Instruction ID: 95e50642ab74a282c46c7936d4cb4b902189b3e9483688fecc6109fb5251bb28
Opcode Fuzzy Hash: f2102b9983f4e5aad6f780c3bb305f90e62864f9985524531b830f2548971782
Instruction Fuzzy Hash: 2A429412A2466987DB78DB79DC1129FA2B3AF58300F04D8FD940DF7664F6704AC99B0E

Function 02664672 Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa28c16bd5c256e6bb1e9407130cf279fec226ada43d4b248d4ca1568f9c8d07
Instruction ID: e155a5eb197ec93464d528eef020e5faf95454865efb7ef8ff87e970bf370559
Opcode Fuzzy Hash: fa28c16bd5c256e6bb1e9407130cf279fec226ada43d4b248d4ca1568f9c8d07
Instruction Fuzzy Hash: 19429412A2466987DB78DB79DC1129FA2B3EF58300F04D8FD940DE7664F6704AC99B0E

Function 02664DA7 Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b8f89c78f365d4ba023b48e339609bc778936a7baa0c0225d04682052b6e89
Instruction ID: 58cbaeb18998b5173a8801c8872933f8955c88bac099a1fd603b4b249b23e86f
Opcode Fuzzy Hash: 37b8f89c78f365d4ba023b48e339609bc778936a7baa0c0225d04682052b6e89
Instruction Fuzzy Hash: 81429312A2466987DB78DB79DC1129FA2B3AF58300F04D8FD940DF7664F6704AC99B0E

Function 02665172 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac0700508e457a88d76806ff6e9a546318000cdd52a18213e7c793b4d9c6468
Instruction ID: 1e346ac22f926a0d72e3d45a34440e40e767742f44e70f8fcda27d754cf9a12a
Opcode Fuzzy Hash: fac0700508e457a88d76806ff6e9a546318000cdd52a18213e7c793b4d9c6468
Instruction Fuzzy Hash: 4F429312A2466987DB78DB79DC1129FA2B3AF58300F04D8FD940DF7664F6704AC99B0E

Function 02664DAC Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 470462819948c91e2f6baf302f4ac4256563253d9730faf572d35be2f27591d7
Instruction ID: 38fabeac188fee7d45c005d42cc4da9c6197b93b09d0988ccfc83a28555125d3
Opcode Fuzzy Hash: 470462819948c91e2f6baf302f4ac4256563253d9730faf572d35be2f27591d7
Instruction Fuzzy Hash: 76429312A2466987DB78DB79DC1129FA2B3AF58300F04D8FD940DE7664F6704A899B0E

Function 02664C92 Relevance: .6, Instructions: 576COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6431742f447d855927a9c7bea5268b0ba3367f8daed63d1cfa17a3f6bf0ef4
Instruction ID: 0348b4b023edc7e27ebb442790926a6513d06457c939fa4ea049722cb45cb25d
Opcode Fuzzy Hash: 3e6431742f447d855927a9c7bea5268b0ba3367f8daed63d1cfa17a3f6bf0ef4
Instruction Fuzzy Hash: B2429312A2466987DB78DB79DC1129FA2B3AF58300F04D8FD940DF7664F6704A899B0E

Function 02663E0B Relevance: .6, Instructions: 575COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea489bf442f2e2140d18fc83fb3d288ef5cbf678d14eca11dcdfaa47c780e6a
Instruction ID: fa29968a63d574e83ccacf219ccb7519236a7f996cd925c88243ae80ddf8cc71
Opcode Fuzzy Hash: 4ea489bf442f2e2140d18fc83fb3d288ef5cbf678d14eca11dcdfaa47c780e6a
Instruction Fuzzy Hash: 76429312A2466987DB78DB79DC1129FA2B3AF58300F04D8FD940DE7664F6704AC99B0E

Function 025F16BF Relevance: 35.2, APIs: 1, Strings: 19, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
7C=X, xrefs: 025F16C1
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: 7C=X$M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3634595442
Opcode ID: bf5b08b61f1f49335c4ba1961894fdaa3af5ef3f80f58a27d04ca77409556135
Instruction ID: d2db50670711ecb9c5d67c7f9647e65381f8d468cfade8a484a70cafa1d0479c
Opcode Fuzzy Hash: bf5b08b61f1f49335c4ba1961894fdaa3af5ef3f80f58a27d04ca77409556135
Instruction Fuzzy Hash: C19102A1D08A988EF721C728DC547EB7B75EF91300F0480FAD54D97281E6BA5AC5CF26

Function 025F10A8 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 230COMMON

Download Yara Rule

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: db7eb60b99b1cdce69def50a63989aa54ac694bb237113558e5e1f59828d6909
Instruction ID: a694d73d3b35fd312532a1e806cefcb3ddf75005ce7feaf0e32571dd5d33d38d
Opcode Fuzzy Hash: db7eb60b99b1cdce69def50a63989aa54ac694bb237113558e5e1f59828d6909
Instruction Fuzzy Hash: D99115A1D08A94CAF720CB28DC54BEB7B75EF81300F0440FAD54D9B281D67A5B85CF66

Function 025F16F0 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 216threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 025F1C52

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: eb34d95d95800202ab416b5984b4af080cc07e3db2fcd57dd2615fdc96d9259e
Instruction ID: d84b7a41671b776f9b18bfbb093b60b99812e5eead752b5d09271a112527cb9e
Opcode Fuzzy Hash: eb34d95d95800202ab416b5984b4af080cc07e3db2fcd57dd2615fdc96d9259e
Instruction Fuzzy Hash: DB8124A1D08A988EF721CB28DC547EB7BB5EF81300F0440FAD54C9B291D67A5AC5CF22

Function 025F0864 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 215threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 025F1C52

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 23c4838bbbab62424123fe109bb222c9ea99670f931ba2b2bea959848843be8a
Instruction ID: 40f4877b9b9737d294e50635e4d185539b569dcfef6617b18da5817366548d12
Opcode Fuzzy Hash: 23c4838bbbab62424123fe109bb222c9ea99670f931ba2b2bea959848843be8a
Instruction Fuzzy Hash: 1781F5A1D08A948AF720C628DC147EB7B75EF91301F0480FAD54D972C1E6BE5A85CF66

Function 025F183E Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 208threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 025F1C52

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 2ce7c5bcb4186651efda36c16a3f51d79a116bc30f7e7bf0a099a578f207d204
Instruction ID: 60554824a66f7389bf9bc114af5c2158ca96b732a16f0fc0c73487dfd25b06ed
Opcode Fuzzy Hash: 2ce7c5bcb4186651efda36c16a3f51d79a116bc30f7e7bf0a099a578f207d204
Instruction Fuzzy Hash: 218123A1D08A948AF720C728DC54BEB7B75EF91301F0440FAD54D9B281E6BA5BC5CF26

Function 025F17B2 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 208threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 025F1C52

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 6cf07029c6afb5e60930422e282b57c01c388124ddf09f8b1a2e7bf0a2b2e766
Instruction ID: b5e72cd4a13c72e35c7aa2583a1e2417bf4660724cf597a2a391997a8689cc5d
Opcode Fuzzy Hash: 6cf07029c6afb5e60930422e282b57c01c388124ddf09f8b1a2e7bf0a2b2e766
Instruction Fuzzy Hash: 108123A1D08A98CAF721C728DC547EB7B76EF91300F0480FAD54D97281D67A5AC5CF26

Function 025F17BB Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 206threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 025F1C52

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 0ff6de46a3414543cb7f0df893307e144931cbdfd716928f3cd0b777ba6b7b2f
Instruction ID: d48e65f5ead60de5fe0bab67f3435678755f64823eec3ab916024491564153e7
Opcode Fuzzy Hash: 0ff6de46a3414543cb7f0df893307e144931cbdfd716928f3cd0b777ba6b7b2f
Instruction Fuzzy Hash: DB8122A1D08A988AF720C728DC547EB7B75EF91300F0480FAD54D9B281D67E5A85CF26

Function 025F10FF Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 205threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 025F1C52

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 6c0707995ebd23d25e52c71895fac481955ae37f310cd51f85951da0009297ef
Instruction ID: de4fd9d70a6475d221df6d056611bcea98e25b970e8360df6e2ad581c2b83f33
Opcode Fuzzy Hash: 6c0707995ebd23d25e52c71895fac481955ae37f310cd51f85951da0009297ef
Instruction Fuzzy Hash: F08114A1D08A94CAF720C728DC547EB7B75EF91301F0480FAD54D9B281D6BE5A85CF26

Function 025F1703 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 204threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 025F1C52

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: b4628df3ade875b58f57b8968671842ecf493c8174b45dc6aa282c95754c1a57
Instruction ID: b0d1088f8a2d0dc6ba1dccbe81fe61950df8d7625090174cd12efe394ad6283c
Opcode Fuzzy Hash: b4628df3ade875b58f57b8968671842ecf493c8174b45dc6aa282c95754c1a57
Instruction Fuzzy Hash: 288103A1D08A988AF720C728DC547EB7B75EF91301F0440FAD54D97281E6BA5F85CF26

Function 025F1735 Relevance: 33.4, APIs: 1, Strings: 18, Instructions: 200threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 025F1C52

Strings

o, xrefs: 025F1D11
r, xrefs: 025F1D18
m, xrefs: 025F1D0A
e, xrefs: 025F1CE7
e, xrefs: 025F1D03
s, xrefs: 025F1CF5
R, xrefs: 025F1CAF
y, xrefs: 025F1D1F
M, xrefs: 025F1CFC
d, xrefs: 025F1CC4
r, xrefs: 025F1CD2
o, xrefs: 025F1CD9
P, xrefs: 025F1CCB
s, xrefs: 025F1CEE
a, xrefs: 025F1CBD
e, xrefs: 025F1CB6
c, xrefs: 025F1CE0
MIMK, xrefs: 025F1DBD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: M$MIMK$P$R$a$c$d$e$e$e$m$o$o$r$r$s$s$y
API String ID: 983334009-3061001137
Opcode ID: 6c549fdd83ce4fa6faef8d5ee1ebda0060369e573b31a995d64be48a2a7bdf62
Instruction ID: 948e6b043dea83f16162e4e53e584b2fc6befe2f4ec1fe950ab408ff685c551a
Opcode Fuzzy Hash: 6c549fdd83ce4fa6faef8d5ee1ebda0060369e573b31a995d64be48a2a7bdf62
Instruction Fuzzy Hash: 578113A1D08A98CAF720C728DC547EB7B75EF91300F0440FAD54D97281D6BA5A85CF26

Function 0266C145 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,?,00000000,00000001,?,?,?,?,?,0266BA35,?,?,?), ref: 0266C1BF

Strings

s, xrefs: 0266C1DA
e, xrefs: 0266C1E1
C, xrefs: 0266C1C5
n, xrefs: 0266C1F6
H, xrefs: 0266C1E8
o, xrefs: 0266C1D3
l, xrefs: 0266C204
a, xrefs: 0266C1EF
e, xrefs: 0266C20B
d, xrefs: 0266C1FD
l, xrefs: 0266C1CC

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Value
String ID: C$H$a$d$e$e$l$l$n$o$s
API String ID: 3702945584-2848555115
Opcode ID: cbef2520bba153b37245a345eb1ee0d53128b10a4a4e7e34548f024ea34203ee
Instruction ID: d8ba575165e4552f637fad663ce71e82a975fde16f369d0369d7e0e4673188ea
Opcode Fuzzy Hash: cbef2520bba153b37245a345eb1ee0d53128b10a4a4e7e34548f024ea34203ee
Instruction Fuzzy Hash: 2D319570C04A988ADB28CA18CC587EBBBB5EB51706F0440EA958897281D67A4FC6CF21

Function 0266DB24 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 144COMMON

Download Yara Rule

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$a$e$e$e$i$l$r$t
API String ID: 2962429428-2654231525
Opcode ID: 1bc4ff69569e447e81788698f77d4a667e7364999969ad586fae02f950d619ca
Instruction ID: fa22b78ea57256f8b2d06771be78e4984f0acf433ba98ab6a00dcb01b313632c
Opcode Fuzzy Hash: 1bc4ff69569e447e81788698f77d4a667e7364999969ad586fae02f950d619ca
Instruction Fuzzy Hash: BC412572D085A49BE7248624CC4CBFB7F75AB92310F0841FED88D16241D6395AC6CF63

Function 0266E025 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 143COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0266E09D

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$a$e$e$e$i$l$r$t
API String ID: 2962429428-2654231525
Opcode ID: 8c84eb2498c86c831e44ad618b3076780d47a53b7a973434160624bcbf70a3fd
Instruction ID: 44ec404572e90e5fc93d5f3c2f024e3f420d309a822e663b10a715212c312a32
Opcode Fuzzy Hash: 8c84eb2498c86c831e44ad618b3076780d47a53b7a973434160624bcbf70a3fd
Instruction Fuzzy Hash: 205124B2D081989FE7248624DC4CBFB7B79DB42314F0841FAD84C16281D63A5ED68B62

Function 0266DBE6 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 142COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0266E09D

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$a$e$e$e$i$l$r$t
API String ID: 2962429428-2654231525
Opcode ID: 9aeb634126e464a417390af33ae9a276c8398577c5f151e692fc43bb257f99b8
Instruction ID: 3a25e879331c9abf391c06addf8c60bbabb7fca19e9bea1fb4473967eecfd0d9
Opcode Fuzzy Hash: 9aeb634126e464a417390af33ae9a276c8398577c5f151e692fc43bb257f99b8
Instruction Fuzzy Hash: AC4105B2D081A49FF7248624DC4CBEB7B69AB52314F0841FAD84C16641D63A5FD6CF63

Function 0266DBDF Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 142COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0266E09D

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$a$e$e$e$i$l$r$t
API String ID: 2962429428-2654231525
Opcode ID: a5389604e7e75adf474e2d26d3ac21f29f28ff98541596f2f3c9b5f9bcc8bc35
Instruction ID: 867c010ae068b0b7bd565441fd0354e74710bf58ee9e2a6c62610a77605af0ad
Opcode Fuzzy Hash: a5389604e7e75adf474e2d26d3ac21f29f28ff98541596f2f3c9b5f9bcc8bc35
Instruction Fuzzy Hash: 0D41F4B2D081A49BE7248624DC4CBEB7B699B52314F0841FAD84C16641D63A5FD6CBA3

Function 0266CCBF Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 140COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0266E09D

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$a$e$e$e$i$l$r$t
API String ID: 2962429428-2654231525
Opcode ID: 555ebb2c78ca7e751645a3c70289a98963d1babe1acb9d1b93f300c726800cf5
Instruction ID: 08c50140240d2150905e6230b9b1c7c994cd72e45b20e96fda8fb61aa254329a
Opcode Fuzzy Hash: 555ebb2c78ca7e751645a3c70289a98963d1babe1acb9d1b93f300c726800cf5
Instruction Fuzzy Hash: 45412762D085A49AF7248624DC4CBEB7E25DB52314F0841FAD84C16681D63A5BD5CBA3

Function 0266DB4C Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 131COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0266E09D

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$a$e$e$e$i$l$r$t
API String ID: 2962429428-2654231525
Opcode ID: f57878aa0251c2b76495e3a0355d15fdbd722b7843ba6bdf00a1748985cce884
Instruction ID: cdf623041d5011fd5913d05faf420f4b262f177aaf59454889392a084223bcec
Opcode Fuzzy Hash: f57878aa0251c2b76495e3a0355d15fdbd722b7843ba6bdf00a1748985cce884
Instruction Fuzzy Hash: 67412672D085A89FE7248624CC4CBFB7B75EB52310F0441EAD84C56241D6395BD5CF62

Function 0266E04C Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 131COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0266E09D

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$a$e$e$e$i$l$r$t
API String ID: 2962429428-2654231525
Opcode ID: bd52a6b4f6fe0edd6ff13beabf53667afb404ee7a5e905785d05ab6062f3e9f8
Instruction ID: 312139fc944f5118c034d48a40b317707233c3ddcc8fa92c32362a68a933358a
Opcode Fuzzy Hash: bd52a6b4f6fe0edd6ff13beabf53667afb404ee7a5e905785d05ab6062f3e9f8
Instruction Fuzzy Hash: 7D412676D085949FEB248624CC4CBFB7B75EB82310F0441FAD84C16681D63A5BD6CF62

Function 0266DC92 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 130COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0266E09D

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$a$e$e$e$i$l$r$t
API String ID: 2962429428-2654231525
Opcode ID: d29299a2858a487889b8c10b5bc62c567a88827b6e0d4df4337995951086fa90
Instruction ID: dc13eab23cbe4c4a8b04fff4a317af1c379f26fcca671f0577beb2915d3b58d5
Opcode Fuzzy Hash: d29299a2858a487889b8c10b5bc62c567a88827b6e0d4df4337995951086fa90
Instruction Fuzzy Hash: 3F411476D085A89FEB248624CC4CBFB7B75AB92310F0441FED88C16641D63A5BD5CF62

Function 0266E05B Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 129COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0266E09D

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$a$e$e$e$i$l$r$t
API String ID: 2962429428-2654231525
Opcode ID: f9e346c2e89f0537d4b5c67fb704638c1b343bb696ac10321ff18a756b12a826
Instruction ID: 8c97a28028d9ad36527d0d65c9949d40dc276429160c5103538ed71db7a49a17
Opcode Fuzzy Hash: f9e346c2e89f0537d4b5c67fb704638c1b343bb696ac10321ff18a756b12a826
Instruction Fuzzy Hash: 6F412672D085A88FEB248624CC4CBFBBB75DB82310F0441FAD84C16641D63A5BD6CF62

Function 0266DC87 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 129COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0266E09D

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$a$e$e$e$i$l$r$t
API String ID: 2962429428-2654231525
Opcode ID: a9f0259b580f5ddedbd784bdd0bddb6f1970d8d654decb34d67e0f31ea2598a9
Instruction ID: 47a4d39aea0ccf0b94513d0f5d8f550d60e0a731213bc79072ccade8b53574b1
Opcode Fuzzy Hash: a9f0259b580f5ddedbd784bdd0bddb6f1970d8d654decb34d67e0f31ea2598a9
Instruction Fuzzy Hash: BE412572D081A88FEB248628DC4CBFB7B759B42310F0441FAD84C16641DA3A5BD6CF63

Function 0266DB7B Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 125COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0266E09D

Strings

r, xrefs: 0266E0DC
C, xrefs: 0266E0D5
W, xrefs: 0266E11B
e, xrefs: 0266E114
i, xrefs: 0266E106
t, xrefs: 0266E0F1
l, xrefs: 0266E10D
e, xrefs: 0266E0E3
F, xrefs: 0266E0FF
a, xrefs: 0266E0EA
e, xrefs: 0266E0F8

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CloseHandle
String ID: C$F$W$a$e$e$e$i$l$r$t
API String ID: 2962429428-2654231525
Opcode ID: 186b481fa8fff59492b683387c446c8e19f02964b8e9c8b2395c442cf51e0ebd
Instruction ID: 1a9421251be0fd9f44fea4378332e9620be5935b5ffdf7cf77076585a7d632ea
Opcode Fuzzy Hash: 186b481fa8fff59492b683387c446c8e19f02964b8e9c8b2395c442cf51e0ebd
Instruction Fuzzy Hash: BE411476D081A89FEB248624CC4CBEB7B75AB52310F0441EAD84C56641D63A5BD5CF62

Function 025FEB1C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 150COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 025FFF17

Strings

23HP, xrefs: 025FEDA7
3, xrefs: 025FEC37
e|, xrefs: 025FEBE6

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID: 23HP$e|$3
API String ID: 1726664587-2865655517
Opcode ID: 885aeaa3b46716b2708c94a56eb1deb35aa8dc26139e4152923be4ed88c0baa8
Instruction ID: eb10d7525c9efbba8a64ccbb0ec9c80a63c879d0a10e1f3d38f73707bc2eac60
Opcode Fuzzy Hash: 885aeaa3b46716b2708c94a56eb1deb35aa8dc26139e4152923be4ed88c0baa8
Instruction Fuzzy Hash: E16168B4D093688AEB25CB18CC996E9BBB1BF48300F0081EAE94DA2251E7355FC5CF55

Function 02668CED Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 134registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7
e|, xrefs: 02668DE1
3, xrefs: 02668E32

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?$e|$3
API String ID: 71445658-1848868468
Opcode ID: 43adf9ce3df25287de86ff1f92c1a20395fa8c7c4a7a0c0e2f1928a3ddad7e39
Instruction ID: db0f03af62ebd09748b7898e2897b6a4b6691891e6c5e80dc6b974ff9f15ae46
Opcode Fuzzy Hash: 43adf9ce3df25287de86ff1f92c1a20395fa8c7c4a7a0c0e2f1928a3ddad7e39
Instruction Fuzzy Hash: 4E616BB4D056688AEB25CF28CC456E9BBB5AF98344F0482E9E44CA3341EB314FC5CF51

Function 025E4A3F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

HOK8, xrefs: 025F938B
Qj@h, xrefs: 025F9A90

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: HOK8$Qj@h
API String ID: 0-1820051497
Opcode ID: 5797d47e3d45096d2ab2e2a3f614386586d4d7beb0c27eb8db74e82377ebf8cd
Instruction ID: fb9004fbbd1b1258e13db13c6124cfea7d7239d9694d678260cbdbda55f6babf
Opcode Fuzzy Hash: 5797d47e3d45096d2ab2e2a3f614386586d4d7beb0c27eb8db74e82377ebf8cd
Instruction Fuzzy Hash: D86144B2D056684BEB648A14DC54BEABB76FB81314F0480FAD94E67281E2386FC1CF55

Function 025FCC3F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 139injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 025FE04F

Strings

e|, xrefs: 025FCD0F
3, xrefs: 025FCD60

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: e|$3
API String ID: 3559483778-1726640827
Opcode ID: 37a8176889d54da0810ae87b4cd2c319062a7f4580416b6c1f5b7cec5845b3c7
Instruction ID: 0caa5170f12efc80b0c2c45f60f4b50940f4a7f0147ad6a16ae8aae29bbbfed6
Opcode Fuzzy Hash: 37a8176889d54da0810ae87b4cd2c319062a7f4580416b6c1f5b7cec5845b3c7
Instruction Fuzzy Hash: C26125B5D086698BDB25CB18CD84AEABBB5BF88301F0041EA990DA2350E7745FC6CF15

Function 025FF376 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 226COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 025FFF17

Strings

[W, xrefs: 025FF8DA

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID: [W
API String ID: 1726664587-2887293924
Opcode ID: bec1b086f5ef79acea4f300e557c00f465b246422cf87361c0fa5fcc1a3c6acc
Instruction ID: 21e2779b9d5713760c556467381bf48c95c40c87e0398105cf050fbf8b90edb6
Opcode Fuzzy Hash: bec1b086f5ef79acea4f300e557c00f465b246422cf87361c0fa5fcc1a3c6acc
Instruction Fuzzy Hash: 61611BF2D041146FF3108625EC88AEB7B68FBC1320F0445B6E90D96AC0E77D5FD58A92

Function 025EA82E Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 213processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 025EBE3D

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 30402d284302e3696be83f5c15edeeb3d8aa04938408c520dbf496c2bd36f427
Instruction ID: b2c108187cb8e8b965bc81a8443953717c1497181e4eaa74a8fb74f11ef78acd
Opcode Fuzzy Hash: 30402d284302e3696be83f5c15edeeb3d8aa04938408c520dbf496c2bd36f427
Instruction Fuzzy Hash: 737127B2E042559BEB28CA24DC95BFB7B35FF80305F0044FAE80F56680E6785AC1CE95

Function 025FCABD Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 188injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 025FE04F

Strings

=EHN, xrefs: 025FCBDD

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: =EHN
API String ID: 3559483778-4237302225
Opcode ID: b2dccd75884a243e7b0995a71ce5a884080f2bad788a15255211fc85f831127a
Instruction ID: c2edb65b23394dcebacddb43269bcc9ebc4d6659c72e5d50e1135d2edaef64bc
Opcode Fuzzy Hash: b2dccd75884a243e7b0995a71ce5a884080f2bad788a15255211fc85f831127a
Instruction Fuzzy Hash: 765105F1D041299AE764CB15DC44AFB7774FB84311F1481FBEA0E92280E6386EC1CA66

Function 026683A2 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: ca80d1b092c2e76a4f8d3a268542948fc67f50f55c68a78ff0f554b05843d91e
Instruction ID: ded29eddc4ca51833718fa0ee4c6ce0574ee7a364783809f21dbcfd61692b714
Opcode Fuzzy Hash: ca80d1b092c2e76a4f8d3a268542948fc67f50f55c68a78ff0f554b05843d91e
Instruction Fuzzy Hash: E45138A2D046689BF7208A64DC88BF77A39EF91310F0041BAD54D972C1D6795FC6CB63

Function 0260331A Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

MA=5, xrefs: 0260347E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: MA=5
API String ID: 0-87635094
Opcode ID: 3484a149acf8b9bd23113b7725f1a6915742a1557b31e80e80e80d6ee415ba19
Instruction ID: a9b72843eda67b415c6559bad99c01fb36eeb7461f48aaf2b0e88e2ce9109145
Opcode Fuzzy Hash: 3484a149acf8b9bd23113b7725f1a6915742a1557b31e80e80e80d6ee415ba19
Instruction Fuzzy Hash: 875102F2D051649FF7188A14DCC8AEBB735EBD1310F1880FAE80D56780D6785AD6CE92

Function 02669854 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 172registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 769dfc5479b34093fbd938f5462167455917f8c90236e24adc20cd1ec19a95f1
Instruction ID: 1b0d3d6712251054d8f73e03310262b6a1ddd14fa58075aaceb4adf61b25108f
Opcode Fuzzy Hash: 769dfc5479b34093fbd938f5462167455917f8c90236e24adc20cd1ec19a95f1
Instruction Fuzzy Hash: 025121B2D156289EE7288A54DC88BFBBB74EF45311F0441BADD4D67280E6781EC1CF92

Function 02669862 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 1b2f2cc62cb6aceb973296cc5bf960a721fc72d89e47e12a65d62f3e97bed3e8
Instruction ID: 7d6a89d434902debc0c1d77853e865632c24752d6229c033b0bcb834015f7864
Opcode Fuzzy Hash: 1b2f2cc62cb6aceb973296cc5bf960a721fc72d89e47e12a65d62f3e97bed3e8
Instruction Fuzzy Hash: 705111B2D15628AEE7248A14DC88BFBBB74EF45311F0441BADD4D63280E6781EC1CF92

Function 025EA838 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 155processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 025EBE3D

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 558ad554517b06e62e993fea7c0cdb79856e6adc527f4ed2bb4ae7f17f870b95
Instruction ID: 3876eadd40d9a3413f92cfcc27c461e1d910b60b29b940d10edcb1f60d0de363
Opcode Fuzzy Hash: 558ad554517b06e62e993fea7c0cdb79856e6adc527f4ed2bb4ae7f17f870b95
Instruction Fuzzy Hash: B35105A1E041659ADB288B25CC45BFFBB75FF81705F0484FAE44F66680E6780AC1CE59

Function 026688C7 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 943dea929cea9a30c71205d9528983141f2eed110c22b70dfa04f79cf7ee7929
Instruction ID: df558709fdc132b2801e9fe9be67ef836c1abdfac9d5a13ad4c9efd46adea77a
Opcode Fuzzy Hash: 943dea929cea9a30c71205d9528983141f2eed110c22b70dfa04f79cf7ee7929
Instruction Fuzzy Hash: 955128B2D046249FF7148A24DC49BFB7775FB81310F0482BAD94D27281D2795AC5CE92

Function 025FE886 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

LL<P, xrefs: 025FEA74

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID: LL<P
API String ID: 1726664587-2443076662
Opcode ID: 9d20e80ca32713fc7ea563ad6e6067c3dd0679396dcfb8f15a763a49a1d29f54
Instruction ID: 3cf491aea8f4d7e484dbe21192eb649ae88cd12823c6eee74d2a4a8113face29
Opcode Fuzzy Hash: 9d20e80ca32713fc7ea563ad6e6067c3dd0679396dcfb8f15a763a49a1d29f54
Instruction Fuzzy Hash: 2C5134B2D05229AAE7608B60DC81BFAB775FF45300F0440FED98D93290E2791EC1CB66

Function 025FF52A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

[W, xrefs: 025FF8DA

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID: [W
API String ID: 1726664587-2887293924
Opcode ID: cbd1dc4e7e2db0a78cbfb5d415d084fd2644671992db45e4a98cd2c9aa232a99
Instruction ID: bd0c4824fbd3d7b40516ee83f71657b17d1936609a417b552e07ecab9330164e
Opcode Fuzzy Hash: cbd1dc4e7e2db0a78cbfb5d415d084fd2644671992db45e4a98cd2c9aa232a99
Instruction Fuzzy Hash: AE4116F2D14114AFF7548A14EC85BFB7768EB40310F0442BADD0D96AC0E6796EC4CE66

Function 02669983 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: Qh?
API String ID: 0-2306691335
Opcode ID: a1d1f61210c74bcc7e4e048a86169ac3897476971b913546bc833e5342df15fa
Instruction ID: c0dcedf65969946326ca2e60853991563388922eb90eb897ce1e25cf21d26f75
Opcode Fuzzy Hash: a1d1f61210c74bcc7e4e048a86169ac3897476971b913546bc833e5342df15fa
Instruction Fuzzy Hash: DD4114B2D156389EE7248A54DC88BFBBB74EB45310F0441BADD4E22280D6781FC1CF92

Function 0266998E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: Qh?
API String ID: 0-2306691335
Opcode ID: fd2a86186ef3ded7bca25fd179ccf78587e938a036ed516a57fa69dcf5f17430
Instruction ID: 85bf110575949eaad723cd4236b08252c66b8576341fbc12d6c9adde62bddb97
Opcode Fuzzy Hash: fd2a86186ef3ded7bca25fd179ccf78587e938a036ed516a57fa69dcf5f17430
Instruction Fuzzy Hash: 6F41F3B6D11628AEE7288A54DC88BFBBB74EB45311F0441BADD4E22280D6785FC1CF91

Function 02669720 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 92930af427c3645a1dd84830d59a085b58162def3d1eb16d9d2f5ad841d19811
Instruction ID: a5148a3841b997324f83c404e66457242710d4006eccb0fc8861aaef9d9d2af8
Opcode Fuzzy Hash: 92930af427c3645a1dd84830d59a085b58162def3d1eb16d9d2f5ad841d19811
Instruction Fuzzy Hash: 4741E3B6C156286FE7248A54DC88BF7BB78EB05315F0440BADD4E27280D6795EC1CEA1

Function 0266991E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 121registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 0bdfb7418cfcd304e516a12610c02201f39009fb654208a06b519eeb2c8b895b
Instruction ID: 51869d82ecfff689aa1f819a43db9720bfc6825cf52f64c6c477428df558ebdc
Opcode Fuzzy Hash: 0bdfb7418cfcd304e516a12610c02201f39009fb654208a06b519eeb2c8b895b
Instruction Fuzzy Hash: 034134B2D05628AFE7248A54DC88BFBBB64EF41311F0441FADD8D22281E6380FC1CE91

Function 02669773 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 1b7ef68ceb34b8b185dbc36cf90a250f94183f321910802406ded164342d8e13
Instruction ID: 06f12cfa863313b9c821598bd2010eb0e1a23567e94b336a3963cd7a4805bb45
Opcode Fuzzy Hash: 1b7ef68ceb34b8b185dbc36cf90a250f94183f321910802406ded164342d8e13
Instruction Fuzzy Hash: 953155B6C056286FE3188A54DCC8BF7BB74EF01315F0440BADD8E26181DA795EC1CEA2

Function 02668882 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 67461d5f78eb5148845866bd8ba2a5a8ecc51fad9fe4c54c56f53f6087bf46e6
Instruction ID: aedf4ec437897f09851b7adc9906452c14d12acd87b5ee4a67301114a1868550
Opcode Fuzzy Hash: 67461d5f78eb5148845866bd8ba2a5a8ecc51fad9fe4c54c56f53f6087bf46e6
Instruction Fuzzy Hash: D93118B2D046549FF7249A24CC88BF77B78EF81314F1441FAD98957582D2784ACACE62

Function 02668889 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 7b1aed36e4f6648ac15c7e0b9e2ab4c3d32a383bb103470a92bfad966952cf7a
Instruction ID: 4c90511ff0687d703844d664b83cb684909f0e865e12b9c835183fe342ff7296
Opcode Fuzzy Hash: 7b1aed36e4f6648ac15c7e0b9e2ab4c3d32a383bb103470a92bfad966952cf7a
Instruction Fuzzy Hash: 263118B2D046589FF7209A24CC88BF77B78EF81314F1041FAD98957582D2785ACACE62

Function 025FF803 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

[W, xrefs: 025FF8DA

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID: [W
API String ID: 1726664587-2887293924
Opcode ID: d5544b00bc3a20930a5eeec20deb0d4fb9ecfefdfe6b5d3149f44d7d8d8e2af8
Instruction ID: db3ffb2d066d9c7239a9f5dbe4c15f744ae45e17e0abd5947e5d75ffc6b86aa0
Opcode Fuzzy Hash: d5544b00bc3a20930a5eeec20deb0d4fb9ecfefdfe6b5d3149f44d7d8d8e2af8
Instruction Fuzzy Hash: 953146F2D141046EF7108A20EC84AFB7769EB80310F1446FAED0DD66C0E639AEC48E62

Function 026699DA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: dbb9490b557edc37c87d883943e31b85d57583aa1f50c3fc47fcdec5c3b86081
Instruction ID: 2dcb6c76733cf4b2690c86a48c6726c6043417b6d729c5277ac8523fc43d1b55
Opcode Fuzzy Hash: dbb9490b557edc37c87d883943e31b85d57583aa1f50c3fc47fcdec5c3b86081
Instruction Fuzzy Hash: E73124B7D116286FF7148A54DC84BE7BB64EB51314F0540BADD4D23280E6795FC1CEA2

Function 025FE91E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

LL<P, xrefs: 025FEA74

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID: LL<P
API String ID: 1726664587-2443076662
Opcode ID: 7f802a30c2e25667122b528bbb034c5eca29c66ba90d7536cb3ca7ed7c1fb0e9
Instruction ID: 298c33f9ce19558fd13aca53423c9e803d9eb33d4502563ce8978d72e5cacecd
Opcode Fuzzy Hash: 7f802a30c2e25667122b528bbb034c5eca29c66ba90d7536cb3ca7ed7c1fb0e9
Instruction Fuzzy Hash: 113146B1C05228AAE7648B50CC42BFAB775FF41300F0444AEDA4A92690E2795ED5CB66

Function 02669A85 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 023a3a73e499194d867a955f35edb11dc2da50ab6cfd0ff680d9f287f221b1da
Instruction ID: 69534c6d13a532f5fb197900804ce83eee346c9b892d784ac594aa6d9c744f1d
Opcode Fuzzy Hash: 023a3a73e499194d867a955f35edb11dc2da50ab6cfd0ff680d9f287f221b1da
Instruction Fuzzy Hash: 163136F6C146286FF7248A54DC84FF7BB64EB41314F0580BADA4D62180D6795FC1CEA2

Function 02669769 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: b9a7ebc8fd64bad2885d8b455ba278d9c71992c015b376a4c5bc19adede32528
Instruction ID: 2d2ec655cc64252679c877c213adb303cb2a7691a52e7e592b904a16abb44926
Opcode Fuzzy Hash: b9a7ebc8fd64bad2885d8b455ba278d9c71992c015b376a4c5bc19adede32528
Instruction Fuzzy Hash: 5F3104B6C156286FF7148A54DC88BF7BB64EB01315F0440BADD8E26180DA795FC1CEA2

Function 025FF81A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

[W, xrefs: 025FF8DA

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID: [W
API String ID: 1726664587-2887293924
Opcode ID: 084eb78004c2125f89bf9b6f988016031bfcc04ea0150d6885918fc362b36e38
Instruction ID: 310350a2e37b4305f07195bb8b31cd386cdf20d68f3b803a93b68477b5bb68fa
Opcode Fuzzy Hash: 084eb78004c2125f89bf9b6f988016031bfcc04ea0150d6885918fc362b36e38
Instruction Fuzzy Hash: AF3136F2D14114AEF7108A24EC85BFB7768E740320F0442FAED0DD6680E6796EC4CE62

Function 0266977C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: a7875312b4e34521d017ecf491e3a63468339a6a369db67c94ad885a0606a3c6
Instruction ID: 4f5a51bf8ee8015ab5a50a793e3826b0f273e85a5db7e4e572f848657d31288e
Opcode Fuzzy Hash: a7875312b4e34521d017ecf491e3a63468339a6a369db67c94ad885a0606a3c6
Instruction Fuzzy Hash: 5F31E1B6D116286FF7148A54DC84BE7BB64EB01315F0440BADD4D26180EA795EC1CEA2

Function 02666C61 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

8:6L, xrefs: 02666C63

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID: 8:6L
API String ID: 4241100979-3411145690
Opcode ID: bea7cdc8f0d48112c5a7bd4519dcd82ec1b75920ed7dd749a99f66d16b9c35d9
Instruction ID: 20704e02a8e2279528ff325a7c6478d2f60556939f364d7416648cbb67d9f159
Opcode Fuzzy Hash: bea7cdc8f0d48112c5a7bd4519dcd82ec1b75920ed7dd749a99f66d16b9c35d9
Instruction Fuzzy Hash: 6B31C4B2C105149FE7298A10DC59BFAB778EB44314F1445EFD90ED6680EA385AC6CE51

Function 026688B4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 5c38d01b89e9604197e0aa0dda88d903d72c0a2ff538e24851c6b0f437aaff93
Instruction ID: 2c3a760bda4540e7e900accc34b3890b3a2287f1f80c1e1b5ba5cdf9d3de97ed
Opcode Fuzzy Hash: 5c38d01b89e9604197e0aa0dda88d903d72c0a2ff538e24851c6b0f437aaff93
Instruction Fuzzy Hash: 033128B2D04654AEF7209A64CC88BFB7778EF81314F1042BAD54956181D3795BCACE63

Function 02668BE9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 04ef872a5672946a00a5e7fb1c4ecf82b76187ad5f682f67ec3230b4f0eaabce
Instruction ID: 9a17fa331c30749184dea59c97543791246a7819ea53269fc5478b2664337a2d
Opcode Fuzzy Hash: 04ef872a5672946a00a5e7fb1c4ecf82b76187ad5f682f67ec3230b4f0eaabce
Instruction Fuzzy Hash: 3E2149B1D00668AEE7208A20DC88BFB7B39EF41314F5080B9E98D57181D6784FC9CE62

Function 025EA88A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 81processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 025EBE3D

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: e2e89f894d7ccd57c86a926372e6d4a7d22ef590d37698632ca266af40e3dbe1
Instruction ID: 85163a71c142fae2acfba59d9a03a6af0d7ca24dbfda789040ebeea9adea6a32
Opcode Fuzzy Hash: e2e89f894d7ccd57c86a926372e6d4a7d22ef590d37698632ca266af40e3dbe1
Instruction Fuzzy Hash: 9A2108B1E05219DAEF3C8A20CD85BBEB774FB81705F1481FAE94B651C0E2741AC1CE99

Function 02668BFA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 447510e471d8e653604afe92ea0f52fbf9ccd84cdaeaa3ae9f8466ce23e4547c
Instruction ID: af5f6d8b35873c4e602272750c177af56ac0e2d7112ee8786eedf32f59edf47b
Opcode Fuzzy Hash: 447510e471d8e653604afe92ea0f52fbf9ccd84cdaeaa3ae9f8466ce23e4547c
Instruction Fuzzy Hash: 042128B1D00668AEE7208A21DC88BFB7B79EF41314F1080B9E94D66180D2791FC9CF72

Function 026688FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 8912f77004fc56047085964ed70859d903cbafa1e544fdee7e0268db15693c38
Instruction ID: b2935e736d2dbabd5de25e69008bacc552ea0e366267f02b552d8e9d5ef0728e
Opcode Fuzzy Hash: 8912f77004fc56047085964ed70859d903cbafa1e544fdee7e0268db15693c38
Instruction Fuzzy Hash: 372126B2D041686EF7249664DC48BFB7B78EF81314F1081BAD58962182D7794BC9CEB3

Function 025EA911 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 78processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 025EBE3D

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: d58d6050f6131b8cb9a4588b3c616b91ba8bfa38f688f9e758cbf4a689221903
Instruction ID: 4c7aa9c93df0f34c30d09ac3c9d5a1e9b8b6957c8a5b1ecfb33af6bd19781e43
Opcode Fuzzy Hash: d58d6050f6131b8cb9a4588b3c616b91ba8bfa38f688f9e758cbf4a689221903
Instruction Fuzzy Hash: C721E5B1E042199AEF388A20CD45BBEB774FB81715F5041FAE94F295C0E7741AC0CE56

Function 02669AFE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 6745c9b35739f10d83bc45156d748d8edbc216264f4a3d2847c90588b9d6c374
Instruction ID: 6b7e891bff9068f01ef1a7b66302efe7ee0dba50f6a411fdd896005eacabe2ac
Opcode Fuzzy Hash: 6745c9b35739f10d83bc45156d748d8edbc216264f4a3d2847c90588b9d6c374
Instruction Fuzzy Hash: C12126B6C50A686FE7248A90DCC4BF7B768EB15305F0440FADD4962180E6795FC1CFA1

Function 025EB8FD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 0af62815f5a79fa1b5caa5a4adaa1903241c72d9eb15825178db34137f4e1766
Instruction ID: c8727b819a25c6197b10acce31f55c29fd512dac92d93eea7b40e8d6402aae96
Opcode Fuzzy Hash: 0af62815f5a79fa1b5caa5a4adaa1903241c72d9eb15825178db34137f4e1766
Instruction Fuzzy Hash: 5D21D4B2E002199AFB2C8A10CC56FBAB775F790301F1041FEE60B665C0EA746B818E95

Function 02667B8A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Part of subcall function 02667D28: CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 02667E45

Strings

FO2I, xrefs: 02667BED

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID: FO2I
API String ID: 4241100979-109952837
Opcode ID: 28a76ae94ecfc523ec208d1e8aeabd4dd53b1e28abc2de5d7a16b2706a787514
Instruction ID: e142c0ba6215cec35d8815d488c742218700ef30deaf2dec3cf6a3d713958119
Opcode Fuzzy Hash: 28a76ae94ecfc523ec208d1e8aeabd4dd53b1e28abc2de5d7a16b2706a787514
Instruction Fuzzy Hash: B02192B1D04698AFEB29CB14DC98BFBBB75EB81305F1041EED50996240DA385BC5CE12

Function 02669BF2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 465a664ed79c1796c8153db21da7dad2b7587b2afe758822aa71124ac86f34c6
Instruction ID: 62050ea82ab0aa2f8d93ba0f7a719a3f246e7b24a36a353ce76714cecf088e6d
Opcode Fuzzy Hash: 465a664ed79c1796c8153db21da7dad2b7587b2afe758822aa71124ac86f34c6
Instruction Fuzzy Hash: 492102B1D046649FD7189B60CC547EAB7B5EB45310F1090FED98A66542DA344EC2CF52

Function 0266955A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: e58d26c821afaca48e1837d20c3534c1c078d5945edf79eeed687231f7ade99e
Instruction ID: 0fd1ea64f2882f878763e7d3d7ad9b8aaed514ded9b69d8e963c56d1d0eefa59
Opcode Fuzzy Hash: e58d26c821afaca48e1837d20c3534c1c078d5945edf79eeed687231f7ade99e
Instruction Fuzzy Hash: 19110AF1C006146EE7148A50CC847FA7678FF90304F0480FAE94D66981E6785FC9CF62

Function 025EA956 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 025EBE3D

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 884852042968d472e06b90c661e6c219fd68666ce7b0dcea05e54b1664578eda
Instruction ID: fd2488b0a749dfe934fb1221b19adddd00b1cc8033f76caad228b19f0f1869c4
Opcode Fuzzy Hash: 884852042968d472e06b90c661e6c219fd68666ce7b0dcea05e54b1664578eda
Instruction Fuzzy Hash: B911B672E04209AAEF388950CD85FBAB774F781706F1081EAE91B251C0A6741AC0CE95

Function 025FDBC6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

;8<E, xrefs: 025FDBD2

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: ;8<E
API String ID: 3559483778-1498667124
Opcode ID: 83c522e124519b2576fb96f6802b9d2247139f4be6003f6f8d40d18d60e4b216
Instruction ID: d0d6e85aa9e2e1e5b247adb5e8d9395e2fd1b0746b781219bdefc98c085e8ce1
Opcode Fuzzy Hash: 83c522e124519b2576fb96f6802b9d2247139f4be6003f6f8d40d18d60e4b216
Instruction Fuzzy Hash: FE11E6B2D061299BDF64CB18CD846E6B7B9EF89300F0082EAD90E67245E6345EC1CE56

Function 02669C8C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 2920202b9100f2fbf9e256c5c8f69290b928c8b2e4da5a0fc9b73d5f878e602c
Instruction ID: eff85fa15e1f75e83bcf3526e9072b974eaa65f59b463af8c934d637536fbaab
Opcode Fuzzy Hash: 2920202b9100f2fbf9e256c5c8f69290b928c8b2e4da5a0fc9b73d5f878e602c
Instruction Fuzzy Hash: 431125B6C15128AFEB188B10CC59BFAB674EB00304F4081FAD94AA2680EB355FC5CF52

Function 025E0BD7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 0f7a587f9bebe1680b2e4bda51bcb12b890d158bce2842984c073a4b94f6e194
Instruction ID: a59e9791765a02f8468c60056976284eaecf2b77a0c41baf9e1f580003120c86
Opcode Fuzzy Hash: 0f7a587f9bebe1680b2e4bda51bcb12b890d158bce2842984c073a4b94f6e194
Instruction Fuzzy Hash: D611A5B1E452199BEF3C8A40CD41FBEB774FB80706F1045EAE5076A1C0E6715A81DF98

Function 025EBD93 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 190dfb89c2f5b2b5214b9178c61f1a6bcd29ec48627ddc76a38eff377c497469
Instruction ID: 29a8175cca96ca3e0d90001b4a1d18aa28c54bf6ea9a9580f8b8e4e445589347
Opcode Fuzzy Hash: 190dfb89c2f5b2b5214b9178c61f1a6bcd29ec48627ddc76a38eff377c497469
Instruction Fuzzy Hash: 1211C8B1E452599BDF3CDA50CC41FAEB774BB80706F1041EAE6066A1C0E6715B80DF99

Function 025EBDA5 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 025EBE3D

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: ad5ab85afbabe5c9927960b5048d7b2e556ce489564152368fb7e9c33ee39519
Instruction ID: 37d42e0107d56a4e9afc583b567add572c08cb2b1c32b638993c2286225ce4dc
Opcode Fuzzy Hash: ad5ab85afbabe5c9927960b5048d7b2e556ce489564152368fb7e9c33ee39519
Instruction Fuzzy Hash: 4501C470E442599AEB388A018C41FEABB74FB81702F1041EBE5466A1C0D6741F81DF94

Function 0266894D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: c6a9b5a49fbb2ed3f238918e29ca6f3fb0b356dbb50a44f5f1bdcb43daf9e752
Instruction ID: 1d17c4f1908a4b5fb19d31f039fec84c4cb39e72cc7d8a1d4bf71cecc0f345cd
Opcode Fuzzy Hash: c6a9b5a49fbb2ed3f238918e29ca6f3fb0b356dbb50a44f5f1bdcb43daf9e752
Instruction Fuzzy Hash: 7601F5B2C005686EF7108660DC88BFBB638EF40304F1080B6D98D66081D2B94BC9CEB3

Function 026689E2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 84fd88272bbf54c76785662682db57004640d6bd7b98009543c9d657c2e0db14
Instruction ID: 3c3a738b590cb8fa378b172c8d3887c9d1ff90f6e2daa9cd202e1e97024b8e8d
Opcode Fuzzy Hash: 84fd88272bbf54c76785662682db57004640d6bd7b98009543c9d657c2e0db14
Instruction Fuzzy Hash: 1F01D8B1C005646DE7149665DC88BF7BA78EF40314F5440B5D58D66181D3794BC9CEB3

Function 025EB88F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 025EBE3D

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 57e0e39b7af198fdd2f1940dead677eda914dbc41397ef33ceaecf5d066ade67
Instruction ID: b91f498f63e80019b38c264c358e7b4f196de8e6d02680e28cb47dac8568b5a8
Opcode Fuzzy Hash: 57e0e39b7af198fdd2f1940dead677eda914dbc41397ef33ceaecf5d066ade67
Instruction Fuzzy Hash: 670184B1F40218AAFB388900CC52FFAB778F784711F1480EAEA0B661C0D6756B809E95

Function 025EBD9E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 9b5a409d5f21339a04df0fb112713fe01b70773addd509ee3419bf0b62dd1f4d
Instruction ID: 588073cfa6fb946ca5fadef872d134a121dc649376a8e106f7942770986d7e3d
Opcode Fuzzy Hash: 9b5a409d5f21339a04df0fb112713fe01b70773addd509ee3419bf0b62dd1f4d
Instruction Fuzzy Hash: FD01D6B0E45259ABEF3CCA10CC41FAEB774BB80701F1040EAE5062A1C0D6715B80DF98

Function 026689EB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: e4948841e146847b7892702a3ba53391e232a3fb7d1c2cf4fa8e76654a1f52a7
Instruction ID: 2e323281c19e5160084bf9a32bbfe6d9b0350db50753f6edd92da79852e02f62
Opcode Fuzzy Hash: e4948841e146847b7892702a3ba53391e232a3fb7d1c2cf4fa8e76654a1f52a7
Instruction Fuzzy Hash: 9601A7B1D045686DF7149A61DC88BFBB678EF41304F5080B9D58D62181D7B94BC9CEB3

Function 025EAA3D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 025EBE3D

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 6605e9a65e9b0995115a8765ad675870b4a60d7628556fee09434a6b22ac97f7
Instruction ID: 1ec5189603f2dbc69c63818687a14cc477f83ec5f81a8fb33423a78f68ca1e63
Opcode Fuzzy Hash: 6605e9a65e9b0995115a8765ad675870b4a60d7628556fee09434a6b22ac97f7
Instruction Fuzzy Hash: ED01F771F45395AAEB388910CC41FBDB774B781704F2080EAE50B6A0C0E6741B80DA99

Function 025EB9EB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 49c9454b0a8f7b6d6400761cabe18a6722f7851e0abb5c0a255e32d12ee65501
Instruction ID: c51388f436c2f8029d59d96fac911892d838ab27d9af3ad7b49e90f85c4c882e
Opcode Fuzzy Hash: 49c9454b0a8f7b6d6400761cabe18a6722f7851e0abb5c0a255e32d12ee65501
Instruction Fuzzy Hash: DF01D270A443699AEB38CF54CC45BB9B774FB00706F1041EAE90AAA1C0E6311B80DF85

Function 025EBDBC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 025EBE3D

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 8974cdee5f4309174262b650528cd6e5d96a0b53257b28daa40a9c364071a2b0
Instruction ID: f9c16044d93100dd25c73f45f2860b98759491029c2c68eb193ac7e26cfdf09e
Opcode Fuzzy Hash: 8974cdee5f4309174262b650528cd6e5d96a0b53257b28daa40a9c364071a2b0
Instruction Fuzzy Hash: 86016771F45219AAEB3CCA45CC42FE9B774BB40701F5041DAEA0A6A1C0D6715B81DF99

Function 025EBDB7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 025EBE3D

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 3ee9aff3615a1e9f2655ff5586982b845b17a383a03afed9a88a0de0ca05b107
Instruction ID: c5cfa2296787554de4921ced25fc8a4a550116bb1b5944ff6adf8f6b14006f84
Opcode Fuzzy Hash: 3ee9aff3615a1e9f2655ff5586982b845b17a383a03afed9a88a0de0ca05b107
Instruction Fuzzy Hash: 6C016771F45259AAEF3CCA41CC46FAEB774BB40705F1040EAE90A6A1C0D6716B81DF99

Function 025EB972 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 025EBE3D

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 6aa474a68c517cea3b7c2707b72907d931bf483dd5f4404c0a8d4b473e13df34
Instruction ID: 66ae1d4f2c1c6688fd62fdac65357dbadc6bd60ff8db5b211dd541ddfad3a197
Opcode Fuzzy Hash: 6aa474a68c517cea3b7c2707b72907d931bf483dd5f4404c0a8d4b473e13df34
Instruction Fuzzy Hash: D201A270A44259AAEF38CA40CC82BEDF7B4BB40706F5085DAE90A6A1C0D2705F80DF99

Function 0266A07C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 5013b31e68d0e3dacbee03726d172abf77e5a551457c8a9ae9ea04ab40c315dc
Instruction ID: 44fcf9c79205566c3d71ce04028a1316862f0ddc537d4157c97af546bc0840cb
Opcode Fuzzy Hash: 5013b31e68d0e3dacbee03726d172abf77e5a551457c8a9ae9ea04ab40c315dc
Instruction Fuzzy Hash: 70012675D046A8AFDB159AA0CC04BFAB635EF85305F0081EA958972582E7754FC2CF52

Function 025EAA51 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 025EBE3D

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 0c0db9ad6520692e47a99f350c12272abfa75d40149ff8300014f7bb69d8b5df
Instruction ID: 5ff184680b6ecb1c68c8ac04ea5ba1df8fd1edf8d1147580afe24bd25dc6829d
Opcode Fuzzy Hash: 0c0db9ad6520692e47a99f350c12272abfa75d40149ff8300014f7bb69d8b5df
Instruction Fuzzy Hash: 56F0A471B44358A6EF38C9408C46FB9B774BB41705F5040DAEA4B6A1C0D6706B40DF99

Function 025EB9FE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 025EBE3D

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 2d869a87a9432875386d20bb4a128d66437bff56a3fdff17328c89d610dfa849
Instruction ID: 9023ea541c5b909186f315e84ab174fb798fa24fce27ef1f0f4f716fb838abdf
Opcode Fuzzy Hash: 2d869a87a9432875386d20bb4a128d66437bff56a3fdff17328c89d610dfa849
Instruction Fuzzy Hash: D5018670E442189ADF38CA40CC42FE9B774BB44701F1040DAE90A6A1C0D6716B80DF89

Function 0266A093 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 72430d2a72336538967316c6b49b0ad372e8b77a4fa4b76e9517d87c59e9bc9f
Instruction ID: be304bd024d065151d1d1c82a415efc8f84188383717934011bc11ec2bc5b23e
Opcode Fuzzy Hash: 72430d2a72336538967316c6b49b0ad372e8b77a4fa4b76e9517d87c59e9bc9f
Instruction Fuzzy Hash: 4EF0F475D006686FE7149A90CC44BFAB674EF80301F4080EA958962542E6710FC1CF52

Function 02669CD2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: c62228ed11c07527b4682aafd3d5cfa691f441b594b33f4b8ed5e4f747459ccc
Instruction ID: 427c15c5de33260016645d7d1519f0c46de6c03bdbad5c9f0496cbcdce9408d0
Opcode Fuzzy Hash: c62228ed11c07527b4682aafd3d5cfa691f441b594b33f4b8ed5e4f747459ccc
Instruction Fuzzy Hash: 1FF02279C04668AEEB189B50CC147FAFBB4EF01300F40A1EA9A8A72181DA710FC1CF50

Function 02669C4C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: b7d204fcefa36bf6091c6081d17b1d2fac2f58ca29226cad36e8a09dbb2e8084
Instruction ID: e872b96c77d66a6886e7854ca57c86e2fd62ceeaabc1011ae2a36ca0fd998a32
Opcode Fuzzy Hash: b7d204fcefa36bf6091c6081d17b1d2fac2f58ca29226cad36e8a09dbb2e8084
Instruction Fuzzy Hash: 6FF0C875C00168AEE7159A90CC457FBF674EF00300F50D1EA958E72181EA715FC1CF62

Function 025EB2D2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 025EBE3D

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: d1784a182fe4fc0f76f1ead8a2cdc31c09633cbbc542e615999e33711cf0bcfa
Instruction ID: 7e50333fffb6067d8ba3463f3bc87065bf84c111a30005e9dd3e890550a7e4c4
Opcode Fuzzy Hash: d1784a182fe4fc0f76f1ead8a2cdc31c09633cbbc542e615999e33711cf0bcfa
Instruction Fuzzy Hash: 03F09671B44254A6EF3CC9408C46FB9B364BB00705F5044DAE60A6A1C0E7706B40DF89

Function 025EB8E9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 025EBE3D

Strings

jjjj, xrefs: 025EBE2E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 0088f9c9e97fdce36b44278cc3f7b21b271c927ad6c2899e1025e02ce64d1710
Instruction ID: 2a2ac5b402daa15c1f4f929263661ace02d13095273d7b539657bdae2f79593e
Opcode Fuzzy Hash: 0088f9c9e97fdce36b44278cc3f7b21b271c927ad6c2899e1025e02ce64d1710
Instruction Fuzzy Hash: 1FF03170A44219AADF38CA408C42FA9B774BB44705F5041DAE90A6A1C0D6716B40DF98

Function 0266A0A2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: cc5b4f80057970750d651b21fd8dae9fafab2b7c90477c308b0c4f99a8933433
Instruction ID: e5b34f51681f08d8fa9a2f8c3d4f039e44b8c33c67cb304f4b4723f93b8424c5
Opcode Fuzzy Hash: cc5b4f80057970750d651b21fd8dae9fafab2b7c90477c308b0c4f99a8933433
Instruction Fuzzy Hash: 1DF0AF75C00668AFDB25DA90CC44BFAF670EF14301F4091EA958966581E6714FC2CF51

Function 02669CD9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: d26aec081cc13689d014647cf177262627ebc10dba551f4c44104b54e1a9ccc7
Instruction ID: 4c5a7e29f4c8cb240716d4baed93fd879948cb6475f55b003cc656e43cd53d18
Opcode Fuzzy Hash: d26aec081cc13689d014647cf177262627ebc10dba551f4c44104b54e1a9ccc7
Instruction Fuzzy Hash: BCF0AF79C14668AED7199B50CC557FAFB74EB00304F4091EA968A66181DA751FC0CF51

Function 02669C63 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: cae05b065dc31734be6012c4aee8e06e05f5f217a8910526f3c4f3538a5d8e36
Instruction ID: 55e71807d0746bee9a23786b62286b301d26e2300b2e0a7579b3a327687c5c12
Opcode Fuzzy Hash: cae05b065dc31734be6012c4aee8e06e05f5f217a8910526f3c4f3538a5d8e36
Instruction Fuzzy Hash: 67F09A75D04668AECB25EA90CC047FAFBB4EF05301F5091DA998972141E6714FC1CF92

Function 02669BD2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 0266A0FB

Strings

Qh?, xrefs: 0266A0E7

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 6b6ddf504ceeb00984e906d8a74b42f68c153ac5e15e1fd6d503070b52e846b2
Instruction ID: 79ac938dfb7023554adc18dcfa5c0e400dd10eb12f1caeb97668da42499dae1e
Opcode Fuzzy Hash: 6b6ddf504ceeb00984e906d8a74b42f68c153ac5e15e1fd6d503070b52e846b2
Instruction Fuzzy Hash: E8F05E75C04268AFDB259B90CC447FAFAB4EF04345F4091DA958972541E6715FC1CF61

Function 025E9048 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 025EFCC5

Strings

@>L8, xrefs: 025EF2B0

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID: @>L8
API String ID: 4275171209-3765172012
Opcode ID: 27e5f61869a4cc2918a222878dff6a466a1542e61b0d5a565d71aa4ab99d49b4
Instruction ID: 30edee02100a4c0f6675a888f699ed6d785cd469a309b73f7539c95536f208d8
Opcode Fuzzy Hash: 27e5f61869a4cc2918a222878dff6a466a1542e61b0d5a565d71aa4ab99d49b4
Instruction Fuzzy Hash: 88318CF2D442556EF7284620EC89FF77B2CFB81324F0400BAED4A46580EA6D5AC1C6A6

Function 025FCBE3 Relevance: 1.7, APIs: 1, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae1c07eafdd42a009318edd91fee17cde6048e6b9dacafe7ceddd7d8d873c87
Instruction ID: d2aa21e9db263a602aac0d4df88ca8cd6bcb0c2de72aad760b585b15a47102c1
Opcode Fuzzy Hash: 5ae1c07eafdd42a009318edd91fee17cde6048e6b9dacafe7ceddd7d8d873c87
Instruction Fuzzy Hash: 896112B2D105199AE768CB24DC45AFB7774FB84311F0442FFDA0E92281E6386EC1CA66

Function 026679E7 Relevance: 1.7, APIs: 1, Instructions: 161COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 723d354e8e14d1830cb4a01a312809bf6096ce1868144c218cebd151a4dc6ff7
Instruction ID: 22488a106f2a983a9254b107ac393700e5134c97d9114134f0bc17467dcabf5e
Opcode Fuzzy Hash: 723d354e8e14d1830cb4a01a312809bf6096ce1868144c218cebd151a4dc6ff7
Instruction Fuzzy Hash: 155113B1D046699BEB28CB18DD94BFABB76EF80305F1441FAD90996241D7386FC1CE11

Function 02667746 Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: c0d37c860bd6b7e204c85832fc1e0f2da8956581ca43c1923b7ff5af58578889
Instruction ID: 8d4dca1d44027f8f9c37c134ac5b2570f1e09d994a5e5416f783859b75793c57
Opcode Fuzzy Hash: c0d37c860bd6b7e204c85832fc1e0f2da8956581ca43c1923b7ff5af58578889
Instruction Fuzzy Hash: 2F41C5B1D042699FE725CB14DC48EFABB78EB80314F1441BED40EA7241D6349EC6CE91

Function 025FDCB7 Relevance: 1.6, APIs: 1, Instructions: 137injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 025FE04F

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 1e38d38803093b57ec7c45ae60c7a66d8ea75c025a5f47934377517ab0958d9f
Instruction ID: a30efbf4416c4775765a52f9e2109a69d2a55bf4b8cfafbe3279f79c12010088
Opcode Fuzzy Hash: 1e38d38803093b57ec7c45ae60c7a66d8ea75c025a5f47934377517ab0958d9f
Instruction Fuzzy Hash: B951F7B2E055189BE764CB18CC85EEBB7B9FB85300F0441EAD90D57680E7396EC1CE55

Function 02666B1C Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 33c390bc7514d1fb132dbb0ff143a4eb5538bbe36bd32670e38a7ecf0b4442a0
Instruction ID: ed6f2bbd3d00942a5fd1fcb8b6e7059669c4fc5b976f512a8940db61524a660b
Opcode Fuzzy Hash: 33c390bc7514d1fb132dbb0ff143a4eb5538bbe36bd32670e38a7ecf0b4442a0
Instruction Fuzzy Hash: 4F4190B2C106689BE7268B54DC59BEAB7B4FF54354F0441FAD94C62250EB385BC2CE90

Function 02667B1F Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5818ab04ed411e793b0510a8010452a450c48c20be4c262f8d5b2e4fdd7745d0
Instruction ID: 1dd067b491475ac10e902414744423ed5b3193f7943404beaeaa39f9490ed76d
Opcode Fuzzy Hash: 5818ab04ed411e793b0510a8010452a450c48c20be4c262f8d5b2e4fdd7745d0
Instruction Fuzzy Hash: 6A41D3709046999FDB25CF24CD94BFABBB6EF41309F1441EAD50996242D7346BC1CF01

Function 02603BC9 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94acdd7046306cc1ce09bae373ce67f23892ec8a636ae381fee8c1b49d8fbb82
Instruction ID: 198ee2189ca1a966121f17ce5c6e64d2119c2b816d9bb5a5172fc7dde0705a55
Opcode Fuzzy Hash: 94acdd7046306cc1ce09bae373ce67f23892ec8a636ae381fee8c1b49d8fbb82
Instruction Fuzzy Hash: 2841B6B1D080588BDB28CA14CDD1AFFB775EB42301F1885EAD90DA2380D6749FD29F91

Function 025FC8BC Relevance: 1.6, APIs: 1, Instructions: 110injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 025FE04F

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 32e49de105c81fb51075cff88d018bf37409175de985f16f9ca2d53a5a95fa28
Instruction ID: 1aa60f4adf170263f10fe05a48f7112b5dd5ea824dd434a4a13ada5620d1faff
Opcode Fuzzy Hash: 32e49de105c81fb51075cff88d018bf37409175de985f16f9ca2d53a5a95fa28
Instruction Fuzzy Hash: 0B3116B2D045189FE758CA54DC84BE777B8FB84311F0445FBD90E96280D679AEC1CEA2

Function 02666C3A Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 3f7d287a3b7927d639a2d31eff373e4bb324ef36486d9b5db45e1e7c755321dd
Instruction ID: 331507048a6d049c641313e65e64205a1952c1db980d6af5083e62c0ebcaadd1
Opcode Fuzzy Hash: 3f7d287a3b7927d639a2d31eff373e4bb324ef36486d9b5db45e1e7c755321dd
Instruction Fuzzy Hash: 1031E4F2C105249FE7288B10DC59BFAB779EB44314F0441FBD90EE6680EA389AC2CE51

Function 025FDA92 Relevance: 1.6, APIs: 1, Instructions: 105injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 025FE04F

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0db9b6d82796771e3f271b1e8e29c12adbd45e18244651b25d4b1e5c7abf94fa
Instruction ID: d84420ff329db1dd9c4b562cfee66cf9c8122520e8d248cbd07cc056ec025bc2
Opcode Fuzzy Hash: 0db9b6d82796771e3f271b1e8e29c12adbd45e18244651b25d4b1e5c7abf94fa
Instruction Fuzzy Hash: A841E4B1D091688FEB64CF10DC84BEAB7B8FB49301F0041EAD94D97241E6356E82CF96

Function 026031F7 Relevance: 1.6, APIs: 1, Instructions: 102threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 02603D9D

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7e36b43588be708a25aec69ed8f2cb46dbd332646b8490b3e2100b1a845ff098
Instruction ID: c9f1f43eaee1e89729c77a75f50a93d359a372367dc8581f4db53b63b0b25f86
Opcode Fuzzy Hash: 7e36b43588be708a25aec69ed8f2cb46dbd332646b8490b3e2100b1a845ff098
Instruction Fuzzy Hash: 8231F5B2D441949AF72C8A24DC99DF77728DB45311F0446BEE90A912C0EA78AEC18E61

Function 025FC7CC Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a86dc6dab49da26fd5ba1de83926fa8b1ace01b2958d74b230ff90915db49d64
Instruction ID: bfc3e4a9a250c9a1175fac81a937628af49e37e7f5204e26d7673b3a883a96ac
Opcode Fuzzy Hash: a86dc6dab49da26fd5ba1de83926fa8b1ace01b2958d74b230ff90915db49d64
Instruction Fuzzy Hash: A531C5B2D041189BEB64CA14DC44BE7BB68FB85321F0441FBE90E52280D7795AC6CE56

Function 02667D28 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 02667E45

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: abe88195ec8b41b1911ea0e4fda6955d6ad2a301614a5b0557240996d269dcb0
Instruction ID: 6fc155a248d6bd1a71118255f9e3567e87b52c35f3be63b836c627f9624d5b70
Opcode Fuzzy Hash: abe88195ec8b41b1911ea0e4fda6955d6ad2a301614a5b0557240996d269dcb0
Instruction Fuzzy Hash: 8B31AEB2D016249BE7248B25DC45AEAB776FFC8320F1441EAD80C67280E6795ED5CF91

Function 02603C3A Relevance: 1.6, APIs: 1, Instructions: 83threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 02603D9D

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ab2cf5e0a99862d331bbe021ba7a88fadd7a32d487754110311e38ccc6509099
Instruction ID: 72c028efd365a06d6486f29cba1980fe18155a5881f129c7d0624d564d239de8
Opcode Fuzzy Hash: ab2cf5e0a99862d331bbe021ba7a88fadd7a32d487754110311e38ccc6509099
Instruction Fuzzy Hash: 5E31D5B2E040588BE728CA15DCD4AEBB7B1BB81311F1441EAD80EA72C0D6745AD2CF55

Function 02666BCF Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 3202789951141966e755cfd2f3ef133e5af9111a6fede2649fdff73d4b5cff84
Instruction ID: 318bae2aeef97503918a9b3d9527b8bb96454eb92a9b73efc9958b332c06d2e9
Opcode Fuzzy Hash: 3202789951141966e755cfd2f3ef133e5af9111a6fede2649fdff73d4b5cff84
Instruction Fuzzy Hash: 8721D3B3C102649FE7258B64CC49BEABB78EB45314F0841FBD94DA6680EA385AC1CE55

Function 025FC83E Relevance: 1.6, APIs: 1, Instructions: 81injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 025FE04F

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 358a9df255d67324d74783619c77a96e8d7b979100947e1adf5cb8a9a06656d2
Instruction ID: 711264fa34e6b6345f784d6b5dc2d2ae3e2e5df3ca724497f2632e40f95ea59a
Opcode Fuzzy Hash: 358a9df255d67324d74783619c77a96e8d7b979100947e1adf5cb8a9a06656d2
Instruction Fuzzy Hash: 2121D3B2E041289BE764CA00DC85BF77B78FB84315F0405FBEA0E96180D7795AC6CE56

Function 02666C92 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 64e8709f401173f9cbb12c563574c390a167f0c520ac7dc832b31b20ad8a43c9
Instruction ID: 940570e596214ac9001837c448c9ccd4921e1cfcf3c676b7f314b6e0e4176c25
Opcode Fuzzy Hash: 64e8709f401173f9cbb12c563574c390a167f0c520ac7dc832b31b20ad8a43c9
Instruction Fuzzy Hash: E521D1F2C106249FE7298B10DC49BFAB775EB44314F1845EED90D96680EA385BC1CE51

Function 025FDBD8 Relevance: 1.6, APIs: 1, Instructions: 80injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 025FE04F

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f4de6fa07ef37c4819f24d0e7d6f64d81a65eeda84d1293568a9ea3f0661aac8
Instruction ID: 75a9140ca492ce951a08bf049fbad4c12674bf07feeb45a41d4d18bfafd345ff
Opcode Fuzzy Hash: f4de6fa07ef37c4819f24d0e7d6f64d81a65eeda84d1293568a9ea3f0661aac8
Instruction Fuzzy Hash: 2931C871D051249BEB64CB14CD849E7B7B9EF85310F1082FAD90D63241E7356F82CE95

Function 02667BF2 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 30be580cdf52eae77c0960a9245593c5e9d32fb04f59a24812dcec7a3ab022c2
Instruction ID: 7a96424f8f617d733e05b1f8df950961006a5b7b8eb2c0c40602728c4d0f21d5
Opcode Fuzzy Hash: 30be580cdf52eae77c0960a9245593c5e9d32fb04f59a24812dcec7a3ab022c2
Instruction Fuzzy Hash: A421A1B1D046589FEB258B24CC88BEBBB76EB81315F1445F6D40C96280D6785BC68E11

Function 02667105 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: df5f891e5f78035c49b4ab2e7dfb5fd7ba64a41a09bfb88992be4ddde27fd011
Instruction ID: ec06788865eabc48db92ca18dbf3a401cbf62d386120a2bce1aeab2fc0e618a3
Opcode Fuzzy Hash: df5f891e5f78035c49b4ab2e7dfb5fd7ba64a41a09bfb88992be4ddde27fd011
Instruction Fuzzy Hash: 912192B2C106689FE7298B20DC49BFABB74EB45314F0841EFD50D96680EA385BC5CE51

Function 02666D41 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 8a7c076b87e03250fc692d9ffa9021332041326df9547bb99610c17aed8dd365
Instruction ID: 797733f7ad24276cba417605f4b9d7179638f79d7dbe6acb98e1434cd7a3e648
Opcode Fuzzy Hash: 8a7c076b87e03250fc692d9ffa9021332041326df9547bb99610c17aed8dd365
Instruction Fuzzy Hash: E02192F2C106289FE7258B20DC49BEABB74EB45314F0841EFD50D96680EA385BC5CE51

Function 02603CB6 Relevance: 1.6, APIs: 1, Instructions: 71threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 02603D9D

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: de3c6c2439602a0da0f8c27fdfbf8945bb086daf06633c0c52689965facca623
Instruction ID: da37f879ed1f3c58753eff77935cbb6b41340cc10af5d14e00003ea5514d868d
Opcode Fuzzy Hash: de3c6c2439602a0da0f8c27fdfbf8945bb086daf06633c0c52689965facca623
Instruction Fuzzy Hash: A921B6B2E041589BF7288A15DC85AEBB776EBC1311F1441FAD80E622C0D6785FD2CF51

Function 026038B3 Relevance: 1.6, APIs: 1, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 02603D9D

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4efca36d41d4855e17f93d7c2c100251c4119793ba10525e669df14ae59c90a1
Instruction ID: ca1912a0d00478da764ee7c4991d095d9e318a4020f5c4a309db35ce274b6a2a
Opcode Fuzzy Hash: 4efca36d41d4855e17f93d7c2c100251c4119793ba10525e669df14ae59c90a1
Instruction Fuzzy Hash: 1621D4F2D581189FE71C8A50DCD5AEB7774EB44310F1482FEE90E52381E6385E92CE51

Function 026677EE Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: a6994a2b9e0bdf6e37d0b2ee0df14fff032b5f44f7d7760caa6eb1df44289159
Instruction ID: 0279f094e200be049fc91dde05e1c0b449facec9d5fa89827bdc4151927338e9
Opcode Fuzzy Hash: a6994a2b9e0bdf6e37d0b2ee0df14fff032b5f44f7d7760caa6eb1df44289159
Instruction Fuzzy Hash: 2D11D5B1E016699BE725CA14CC48FFAB725EBC0314F0046FFC409A7241E6344EC6CE90

Function 025F36E3 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 304b19aa56b8399ecd2dcb29679e5a0db0c72aac571b488797fed343e23cb299
Instruction ID: f410700a235d3170aa1dd01ad26d11655c00dcefa36bf7a0ebcce9c26a2abb70
Opcode Fuzzy Hash: 304b19aa56b8399ecd2dcb29679e5a0db0c72aac571b488797fed343e23cb299
Instruction Fuzzy Hash: 5D11DAB1E042959BF7248A15DC95BA7B775FB80310F0441FFD94996280E6759AC0CF91

Function 0266780C Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: ff20238f9ee6342f8d40886462b2f367549671c602fc6ff715d23fc856d6eb58
Instruction ID: 55e2ec543957da0f79e94ca0a2dc022ca24a9de32b7060cee1ae7da668f158f8
Opcode Fuzzy Hash: ff20238f9ee6342f8d40886462b2f367549671c602fc6ff715d23fc856d6eb58
Instruction Fuzzy Hash: CB1193B5E016699BD724DB24CC44BE9BB75EB80315F0046FEC449A6241D6349EC6CE90

Function 02667807 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 5f0f3c811927c4dada9d89e16870849aa04028c22023c5e6b54821fedcbb4dc4
Instruction ID: 278a90547aa14ba5642ecff19866c7ba284727ec1b432005b2226ccb24f56d98
Opcode Fuzzy Hash: 5f0f3c811927c4dada9d89e16870849aa04028c22023c5e6b54821fedcbb4dc4
Instruction Fuzzy Hash: 4C11B2B1D006699FDB25DB24CC48BF9B775EB84314F0086FEC40AA7241D6349EC6CE90

Function 02667BA1 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Part of subcall function 02667D28: CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 02667E45

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 3f02ce8d9ba885e2862fcbeb5f61a37b5d8d2c257a8c487e60a92c7360c8b0c3
Instruction ID: 773a4ee82f50b6d89b44b0fa611d1c6ae926abf171f8869515e495a6c0974f65
Opcode Fuzzy Hash: 3f02ce8d9ba885e2862fcbeb5f61a37b5d8d2c257a8c487e60a92c7360c8b0c3
Instruction Fuzzy Hash: DA118270D046689FEB29CB14DC98BFABB75EB81305F1045EAD509A6281DB345BC2CE11

Function 02667BA8 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Part of subcall function 02667D28: CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 02667E45

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: f6359761f0532f0b9835c76b7dd74dd981b85c5cbe7c898436c898bb3f9faa03
Instruction ID: dde54638f7e583075c57c110270b22bb99b007594bf1044f7bbc8e224af37687
Opcode Fuzzy Hash: f6359761f0532f0b9835c76b7dd74dd981b85c5cbe7c898436c898bb3f9faa03
Instruction Fuzzy Hash: E4119170D046689FEB25CB24CC98BFABB76EF85305F1044EAD50DA6241DB385BC1CE11

Function 02667701 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 2b58670b13de16a26b8b85da5f995baedbc91b2613fcce4dd04bc8033a8e34f7
Instruction ID: e9361e5fb93e33745c36545a1bb63ade2875eab4cb934601dec26a281dee81a3
Opcode Fuzzy Hash: 2b58670b13de16a26b8b85da5f995baedbc91b2613fcce4dd04bc8033a8e34f7
Instruction Fuzzy Hash: E61186B1D04268DFE725CB14DC88AFABF78EB45314F1081EAD50DA6254DA344FC6CE51

Function 0266774D Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: ce9257200bfee343aeda19c206c26eebacd43fa020076e48b88178fe13b63558
Instruction ID: d0bace4e0eb245ed60ab0d56c3ed3f4ed6d539632c9a1eb977bd97e82d3e90ec
Opcode Fuzzy Hash: ce9257200bfee343aeda19c206c26eebacd43fa020076e48b88178fe13b63558
Instruction Fuzzy Hash: CA118EB1D046689FE725CB14DC88BFABF74EB45314F0082EAD50DA6244EA384FC6CE91

Function 02667753 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 149edab8be7ea5483773db2512c14c6bcce0db8b677506ff7d10478b95b2a08d
Instruction ID: f1db26736e30e1abe437f55be371bdc9aa89e3defc10e0f576cac7f5673e1445
Opcode Fuzzy Hash: 149edab8be7ea5483773db2512c14c6bcce0db8b677506ff7d10478b95b2a08d
Instruction Fuzzy Hash: 7711A1B2D002689FE725CB14CC88BFABF75EB45314F0082EAD54DA6240EA344FC6CE90

Function 025FE7E3 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 9ae0ce748537884bf816f1c404bfc4f6111eca96ad8e15d905ae31a03cf23b5d
Instruction ID: b988bd7793b267bf7c07ee7425aff86965da593306d36f10d13d72949db32610
Opcode Fuzzy Hash: 9ae0ce748537884bf816f1c404bfc4f6111eca96ad8e15d905ae31a03cf23b5d
Instruction Fuzzy Hash: 2D0100F2909245AFE7208A60CC42BF673A9FB85301F0441FADA49D65C0E3795A95CF52

Function 0266775D Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 3f946bfb4987aee25611bd27198e5fa45b27c04ce6e48d3efe2fc0d941b96548
Instruction ID: ccfdd7d2ec096b0b8dfa8b9ed6d030c9c509488aa00c758859dcba3d92f3506b
Opcode Fuzzy Hash: 3f946bfb4987aee25611bd27198e5fa45b27c04ce6e48d3efe2fc0d941b96548
Instruction Fuzzy Hash: F61184B1D016689FEB25CB24DC48AEABB74EB45714F0082EAD50DA6240DA344EC6CF90

Function 025FEA7B Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 025FFF17

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 214d091fa04b46cd2d0b0a60b5621f12d55b3461e985066842f8b9f179ce5eb3
Instruction ID: 690bca3a8df7f6dd37e5276bb76fe09e9230136a6c7d8fa0bf47dc1d2c8d28b4
Opcode Fuzzy Hash: 214d091fa04b46cd2d0b0a60b5621f12d55b3461e985066842f8b9f179ce5eb3
Instruction Fuzzy Hash: ED0184F2D191149BE724C640DC41BF672B9F794311F0445EAD90E91680F3796A94CE56

Function 025FE76A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 025FFF17

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 11cb8807eb17062f059065f5fafddf635ff116c78eed47c7567a87d90a97826b
Instruction ID: 5abc00d85f5b15c5a72946c48ab1d8a77041e7ea7e2bfe3545a7b722946184df
Opcode Fuzzy Hash: 11cb8807eb17062f059065f5fafddf635ff116c78eed47c7567a87d90a97826b
Instruction Fuzzy Hash: 2601A7F2D08104ABF724C640DC46BF672A4F794315F0445AAD90DD15C0F37D6AD48E56

Function 025FE7FE Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 025FFF17

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b8b706ce64710e60c3f347da5b988c7a2e6aac3aa857b0ec478af8fd37546913
Instruction ID: 8d84cef0d7a9f139b4f217d722d42715b1d50427c702583f1af0420e56954245
Opcode Fuzzy Hash: b8b706ce64710e60c3f347da5b988c7a2e6aac3aa857b0ec478af8fd37546913
Instruction Fuzzy Hash: 8201A2F2D08104ABF724C640DC46BF672A8FB94311F0445AAE90ED15C0F3796AD5CE56

Function 02666919 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Part of subcall function 02667D28: CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 02667E45

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: bcae67c3d9b9acdf09f8975b3812972c845503f0829d52fce55444e68ba6f908
Instruction ID: 1e58d92d268a8ba2b8081de56cf08dfabe140f94449e2efe5b532b297fecbd18
Opcode Fuzzy Hash: bcae67c3d9b9acdf09f8975b3812972c845503f0829d52fce55444e68ba6f908
Instruction Fuzzy Hash: 57F0A4B18003585FEB289A24ED5DBFABA34FB40300F0042BED609551C1EA781AC2CE11

Function 025F37CC Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 025F3BFA

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 83f8953fb278223d6eb01589413b0805e1ebe4477ef4b99c4dc3caea40f87506
Instruction ID: 14ec22d79050566dced9f8d30a9ecfdb6af4a832acce75a555ebda72ec21d125
Opcode Fuzzy Hash: 83f8953fb278223d6eb01589413b0805e1ebe4477ef4b99c4dc3caea40f87506
Instruction Fuzzy Hash: 64F096B1E442999BF764CE14CC41BBAB375FB84300F1081FBE90957280E6356E91CE59

Function 025FD4E0 Relevance: 1.5, APIs: 1, Instructions: 34injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 025FE04F

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 135e001c787a82d035a94c887df20ab25cafb799b5ad27b119333aac90e82db9
Instruction ID: 38331eba580dc0d89064ed1ffa6e4b13775978c0f37d6f75a85a7e2124a97305
Opcode Fuzzy Hash: 135e001c787a82d035a94c887df20ab25cafb799b5ad27b119333aac90e82db9
Instruction Fuzzy Hash: 5DF068B1A050189BE754CA54DD45BF7B3B4FF48300F0441DEE50E52190E6316E91CE96

Function 02667793 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Part of subcall function 02667D28: CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 02667E45

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 448d189ead53b3def959def02216cc2e1f4d3aa8ebab3d5930795281ddf1cd26
Instruction ID: 59c248ef61f40b5b8cc142a010f7b2bd83c89abf7ee3d818f8fafd8ea2f3d3d1
Opcode Fuzzy Hash: 448d189ead53b3def959def02216cc2e1f4d3aa8ebab3d5930795281ddf1cd26
Instruction Fuzzy Hash: 01F08CB1D006A89FDB25CB24CC84AE9BB79EB85304F0081DAD54867240DA315BC6CF50

Function 026678D6 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Part of subcall function 02667D28: CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 02667E45

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: fe7e609af3292c3546857f3cf121255dc13b01611b01fd423a6f311fc9692a3b
Instruction ID: f25e283b2339a035e7c9d7324860875f83e46b30b8f77a5a2c2e9125495f490d
Opcode Fuzzy Hash: fe7e609af3292c3546857f3cf121255dc13b01611b01fd423a6f311fc9692a3b
Instruction Fuzzy Hash: B6F044B0D002589FD725DB14CC48AFABB75EF84314F0045EFD50DA6140DA745AC5CF50

Function 02667CA7 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Part of subcall function 02667D28: CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 02667E45

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 68c5489cf6d1d8e22ae64941a9d19762e68c9932267ce05407d5b74b5735c244
Instruction ID: fb107c65734d7cb1bbdb1f88c2ec2f733b517d08c11b837c20cd2990395c8720
Opcode Fuzzy Hash: 68c5489cf6d1d8e22ae64941a9d19762e68c9932267ce05407d5b74b5735c244
Instruction Fuzzy Hash: 72F04970900668AFDB25CB20CC48AE9BB75FB84301F0089DAD559EA240DA354BC1CE00

Function 025FDADF Relevance: 1.5, APIs: 1, Instructions: 30injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 025FE04F

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0e40751da3ef764ee18f16ec1b8a89ff408a0814cb9b74e6a84c8518c117d3f7
Instruction ID: 185af36dddb04e4cff4b2acf5c3af91451055831326b6ab4149fdcffacec4ba9
Opcode Fuzzy Hash: 0e40751da3ef764ee18f16ec1b8a89ff408a0814cb9b74e6a84c8518c117d3f7
Instruction Fuzzy Hash: A2F0F4B1E051189BDB64CA54DD84AE6B3B4FF89300F5442D9DA0DA3250E7315F81CF96

Function 026677A4 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Part of subcall function 02667D28: CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 02667E45

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 3faad0f40d220c8ec74d9f26f34309b2635928add10916f9569ec1832ec9ec43
Instruction ID: 5b67df0dca07e438ad15dca9ba4bccb65d9c3b30cb10135cc901245d846ec1b1
Opcode Fuzzy Hash: 3faad0f40d220c8ec74d9f26f34309b2635928add10916f9569ec1832ec9ec43
Instruction Fuzzy Hash: 8EF067B0D00368AFDB25CF20CC84AEABB79FB84310F0081DAC109A6280EA304AC2CF10

Function 025FDBA3 Relevance: 1.5, APIs: 1, Instructions: 29injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 025FE04F

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b1aff16b8bdcd31f3f37d4aae3db6e8b714624298fb7c20f2b34d5e9c875f76e
Instruction ID: d81809ed227f19af1f9e4682637c10b3a7a2a327ceb246907ebf2a25646db70e
Opcode Fuzzy Hash: b1aff16b8bdcd31f3f37d4aae3db6e8b714624298fb7c20f2b34d5e9c875f76e
Instruction Fuzzy Hash: E6F0FFB1E051189BDB64CA54CD84AEAB3B8AF89300F0442DAA90DA3250E7316E81CF56

Function 025FDFF1 Relevance: 1.5, APIs: 1, Instructions: 29injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 025FE04F

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e2f63ffd29e5d94cba0bec690c390b3efab864b9805de005b0cf9e1a53b3a520
Instruction ID: 3bb341104573d3396fcb4b46b7d06881d778f4dc42696d985ab7bae6cf63ba87
Opcode Fuzzy Hash: e2f63ffd29e5d94cba0bec690c390b3efab864b9805de005b0cf9e1a53b3a520
Instruction Fuzzy Hash: 11F01DB1E051289FDF64CA54DD84AEAB3B8BF89300F4441DAE90DA3250E7316E81CF96

Function 026678EA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Part of subcall function 02667D28: CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 02667E45

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d0be28a2835c93afe184093d53773b2c52e427bc5cadba6ec79f2428fadb03f1
Instruction ID: 7ef4dae732be48b6468205f9bead502f232250545619a633b066cff0d33ca45c
Opcode Fuzzy Hash: d0be28a2835c93afe184093d53773b2c52e427bc5cadba6ec79f2428fadb03f1
Instruction Fuzzy Hash: BDF01DB0D007689FDB26CF14CC44AE9B775FF84311F0085EAD109A6240EA344AC2CF10

Function 025F37E3 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 025F3BFA

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 68e805f99a01c02851e8d8f578f6ff4c95bd416216e4e4208ba65a1eae89be69
Instruction ID: 6e86597be26821f25e31bcce97c3701c9a242bfd445467cc394f5c08e0d7448b
Opcode Fuzzy Hash: 68e805f99a01c02851e8d8f578f6ff4c95bd416216e4e4208ba65a1eae89be69
Instruction Fuzzy Hash: A2F08970A442599BDB28CF15CC81FA9B3B5FF48300F5041EAD50997290EA356D90CF45

Function 02667863 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Part of subcall function 02667D28: CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 02667E45

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 270a9b3a9af1d5b4578dbf262818f00e60c35a067b39fcfdf32ac48afd64c1ff
Instruction ID: 4534b1a05b8f917d0ed5735ddbd6d1566b58b8bf0bb1a9def0954dc8b9480e63
Opcode Fuzzy Hash: 270a9b3a9af1d5b4578dbf262818f00e60c35a067b39fcfdf32ac48afd64c1ff
Instruction Fuzzy Hash: CBF03AB0D10668AFDB29DB14CC88AE9BB75EB84715F0081EED509A6280EA355BC6CF10

Function 025F36A3 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 025F3BFA

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a05081bcd1f2b28f2c9ab6a4d541706f79151fa330375731944a5fcfb281f714
Instruction ID: 4fbf8c347304d3682eff120a3ad5280a9a6b028836d80d0ea95283cae4b9baf1
Opcode Fuzzy Hash: a05081bcd1f2b28f2c9ab6a4d541706f79151fa330375731944a5fcfb281f714
Instruction Fuzzy Hash: A9F03771E442599BDB28CE14CC81FB9B775FB44601F4041DAD909A7280EA316E90CF55

Function 0266694E Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 02667CFA

Part of subcall function 02667D28: CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 02667E45

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 2be231e7c47b203d3ab4ee8215e99433f34df57f34a1c791668247d8cc72e55d
Instruction ID: 44b36792aa799ea23048c0de0271292f1fd6251590e6b8d34fa4ec6f04e465bd
Opcode Fuzzy Hash: 2be231e7c47b203d3ab4ee8215e99433f34df57f34a1c791668247d8cc72e55d
Instruction Fuzzy Hash: 06F030B1900368AFEB25DF20CC49BEABB75FB44305F0085DED149A6180EA755AC5CF10

Function 025F282D Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 025F3BFA

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 792b60c2d4b6dc0eadc9e5702d048cccf3db3187c7f0cd0b7ac3c4acabbecc96
Instruction ID: 75b5914b2c7ce5a8aca41b5141664ae72981bde1b963837ba71c597d82ac3df9
Opcode Fuzzy Hash: 792b60c2d4b6dc0eadc9e5702d048cccf3db3187c7f0cd0b7ac3c4acabbecc96
Instruction Fuzzy Hash: 63E0D8B1B442489BE724CA15CC85FA9B3A5FB40300F0001D7EA0AE71C0EAB569D0DF9A

Function 025F30A2 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 025F3BFA

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 38a4ba94fee793d57ed5484c0a5f21a4b923d31a6608decea36dca74e7c8f150
Instruction ID: e4b15fec1f6cab72e9992dfb4633b29a5778de7161347a252b3c36f11d953c7c
Opcode Fuzzy Hash: 38a4ba94fee793d57ed5484c0a5f21a4b923d31a6608decea36dca74e7c8f150
Instruction Fuzzy Hash: 54E0D8B1A44258A7E724CA14DC81FA5B3A5FB04200F5001DBEA0AA72C0EA366990CF9A

Function 025F36CF Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 025F3BFA

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: fa1fab9af295c091cb70130e66672ae43538fbf161cf5234f9f5aaf769a9250f
Instruction ID: de695c6f843a529c61e9446749ead80b09048bffabde0908699c72886c6123a4
Opcode Fuzzy Hash: fa1fab9af295c091cb70130e66672ae43538fbf161cf5234f9f5aaf769a9250f
Instruction Fuzzy Hash: E5F06570E8425EDBDB28CF10CC81FB9B775FB44601F0041DAD909A7280EA316E90CF59

Function 02667E1F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 02667E45

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 02674f7c98431bbd9e2ea608363d93232d170d753f83e375fa5e566f5abdc42d
Instruction ID: 5661f35b2e025565a6a2b56f8b79f77bb370a088264df5abe2032236d4798514
Opcode Fuzzy Hash: 02674f7c98431bbd9e2ea608363d93232d170d753f83e375fa5e566f5abdc42d
Instruction Fuzzy Hash: 61E06DF0840368AFEB208B51DC84AEBBBB4FB44710F1145EAE548A6541E6745FC4CF52

Function 026029F9 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 02603D9D

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 22eb1ef79d5092128ceb8db3efc50112a16ed5853035b7caad7f132885c71ae8
Instruction ID: 7920c926b9686ae9027d5e98fe7e6916299f7ce6ae66def7ee6a1ecdca4a2fea
Opcode Fuzzy Hash: 22eb1ef79d5092128ceb8db3efc50112a16ed5853035b7caad7f132885c71ae8
Instruction Fuzzy Hash: 50E0EDB19591189BDB28DB54DC84AEAB374BB48311F1041CAE80E632C0DA709E91DF95

Function 025FB567 Relevance: 1.5, APIs: 1, Instructions: 212memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 025FB9B1

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 312f2eb45a709e00064cea34ef16a9697ac4e7d29ae3293fe0c717a75fee07bd
Instruction ID: e8b25179ced0b951ee627798ce37ba3dbf7513f1c6aab59cb0336f919a23454b
Opcode Fuzzy Hash: 312f2eb45a709e00064cea34ef16a9697ac4e7d29ae3293fe0c717a75fee07bd
Instruction Fuzzy Hash: D171F2B2D052249FE764CA14CCC0BEA77B5FB84318F1841FAD90D56640D2396FC1CE96

Function 025E5ED5 Relevance: 1.4, APIs: 1, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 58d65d6c63d75e496629591fbeefeb18ba06b48bf27562f2e3faf3580362e04f
Instruction ID: b72a64760c8e87d007992535b930e55779642c484c0dfc240f7c64cc97d521f7
Opcode Fuzzy Hash: 58d65d6c63d75e496629591fbeefeb18ba06b48bf27562f2e3faf3580362e04f
Instruction Fuzzy Hash: 066100F2C00114AFFB288A14DD98BFB776DEB80319F1482BAD90A96580D77D5FC5CA16

Function 025E5B13 Relevance: 1.4, APIs: 1, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 354c5609520c40c95d15a2865492b763bdb5f1730b22de0494fa2aefd643f007
Instruction ID: 42fd59107ce04734aaac4ba054498a855479e933f5f16d6241884d8c185f5f78
Opcode Fuzzy Hash: 354c5609520c40c95d15a2865492b763bdb5f1730b22de0494fa2aefd643f007
Instruction Fuzzy Hash: CF610FB2C001249FFB288A14DD98BFB7B6DEB80358F0441BAD90E96180D7795FC5CE56

Function 025E59E9 Relevance: 1.4, APIs: 1, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1b7e08e8bd2293582f6d98d0f66cd7f8fd2fb4a2b2ff81d38336ebbc7974b741
Instruction ID: a66ee3b2cebf53d6075e198d73cf496e38d69497162436b831dd200d350a5aef
Opcode Fuzzy Hash: 1b7e08e8bd2293582f6d98d0f66cd7f8fd2fb4a2b2ff81d38336ebbc7974b741
Instruction Fuzzy Hash: 946120B2C001149FFB288A14DD98BF7776DFB80318F1441FAE90A9A280D7795EC5CE16

Function 025E5AB2 Relevance: 1.4, APIs: 1, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 02a6fe4f141a858dc833e010f837b794eed4285fb79b615b99c1127e3da61924
Instruction ID: 21fb87108c936c4bf38e02ec1a3d50cb0835312cc730f05a9c2b5cca98dd2c30
Opcode Fuzzy Hash: 02a6fe4f141a858dc833e010f837b794eed4285fb79b615b99c1127e3da61924
Instruction Fuzzy Hash: E0511EB2D001149FFB288A14DD88BFB776DFB90309F1481FAD90A96280D7795EC5CE16

Function 025E59FA Relevance: 1.4, APIs: 1, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f064f53823ab122bafbdb8a69dd860cd804adcc1e31eb380120065bad1fdcdc1
Instruction ID: 6864a7df6d9771549983b0f01f3887158ac91bcf679d825fca546800d3479c32
Opcode Fuzzy Hash: f064f53823ab122bafbdb8a69dd860cd804adcc1e31eb380120065bad1fdcdc1
Instruction Fuzzy Hash: D0510FB2C001149FFB288A14DD98BFB77ADFB80359F1441FAE90A96280D7795EC5CE16

Function 025E5A26 Relevance: 1.4, APIs: 1, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 230894005fec40ac139e58c6a83b9c590f44580cb3c758bf65232b5b3b127b0c
Instruction ID: bf5e33f074acd9cf804a28c09141d4c16eba39647fdf66c0b683c24c4ca90b57
Opcode Fuzzy Hash: 230894005fec40ac139e58c6a83b9c590f44580cb3c758bf65232b5b3b127b0c
Instruction Fuzzy Hash: FF5110B2C001149FFB288A14DD98BFB776DFB80349F1441FAD90A96180D7795EC5CE16

Function 025E6683 Relevance: 1.4, APIs: 1, Instructions: 172memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 025E6AF4

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0a0f527f4ee5f169ca7f9049ab2e0377e5d370517538585429f81be7e27a8506
Instruction ID: c6f0e0effeefa4c00865c6c667e9e7958108366901e531e1472cdb2156c37fc4
Opcode Fuzzy Hash: 0a0f527f4ee5f169ca7f9049ab2e0377e5d370517538585429f81be7e27a8506
Instruction Fuzzy Hash: 30510EB2D00118AEFB288A14DD88BFB7B69EB90358F0441FAD90A56280D63D5EC5CA56

Function 025E66AA Relevance: 1.4, APIs: 1, Instructions: 160memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 025E6AF4

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f446aabc4ac296d4dfbb825df3d3c535c451b6edb825beffc38f802254278cbe
Instruction ID: 72da85644193fa22adf6c87b09d3b38c5d6676f205c42bf76445683683958fc9
Opcode Fuzzy Hash: f446aabc4ac296d4dfbb825df3d3c535c451b6edb825beffc38f802254278cbe
Instruction Fuzzy Hash: 3351DDB2D00129AEFB288A04DD88BFB776DFB90359F0401FAD90A56280D7795EC5CE56

Function 025E657B Relevance: 1.4, APIs: 1, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 025E6AF4

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 38f06009eda9c9bad395465b44af1f9589143142f52ce03b2eb72327f50918dd
Instruction ID: 5442ab54727ff7150f366ff96869a8969b4345e12f6cf37f31b5707b4212568d
Opcode Fuzzy Hash: 38f06009eda9c9bad395465b44af1f9589143142f52ce03b2eb72327f50918dd
Instruction Fuzzy Hash: 8A51E0B29001159EFB288A14DD98BFB7B7DEB80358F0441BAD90A96280C77D5EC4CA56

Function 025E664E Relevance: 1.4, APIs: 1, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 025E6AF4

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: baf54a6f768b6373811f33f8ce411b798ae8017b041eac41a2233635892c3b62
Instruction ID: d13e36e89736988dc9ff70ce9f8b73aca4eb942188b18f09e8e34a021f795c71
Opcode Fuzzy Hash: baf54a6f768b6373811f33f8ce411b798ae8017b041eac41a2233635892c3b62
Instruction Fuzzy Hash: 4D512FB2900115AFFB288A04EC88BFB7B6DFB80358F0441FAD90A56280C77D5EC5CE56

Function 025E6AAF Relevance: 1.4, APIs: 1, Instructions: 139memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 025E6AF4

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d54e8d0d13bd3efd467713e876ffd5fee0b5793c6a594bdc1af3b72e7b90627d
Instruction ID: 81ca1357a50bd0eaa8af63d10ce60bdfc40dc6f18e48140c5d17ccfb1cdb253d
Opcode Fuzzy Hash: d54e8d0d13bd3efd467713e876ffd5fee0b5793c6a594bdc1af3b72e7b90627d
Instruction Fuzzy Hash: 4B51FDB29001199EFB288A14DD88BFB776DFB80359F0401FAD90A56280C7795EC4CE16

Function 025E65D5 Relevance: 1.4, APIs: 1, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 025E6AF4

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a4456b2b4088a4e605b348bbf2e3e39d63734f1f33fe99ed6eb20fb36aa9cd15
Instruction ID: 06380551cd22fb5da31077aea1d0b85cc2ca02b63cc638ba04826f4cb206ceeb
Opcode Fuzzy Hash: a4456b2b4088a4e605b348bbf2e3e39d63734f1f33fe99ed6eb20fb36aa9cd15
Instruction Fuzzy Hash: CB41FDB2900119AFFB288A14DD88BFB777DFB90359F0401FAD90A56280C7795EC4CE16

Function 025FB3DD Relevance: 1.4, APIs: 1, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 025FB9B1

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 908937f9e69040dcfeda65bee689a249c3571e81e6f9c6f14399b0c8dd40d4ca
Instruction ID: d782d2aed40cf2eaa5a8e24d188e32ed404bdab339af75e5aef9f30d3a484bbe
Opcode Fuzzy Hash: 908937f9e69040dcfeda65bee689a249c3571e81e6f9c6f14399b0c8dd40d4ca
Instruction Fuzzy Hash: 8041E4B2E05218DFE7A48A14CC84BEB7B75FB94318F1481FADA0D66240E3385AC1CE56

Function 025F050B Relevance: 1.4, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 583b744148275876dffe04835bd5f2a85a0dcb0707f91dfe8c87b98b43b16a0f
Instruction ID: 25a41c7d3a2329aaed93adc0cbd878282100382a42c334b74bd62f6154f03ae1
Opcode Fuzzy Hash: 583b744148275876dffe04835bd5f2a85a0dcb0707f91dfe8c87b98b43b16a0f
Instruction Fuzzy Hash: 2D4179B3D0A2689FE7648A14CC88BE77B71FB85318F0505F6C90D96181D2385AC6CF42

Function 025FB39A Relevance: 1.3, APIs: 1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5f700b2fd179c74b3c5da152240e003de131c4a611fc4ae1014553920706e933
Instruction ID: f13a0ed7dbf77512a25d36b0570cc2c1f03137036d6a7f4a38568d8e80c440f9
Opcode Fuzzy Hash: 5f700b2fd179c74b3c5da152240e003de131c4a611fc4ae1014553920706e933
Instruction Fuzzy Hash: 1B3159B3E062589FE7648614CC88BEB7B71FB85328F0442F6C90D67280D23C5AC5CE92

Function 025EF7CA Relevance: 1.3, APIs: 1, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 025EFCC5

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f8d83f6c26e90f5461e2ab91cac58bae0207c9db580c86ae674b9c6a69047613
Instruction ID: 6201bf1e95ca31756bc4aeef303100275338a8e8ac1630e471a48c20a8707129
Opcode Fuzzy Hash: f8d83f6c26e90f5461e2ab91cac58bae0207c9db580c86ae674b9c6a69047613
Instruction Fuzzy Hash: A52109F2D442249FF7248A24DD85BE77B74FB80325F1081B6D90E66AC0D6791EC0CE95

Function 025EF6F9 Relevance: 1.3, APIs: 1, Instructions: 70memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 025EFCC5

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 918570a39286bdcee2f66152ec622b364b7e033d8de73e406d43bb9f2aa301ca
Instruction ID: 3c5d7edc8405adf3646126e2206feeb8e190359be598714fd3ffca1e147fee8b
Opcode Fuzzy Hash: 918570a39286bdcee2f66152ec622b364b7e033d8de73e406d43bb9f2aa301ca
Instruction Fuzzy Hash: 602134B09042158FFB288A20DD40BFBB778FB84315F2040FAD84A62680CB755EC0CE56

Function 025FB913 Relevance: 1.3, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 025FB9B1

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 23aa8d0411e6f79c08fcd945bb8308b3c23dd9a569cd6f5cbe0bc154b10bab36
Instruction ID: ea76bd574d2994c157bd5efee0911b71716dc0ff18a2800d0b9c18fbc1c99a0a
Opcode Fuzzy Hash: 23aa8d0411e6f79c08fcd945bb8308b3c23dd9a569cd6f5cbe0bc154b10bab36
Instruction Fuzzy Hash: 3911B2A1D09218EAFB608A15DC88BEABB74EB84318F0441B7DD0D55180D3751AC5CE57

Function 025EF7D5 Relevance: 1.3, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 025EFCC5

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0961451b79378e9aa9167288cb439646d552bf000e5f055744d09c066d829e5e
Instruction ID: 1d1fc8d3a38e0b97573fb0c1c110f6cdd3f0baf52cb4eed1b67f66df29042652
Opcode Fuzzy Hash: 0961451b79378e9aa9167288cb439646d552bf000e5f055744d09c066d829e5e
Instruction Fuzzy Hash: 4B01D6B2D452298FEB388A24CC45BE677B0F744319F1041F6DA4EA76C0CA394DC0CE85

Function 025EF7DC Relevance: 1.3, APIs: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 025EFCC5

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f33aa0f522f5223469725de58cee0f5e68a97a8a709dae92ae86d5f2692a1b25
Instruction ID: 749b33e5a1e89c626e988f8669abf6368271fed850447bd2e8bcca7b2ed5d046
Opcode Fuzzy Hash: f33aa0f522f5223469725de58cee0f5e68a97a8a709dae92ae86d5f2692a1b25
Instruction Fuzzy Hash: 1901A1B2D452258FEB388A24CD45BDA7BB0FB04315F1041FADA4E676C1C6394DC0CE85

Function 025EFC41 Relevance: 1.3, APIs: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 025EFCC5

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 43bb41686f7f0f7ac6d7483c08cb66978dbe318e1d40c45293ca5861db9e423e
Instruction ID: 5bf66d0ffad945e1f319c3f90ce70c28077acbf0c6f9123c28b6260c60564315
Opcode Fuzzy Hash: 43bb41686f7f0f7ac6d7483c08cb66978dbe318e1d40c45293ca5861db9e423e
Instruction Fuzzy Hash: 860104B0C4C3A98FDB249B20CC45B99BBB0BF05319F1001EAD94E665C1DB7109C0CF9A

Function 025EF120 Relevance: 1.3, APIs: 1, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 025EFCC5

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9970fd5587f6cdcabfed28c56e8c3b5fb5f1449a5326cbaed996bc5ba3c56ac5
Instruction ID: c576dde8b7917593336c5e0de5b6b7e51dc48279410b909cbdf16ae7f3ab4c01
Opcode Fuzzy Hash: 9970fd5587f6cdcabfed28c56e8c3b5fb5f1449a5326cbaed996bc5ba3c56ac5
Instruction Fuzzy Hash: 8901FC71D052298BEB284A21CC09FA6F770BB04315F0041F7EC4E661C0DB740A80CF85

Function 025EE8D6 Relevance: 1.3, APIs: 1, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a82df661c526cf609cf7618d10d447e7171659dfc1904b298681c9d246505047
Instruction ID: f9edbefc8011be117fecb5774bc59cae614cb90320de336146ea2d69d683ad47
Opcode Fuzzy Hash: a82df661c526cf609cf7618d10d447e7171659dfc1904b298681c9d246505047
Instruction Fuzzy Hash: 90F02BB2E8D3595FEB245A208C457AA7B20BB41325F2501EBDF8A250C3DB750981CF8A

Function 025EF156 Relevance: 1.3, APIs: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 025EFCC5

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d3e79a509dcacd0b0be86c35c5286a1d36554314773393c82342e62197d46432
Instruction ID: b859a6687764ae53b41fc230a6b7bf5012ad1a55c0651e9cbeb20a5ce837e801
Opcode Fuzzy Hash: d3e79a509dcacd0b0be86c35c5286a1d36554314773393c82342e62197d46432
Instruction Fuzzy Hash: 27F05C72D4826D5EF7240661DC09F67BB60F701329F0002B7DD8E265C08BB50991CFCA

Function 025EF75B Relevance: 1.3, APIs: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 025EFCC5

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e3887bd73793430547e485f1c66a1f45bc202ae95103271211f30a2646146339
Instruction ID: 54b028a6d6617bc9ed9daf7d4a70a274079c86368aff3a7fe1c9859fcefc55de
Opcode Fuzzy Hash: e3887bd73793430547e485f1c66a1f45bc202ae95103271211f30a2646146339
Instruction Fuzzy Hash: 2EF0B471E882199FEB2C9A108C45B76B6A0F744315F6046EAD94B155C0CB7009C1CF89

Function 025EF76A Relevance: 1.3, APIs: 1, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 025EFCC5

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0f70e15cee615d5c0914786b8c9c03c99b80ae370ab9aae99e752b8f5f4747c4
Instruction ID: 7c2efababd3d8558dd4efc5d4ae48ea2cc798c0c22c86742d0f2c12acf0da2e5
Opcode Fuzzy Hash: 0f70e15cee615d5c0914786b8c9c03c99b80ae370ab9aae99e752b8f5f4747c4
Instruction Fuzzy Hash: 51F0A770D882199FEB289E10CC45BAAB670FB44315F5042DAEA4F662C0CB710DC0CE89

Function 025EFC6B Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c974bed44b97bc14f19a46e553caabb9276d068b924b1d6257c3b92a031f52c8
Instruction ID: c994b5448394ff743ad7cc15e39f6787176d778a12143f2980c077341985ea97
Opcode Fuzzy Hash: c974bed44b97bc14f19a46e553caabb9276d068b924b1d6257c3b92a031f52c8
Instruction Fuzzy Hash: C4F089B1D4822A9EEB349A208C457A9B670B745729F1041E6DD0F765C0DB705DC0CEDA

Function 025EF167 Relevance: 1.3, APIs: 1, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 025EFCC5

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 69e55553f5854c4274b12718ced71b61ab473e4b7902bb1f02f495ff8c8b4686
Instruction ID: 6c711ddd30fc2a13e8117b333ff1d6cfcfe312bad0b10afff53a6f9572068710
Opcode Fuzzy Hash: 69e55553f5854c4274b12718ced71b61ab473e4b7902bb1f02f495ff8c8b4686
Instruction Fuzzy Hash: E7F0ECB098C3469EE72446105C097557BA0BB4532DF5401EBDD4A591C1D7F606D2CF87

Function 025EE8F2 Relevance: 1.3, APIs: 1, Instructions: 25memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 025EFCC5

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8acfb94772938270645ce94d82b41fffa0a4a94a6e0e34f9d4c1651f84cacd7b
Instruction ID: 086aa46fb73daaac7a5bf3e9054f129a321564eb480178f47df08f9ea075e00c
Opcode Fuzzy Hash: 8acfb94772938270645ce94d82b41fffa0a4a94a6e0e34f9d4c1651f84cacd7b
Instruction Fuzzy Hash: FAE092B3F892059AF7245510CC09BA9B660B740729F6501F7DA4E2A5C0DBB50980CD8A

Function 025EFC7C Relevance: 1.3, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 025EFCC5

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b1df66e949bb2929a3f2d09d53f7f20a228648c06dc240de354995ee2ac55112
Instruction ID: b448dd699f0dd027418cc9863f81697b80c5ee0b4b4e16f7e8a2fcf82608193e
Opcode Fuzzy Hash: b1df66e949bb2929a3f2d09d53f7f20a228648c06dc240de354995ee2ac55112
Instruction Fuzzy Hash: DFF03771D892299EDB349A148C457A5B670B704319F5001E6DE0E266C0DB711EC0CEC9

Non-executed Functions

Function 025E1F3C Relevance: 26.6, Strings: 21, Instructions: 338COMMON

Download Yara Rule

Strings

M, xrefs: 025E24AF
G, xrefs: 025E249A
a, xrefs: 025E24E0
e, xrefs: 025E24A1
3, xrefs: 025E2241
u, xrefs: 025E24C4
OBIN, xrefs: 025E2488
3, xrefs: 025E2047
E, xrefs: 025E2503
x, xrefs: 025E250A
l, xrefs: 025E24F5
e, xrefs: 025E24D2
l, xrefs: 025E24CB
d, xrefs: 025E24BD
e, xrefs: 025E24FC
W, xrefs: 025E2511
H, xrefs: 025E24D9
n, xrefs: 025E24E7
o, xrefs: 025E24B6
t, xrefs: 025E24A8
d, xrefs: 025E24EE

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID: ContextThreadWow64
String ID: E$G$H$M$OBIN$W$a$d$d$e$e$e$l$l$n$o$t$u$x$3$3
API String ID: 983334009-780640683
Opcode ID: ef19a461417219580b49e34330e332657820c932d5e9ee369dcbd88367777d9a
Instruction ID: 8cd15c41e86776787ab4de1063db6f4296612a46876cc84f2b72da105c4a254b
Opcode Fuzzy Hash: ef19a461417219580b49e34330e332657820c932d5e9ee369dcbd88367777d9a
Instruction Fuzzy Hash: 1DF17DB0D086A88AEB258B18DC446EABBB5FF95304F0480EAD94DA7340E7354FC5CF56

Function 025E212E Relevance: 25.3, Strings: 20, Instructions: 276COMMON

Download Yara Rule

Strings

M, xrefs: 025E24AF
G, xrefs: 025E249A
a, xrefs: 025E24E0
e, xrefs: 025E24A1
3, xrefs: 025E2241
u, xrefs: 025E24C4
OBIN, xrefs: 025E2488
E, xrefs: 025E2503
x, xrefs: 025E250A
l, xrefs: 025E24F5
e, xrefs: 025E24D2
l, xrefs: 025E24CB
d, xrefs: 025E24BD
e, xrefs: 025E24FC
W, xrefs: 025E2511
H, xrefs: 025E24D9
n, xrefs: 025E24E7
o, xrefs: 025E24B6
t, xrefs: 025E24A8
d, xrefs: 025E24EE

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: E$G$H$M$OBIN$W$a$d$d$e$e$e$l$l$n$o$t$u$x$3
API String ID: 0-2996905995
Opcode ID: 40de5ef9a87081e6dbb5c1b22fcac0fce8441a0b8ddaad7123897580292125ea
Instruction ID: a21410a49189768955b1aa6d8ad310db8d3f01962daf54df4b50983a551cf5ca
Opcode Fuzzy Hash: 40de5ef9a87081e6dbb5c1b22fcac0fce8441a0b8ddaad7123897580292125ea
Instruction Fuzzy Hash: 1DC1A2B0C086A89AFB258B28DC457EAB7B5FF55304F0480EAD94DA6240E7354FC5CF56

Function 025E22D5 Relevance: 24.0, Strings: 19, Instructions: 220COMMON

Download Yara Rule

Strings

M, xrefs: 025E24AF
G, xrefs: 025E249A
a, xrefs: 025E24E0
e, xrefs: 025E24A1
u, xrefs: 025E24C4
OBIN, xrefs: 025E2488
E, xrefs: 025E2503
x, xrefs: 025E250A
l, xrefs: 025E24F5
e, xrefs: 025E24D2
l, xrefs: 025E24CB
d, xrefs: 025E24BD
e, xrefs: 025E24FC
W, xrefs: 025E2511
H, xrefs: 025E24D9
n, xrefs: 025E24E7
o, xrefs: 025E24B6
t, xrefs: 025E24A8
d, xrefs: 025E24EE

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: E$G$H$M$OBIN$W$a$d$d$e$e$e$l$l$n$o$t$u$x
API String ID: 0-4042089635
Opcode ID: b07f4c8c97c9992f836295cdd634e58df32fd1d06033568697540060a1ea597c
Instruction ID: 2ea7341b482382b235ef1badb8b8703cc84158901a3268a130d72c4fe15d71aa
Opcode Fuzzy Hash: b07f4c8c97c9992f836295cdd634e58df32fd1d06033568697540060a1ea597c
Instruction Fuzzy Hash: 2A8148A1C086989AF7258728DC04BEB7B75FF51304F0480F9D98D96680EB3A4FC5CB66

Function 025E2327 Relevance: 24.0, Strings: 19, Instructions: 217COMMON

Download Yara Rule

Strings

M, xrefs: 025E24AF
G, xrefs: 025E249A
a, xrefs: 025E24E0
e, xrefs: 025E24A1
u, xrefs: 025E24C4
OBIN, xrefs: 025E2488
E, xrefs: 025E2503
x, xrefs: 025E250A
l, xrefs: 025E24F5
e, xrefs: 025E24D2
l, xrefs: 025E24CB
d, xrefs: 025E24BD
e, xrefs: 025E24FC
W, xrefs: 025E2511
H, xrefs: 025E24D9
n, xrefs: 025E24E7
o, xrefs: 025E24B6
t, xrefs: 025E24A8
d, xrefs: 025E24EE

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: E$G$H$M$OBIN$W$a$d$d$e$e$e$l$l$n$o$t$u$x
API String ID: 0-4042089635
Opcode ID: e4ff268003b007ecac77b725dd5b4c817b49aac8575833741f8b4c68098075f3
Instruction ID: 7df339c51316687ef16dfb5fc10ef9b1c294bc2d8e27e7533c31f85cd161b51b
Opcode Fuzzy Hash: e4ff268003b007ecac77b725dd5b4c817b49aac8575833741f8b4c68098075f3
Instruction Fuzzy Hash: E28148A1C086989AF7258728DC04BEB7775FF51304F0480FDD58DA6680E77A0FC58B66

Function 025FBA3C Relevance: 22.9, Strings: 18, Instructions: 408COMMON

Download Yara Rule

Strings

e, xrefs: 025FC173
y, xrefs: 025FC1AB
e, xrefs: 025FC150
o, xrefs: 025FC19D
i, xrefs: 025FC142
s, xrefs: 025FC17A
c, xrefs: 025FC16C
t, xrefs: 025FC149
r, xrefs: 025FC1A4
r, xrefs: 025FC15E
e, xrefs: 025FC18F
o, xrefs: 025FC165
M, xrefs: 025FC188
s, xrefs: 025FC181
m, xrefs: 025FC196
P, xrefs: 025FC157
W, xrefs: 025FC134
r, xrefs: 025FC13B

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: M$P$W$c$e$e$e$i$m$o$o$r$r$r$s$s$t$y
API String ID: 0-3267982596
Opcode ID: 7ee22ebd26bf88c3ce5de3eaf8d08a57ed8d73b853d9e0b6721cf98a685b79ee
Instruction ID: 39decef06ab4d4b0c92828a094998eed32aaa0cc6be10bc26a452fba16afa58c
Opcode Fuzzy Hash: 7ee22ebd26bf88c3ce5de3eaf8d08a57ed8d73b853d9e0b6721cf98a685b79ee
Instruction Fuzzy Hash: DBF10FB1D082688BE764CA24DC84BEABBB1FB81304F0441FAD54D67281D7795EC5CF66

Function 025FBDD6 Relevance: 22.9, Strings: 18, Instructions: 354COMMON

Download Yara Rule

Strings

e, xrefs: 025FC173
y, xrefs: 025FC1AB
e, xrefs: 025FC150
o, xrefs: 025FC19D
i, xrefs: 025FC142
s, xrefs: 025FC17A
c, xrefs: 025FC16C
t, xrefs: 025FC149
r, xrefs: 025FC1A4
r, xrefs: 025FC15E
e, xrefs: 025FC18F
o, xrefs: 025FC165
M, xrefs: 025FC188
s, xrefs: 025FC181
m, xrefs: 025FC196
P, xrefs: 025FC157
W, xrefs: 025FC134
r, xrefs: 025FC13B

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: M$P$W$c$e$e$e$i$m$o$o$r$r$r$s$s$t$y
API String ID: 0-3267982596
Opcode ID: ba0d12c59aa6b29438d33a573197b07fd1cbbd5332d2f918b5c5a989eaad19c0
Instruction ID: bd30b1f8c55495b11a3190c6e4126a2ba63d3cacffea806fc87e5a1179682cf8
Opcode Fuzzy Hash: ba0d12c59aa6b29438d33a573197b07fd1cbbd5332d2f918b5c5a989eaad19c0
Instruction Fuzzy Hash: 1FE1AC71D082A88AEB24CB24CC44BEABBB1FB91304F0481FAD64D67681E7795EC5CF55

Function 025EC785 Relevance: 18.0, Strings: 14, Instructions: 464COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
A, xrefs: 025EDDA9
e|, xrefs: 025ECA55
l, xrefs: 025EDDB7
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
3, xrefs: 025ECAA6

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$e|$i$l$l$l$o$r$t$u$3
API String ID: 0-3593921935
Opcode ID: 864b623ad92583d1d32c4f2bdc1cb40b0008d94fbf0e5d947ff8f97d006108e6
Instruction ID: da75492237ca9e84406ad6acb0146c6561cbc6083fda6d28ff0e5220dfe90ba9
Opcode Fuzzy Hash: 864b623ad92583d1d32c4f2bdc1cb40b0008d94fbf0e5d947ff8f97d006108e6
Instruction Fuzzy Hash: 6C0224B1D046A88AEB288B28DC44BEABBB5FF95310F0441FAD84E62240D7795FC5CF55

Function 025ED871 Relevance: 16.4, Strings: 13, Instructions: 181COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
A, xrefs: 025EDDA9
l, xrefs: 025EDDB7
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
P<9<, xrefs: 025ED871
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$P<9<$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-168012158
Opcode ID: 8aec9e0363bdaf6517de40211b68d7c78934613deb7e37bc0f5d88b25753bb78
Instruction ID: df54bba7a627f0961891dc0fab83f6abbc221cd796df5e15912d66c08ae538a7
Opcode Fuzzy Hash: 8aec9e0363bdaf6517de40211b68d7c78934613deb7e37bc0f5d88b25753bb78
Instruction Fuzzy Hash: 3D6138E2C142949FF7258A24EC88BE77B7DE741310F0481FAD84E66281D6BD5BC5CB22

Function 025ED7A7 Relevance: 15.2, Strings: 12, Instructions: 243COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: 3f6d07aba9e066f48e6f6173bbf332e236dfc53c706cd1f05506384c77fd7c68
Instruction ID: 4d90c0f43cb2554958f1f2abc6b729d2786abbf7aefb1523dabcaad9d599cef8
Opcode Fuzzy Hash: 3f6d07aba9e066f48e6f6173bbf332e236dfc53c706cd1f05506384c77fd7c68
Instruction Fuzzy Hash: 3E8119A2D042949FF7258A24EC48BEB7B7DEB51310F0441FAD84E66281D6BD5BC5CB21

Function 025ED920 Relevance: 15.2, Strings: 12, Instructions: 233COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: f7c39a011319857aea736b4b0473959a64fd7a67f1eeca68179632505c0e4c8a
Instruction ID: ae20af05746fac18b582e9386440ee1a2a788956e88dc5ea11bf0aa2a0262bb7
Opcode Fuzzy Hash: f7c39a011319857aea736b4b0473959a64fd7a67f1eeca68179632505c0e4c8a
Instruction Fuzzy Hash: D28125F2C052549FFB198A14DC94BABBB79EB90310F0441FAD80E66281D6795FC5CB22

Function 025EDC30 Relevance: 15.2, Strings: 12, Instructions: 220COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: 215c1d359ad557557f1a944552d987be852ef1db03d46ffc6e410ed519f8f010
Instruction ID: 8afde8403aad0f8b5c3c658e410a272dd26f71fc2bd54c6af9aab7c280baee48
Opcode Fuzzy Hash: 215c1d359ad557557f1a944552d987be852ef1db03d46ffc6e410ed519f8f010
Instruction Fuzzy Hash: 21812DF2C086989FEB198624DC98BEB7B79FB41310F0441FAD84A56181D6BD1BC5CB21

Function 025EC852 Relevance: 15.2, Strings: 12, Instructions: 195COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: 83560c9bf57c878a92a3416a016677e3cf433627fde5dc5484187aa81d08f6f4
Instruction ID: f05d07fea0bf5696684491d12c37eee31e86fddc17bf86665cf64b6c3beb637d
Opcode Fuzzy Hash: 83560c9bf57c878a92a3416a016677e3cf433627fde5dc5484187aa81d08f6f4
Instruction Fuzzy Hash: 386158A2C082999FFB258624DC48BEA7F79EB51310F0441FBD44E66281C6BD5BC5CB22

Function 025EC90E Relevance: 15.2, Strings: 12, Instructions: 192COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: b010b89f30c46c9ea7478c22374f36ee93c059c94952ea263ac54bd311d2f0bd
Instruction ID: ad9085237d38518fc99abf3a09925a822290fd34684e1aee2b143ab87266cc42
Opcode Fuzzy Hash: b010b89f30c46c9ea7478c22374f36ee93c059c94952ea263ac54bd311d2f0bd
Instruction Fuzzy Hash: A8615AE2C046989FFB258624DC48BEB7B79E791310F0441FAD44A66281C6BD5BC5CB26

Function 025ED7D6 Relevance: 15.2, Strings: 12, Instructions: 190COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: 57e3bc91208c1cb33b5f29efdd93e7e9cd4b4073133240901ff69a30f01817bb
Instruction ID: d6a73087bb8386174d46a4b0291087975880d487f1dba19754d33aac71a93b84
Opcode Fuzzy Hash: 57e3bc91208c1cb33b5f29efdd93e7e9cd4b4073133240901ff69a30f01817bb
Instruction Fuzzy Hash: E36107A2C082949FFB294624EC48BEB7B7CE751350F0441FAD84E66281D2BD5BC5CB26

Function 025ED7BE Relevance: 15.2, Strings: 12, Instructions: 185COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: bd13571ac05a3531159b9afadcd6f729cb7c64f988b5043535aafa9be9f5ac8d
Instruction ID: 8e9da9cca1b5d3f7dc230f31f5565400548af0a60512dd1eabcd7fd7bd8a59dd
Opcode Fuzzy Hash: bd13571ac05a3531159b9afadcd6f729cb7c64f988b5043535aafa9be9f5ac8d
Instruction Fuzzy Hash: D651F6A2C182949FF7258624EC48BEB7B7CE751350F0441FAD84E66281D6BD1BC5CB62

Function 025EDC8E Relevance: 15.2, Strings: 12, Instructions: 183COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: 75e0cf030b77695c62329ea366a167ee81c6e767b013dc9edfe978ef69fe8433
Instruction ID: ea5912725ee2e7388929911d9a2da438a9b8d6e4538e2185d8a5917fe0933188
Opcode Fuzzy Hash: 75e0cf030b77695c62329ea366a167ee81c6e767b013dc9edfe978ef69fe8433
Instruction Fuzzy Hash: C5612BF1C086989FFB298624DC987EA7F79EB41310F0441FED44A66181D67D1BC5CB22

Function 025EDC86 Relevance: 15.2, Strings: 12, Instructions: 183COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: efb18092e994a782d30061788c1ea73f570b800d442da8242da99f6e532384ab
Instruction ID: 60e49c2c1922b89cdcd3a23328678f40037c175e6321520f44a7f21cb855a92d
Opcode Fuzzy Hash: efb18092e994a782d30061788c1ea73f570b800d442da8242da99f6e532384ab
Instruction Fuzzy Hash: 7E614DE1C086989FFB258624DC587EA7F79EB41310F0441FED44A66281D67D1BC5CB22

Function 025EDCF6 Relevance: 15.2, Strings: 12, Instructions: 168COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: 3a04f05199b8dc80ac94702b3c6223843eb84109c29a00cdd6c9c8d6dc43ef1d
Instruction ID: 676ffffdda3e7072293375b6c515905db1910f714405b23c88ca336e069d8485
Opcode Fuzzy Hash: 3a04f05199b8dc80ac94702b3c6223843eb84109c29a00cdd6c9c8d6dc43ef1d
Instruction Fuzzy Hash: B7513BE2C182989FFB258624DC58BEA7F7DEB51310F0440FED44A66181D6BD5BC5CB22

Function 025EC63D Relevance: 15.2, Strings: 12, Instructions: 164COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: 0cf56c97f2ca01c4a2ae2d89b346f45776ab32d83a46015ad9d49bcf20298dd3
Instruction ID: 2cb98f1f9102814f70e928ab75ed2d32d716d80de65ba61d09df5eca8be76315
Opcode Fuzzy Hash: 0cf56c97f2ca01c4a2ae2d89b346f45776ab32d83a46015ad9d49bcf20298dd3
Instruction Fuzzy Hash: 59514AE2C042989FFB258624DC48BEA7F69E751310F0840FAD44A66281C6BD5BC5CB26

Function 025EC637 Relevance: 15.2, Strings: 12, Instructions: 164COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: bbd7c913bc11fc58f33c4b518efd0c96e7b09b6db9993d02e93b76c8006595cc
Instruction ID: f87f7020d1b419af024e3a40f6cb05632ab22d586ff0c6e84065e1061a61d274
Opcode Fuzzy Hash: bbd7c913bc11fc58f33c4b518efd0c96e7b09b6db9993d02e93b76c8006595cc
Instruction Fuzzy Hash: 17513BE2C082989FFB258624DC48BEB7F79E751314F0841FBD44A66281C6BD5BC5CB26

Function 025ED809 Relevance: 15.2, Strings: 12, Instructions: 162COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: 423ed3db2635845648250a2f6e7b933d0fe3270bca9173c8a446d30727f5e3b9
Instruction ID: 7afc45bdc24e3d2ea9568d571c8cd2d9a5f56526ea424008eed9c977b11f22e9
Opcode Fuzzy Hash: 423ed3db2635845648250a2f6e7b933d0fe3270bca9173c8a446d30727f5e3b9
Instruction Fuzzy Hash: 92511AA2C182989FF7258624EC48BEB7F7DE751310F0440FAD84E66281C6BD1BC5CB62

Function 025ED950 Relevance: 15.2, Strings: 12, Instructions: 160COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: c416d0231ad9f83988a6a5e7cdad11fba59c72f638c1f12b4b6d6a7d91472061
Instruction ID: 8ba69f38281fc351b4444bd4108c79fa63ee78ef267ae187b7c87466a77b0757
Opcode Fuzzy Hash: c416d0231ad9f83988a6a5e7cdad11fba59c72f638c1f12b4b6d6a7d91472061
Instruction Fuzzy Hash: 405129E2C182989FF7158624EC58BA77F7CE751310F0441FAD44E66281D6BD1BC5CB26

Function 025EDD24 Relevance: 15.2, Strings: 12, Instructions: 155COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: 719d44db2a8cee1fe50de257dfcf9122b620852640b4824127cd1521110388d9
Instruction ID: baebd7af4b26dacaed9a1840b0b749fab6fe9aec867344d7500ae9f2f2fb02d5
Opcode Fuzzy Hash: 719d44db2a8cee1fe50de257dfcf9122b620852640b4824127cd1521110388d9
Instruction Fuzzy Hash: 875128E2C182989FF7258624EC58BE77B6CE751310F0440FAD84E66281D6BD5BC5CB26

Function 025ED96E Relevance: 15.2, Strings: 12, Instructions: 152COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: e6e22356fc6080e0fe48eb9d395d3ea7c5c57d19d050d6de8daf6192a00a06cd
Instruction ID: 7f2b4912e7e244ab6e308c4825cb777badeeeb862b1dc100dc59aad20173879a
Opcode Fuzzy Hash: e6e22356fc6080e0fe48eb9d395d3ea7c5c57d19d050d6de8daf6192a00a06cd
Instruction Fuzzy Hash: E35139E2C182989FF7258624EC48BEA7F7DE751310F0441FAD84E66281C6BD1BC5CB22

Function 025EC9A1 Relevance: 15.2, Strings: 12, Instructions: 152COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: d22379301c28db30f1d4161d659939aac742bb1c1e0e7d33b551be9371f5a487
Instruction ID: 8832ef03b325a446ec1a6f89188a9d3cc606e93c17799de0074d2aa67e3bb72f
Opcode Fuzzy Hash: d22379301c28db30f1d4161d659939aac742bb1c1e0e7d33b551be9371f5a487
Instruction Fuzzy Hash: E1515DE2C182989FF7258624DC487E67F6CE751314F0840FAD44A66281C6BD5BC5CB22

Function 025ED82E Relevance: 15.1, Strings: 12, Instructions: 149COMMON

Download Yara Rule

Strings

a, xrefs: 025EDD9B
t, xrefs: 025EDD8D
c, xrefs: 025EDDC5
A, xrefs: 025EDDA9
l, xrefs: 025EDDB0
V, xrefs: 025EDD78
i, xrefs: 025EDD7F
o, xrefs: 025EDDBE
u, xrefs: 025EDD94
l, xrefs: 025EDDA2
r, xrefs: 025EDD86
l, xrefs: 025EDDB7

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: A$V$a$c$i$l$l$l$o$r$t$u
API String ID: 0-1474867871
Opcode ID: ab14c8ba6b8ec7c28ede62265899ec88fb53fd6d075de9f9d242f0770388c027
Instruction ID: d21faa9d9da34e771b0b641e5ea3285dfa19a8cdf054f2b293d4f311ff9eda33
Opcode Fuzzy Hash: ab14c8ba6b8ec7c28ede62265899ec88fb53fd6d075de9f9d242f0770388c027
Instruction Fuzzy Hash: 46511AE2C182989FF7158624EC587EA7F7DE751310F0440FAD54A66281D6BD1BC5CB22

Function 025EAEF4 Relevance: 4.0, Strings: 3, Instructions: 295COMMON

Download Yara Rule

Strings

Q, xrefs: 025EB3BB
7B;2, xrefs: 025EB311
YQ, xrefs: 025EB7D8

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: 7B;2$Q$YQ
API String ID: 0-2086112649
Opcode ID: c5d3e086991dd111372fa0117f3f856af8c142f812b310752429494378cc2e11
Instruction ID: 0fd5df67854d24ee86032ceeba2d95ea1afe32b379bd3c10323a3155cf12195b
Opcode Fuzzy Hash: c5d3e086991dd111372fa0117f3f856af8c142f812b310752429494378cc2e11
Instruction Fuzzy Hash: 33A139B2C041158FEB24CB20DC95AEBBB75FF81315F1481FAD80A97241D639AE86CE52

Function 025E2C7B Relevance: 4.0, Strings: 3, Instructions: 210COMMON

Download Yara Rule

Strings

3, xrefs: 025E30E1
M=M9, xrefs: 025E37F5
e|, xrefs: 025E3090

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: M=M9$e|$3
API String ID: 0-2436971195
Opcode ID: 027230caaf09b0343f382333043eecf9ab2e128ff17492a5cecb8ec26c5603e3
Instruction ID: e8e0674a102db2752fcb78c5c90b9568d1f51ea9704b72c333bec94ec795f499
Opcode Fuzzy Hash: 027230caaf09b0343f382333043eecf9ab2e128ff17492a5cecb8ec26c5603e3
Instruction Fuzzy Hash: 89916DB1D056689BEB29CB18DC856EABBB5FF98310F1481EAD90E63240D7345BC5CE05

Function 0260282C Relevance: 2.9, Strings: 2, Instructions: 353COMMON

Download Yara Rule

Strings

3, xrefs: 02602ADF
e|, xrefs: 02602A8E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: e|$3
API String ID: 0-1726640827
Opcode ID: 33e0ba9de31bb772fd2bf121173325c4fdd2daf1386223d4182eba6863268429
Instruction ID: eb24d137ca4546e03b1ef311e8fd9b4223e2a29c153cc424fcd4ae9c0fdf236b
Opcode Fuzzy Hash: 33e0ba9de31bb772fd2bf121173325c4fdd2daf1386223d4182eba6863268429
Instruction Fuzzy Hash: D1D1D4B1C052688BEB288B28DC986EBBBB5EF45314F0441FAD84D63381E6355EC5DF51

Function 025F27DA Relevance: 2.7, Strings: 2, Instructions: 234COMMON

Download Yara Rule

Strings

e|, xrefs: 025F28C8
3, xrefs: 025F2919

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: e|$3
API String ID: 0-1726640827
Opcode ID: 67b296f1e1022dd70b3d1fae0ced1e46ac05f8f08e708a2e6d05d07fd6d4c57f
Instruction ID: 7d6524d63633d90d29ecb7690dbd8ceb4b76daf33a5015d8293c36844b230b3b
Opcode Fuzzy Hash: 67b296f1e1022dd70b3d1fae0ced1e46ac05f8f08e708a2e6d05d07fd6d4c57f
Instruction Fuzzy Hash: 4BA1ADB5D086A99FEB25CB18CD446EABBB5FF88310F1481EAD94DA3241D7740AC2CF51

Function 025E723B Relevance: 2.0, Strings: 1, Instructions: 729COMMON

Download Yara Rule

Strings

D, xrefs: 025E72D1

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: eef1a1bb66c2f6e54e867d6151cf76f9ba4dd2906c29cdb5fdf94b8ae38f496b
Instruction ID: 577d6c5ab90d075eb496d4b629a0acbbd5501315cd2d1182d7c036f1654a42dc
Opcode Fuzzy Hash: eef1a1bb66c2f6e54e867d6151cf76f9ba4dd2906c29cdb5fdf94b8ae38f496b
Instruction Fuzzy Hash: 36727435E2866887DB28DB799C511DBA2B3EF58300F04E5FD940DE7264F7714A898F0A

Function 026021B0 Relevance: 1.6, Strings: 1, Instructions: 316COMMON

Download Yara Rule

Strings

4@@M, xrefs: 0260215E

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: 4@@M
API String ID: 0-3598929666
Opcode ID: 832a97a9a68d86c5617f994e34397d5d08dbc7fd7552123d80ac13ea1608cd02
Instruction ID: eeb51bee1fd36da24127b37744ba82215448f89c90d52021f7e03ccaba931d52
Opcode Fuzzy Hash: 832a97a9a68d86c5617f994e34397d5d08dbc7fd7552123d80ac13ea1608cd02
Instruction Fuzzy Hash: 93B125B2D141649AE7188B20DC94BFB7735EF41310F1481FAD94DA7680E6785ED2CBA2

Function 025E3473 Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

M=M9, xrefs: 025E37F5

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: M=M9
API String ID: 0-2119929983
Opcode ID: 4f7b1bad0cbf184d7320e8896b604e6dad6f4db04e23f4a1950f35e6cae172bd
Instruction ID: f4f51a9d2db9b04c0756a8234230a2387df1abd69ebd7fc5824e1b8a4488ae4c
Opcode Fuzzy Hash: 4f7b1bad0cbf184d7320e8896b604e6dad6f4db04e23f4a1950f35e6cae172bd
Instruction Fuzzy Hash: 1571F5F2D04158ABFB248A14DC84AFB7779FB84314F1581FAE80E57241E6395EC58E52

Function 025F2CB8 Relevance: 1.5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

Strings

IF7C, xrefs: 025F310C

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: IF7C
API String ID: 0-3432876487
Opcode ID: 63053362f7ef531a3bb37ae1c5be2ac6f276c94fa08a0c5d18e0f8e159573144
Instruction ID: 4d5d98f3f369cd8a1f004a5b22f3a543fd4bf2f6b2a6d8fac3e2a49f0c80f620
Opcode Fuzzy Hash: 63053362f7ef531a3bb37ae1c5be2ac6f276c94fa08a0c5d18e0f8e159573144
Instruction Fuzzy Hash: 7D6189F2D090C4AFF3948A20DC59AE77B6AFBD1310F1400FAD90A86641D63C5AC7CA26

Function 025E323F Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

M=M9, xrefs: 025E37F5

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID: M=M9
API String ID: 0-2119929983
Opcode ID: 5f6dfe6656d05d5c77311201abe6937b2c7b814d2d60bc2640ebc93997525557
Instruction ID: 345e004521c12ab24056d38c2a9050edaf6929cbc0a9c9876d8b047bd88f498a
Opcode Fuzzy Hash: 5f6dfe6656d05d5c77311201abe6937b2c7b814d2d60bc2640ebc93997525557
Instruction Fuzzy Hash: C861E3F2D15168ABFB288A14EC85BF77628FB84310F0481FAD80E27280E6395FC1CE51

Function 0266B179 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbcbf61d6519938a428950d48cf22ed505fe968738b6aad921b0f9c1bc58da74
Instruction ID: 0e65a20ff16c1cef2782af1f445a475532ac320585dd9870a77771d1c7622793
Opcode Fuzzy Hash: dbcbf61d6519938a428950d48cf22ed505fe968738b6aad921b0f9c1bc58da74
Instruction Fuzzy Hash: 409108F2D006249FF7148A15ED88BFB7779EB81314F0440BAE80DA6641D6795FC2CEA2

Function 0266BA36 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b3728ccc3bf93d45df689d46ad46ee000bfe91000339ac80b55cc4b8e914044
Instruction ID: 347730a09dc5d64a3c47bb4e6c8421d65974a39d76e9906029eedabe560a9062
Opcode Fuzzy Hash: 8b3728ccc3bf93d45df689d46ad46ee000bfe91000339ac80b55cc4b8e914044
Instruction Fuzzy Hash: B691D3B2C04224DFE7289F24DC986FA7B75FF41314F0441BAD949A7241EA395AC2CF51

Function 0266C6A5 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7246a1d404e66029266c6615454d62c0c9ac66bcf03f9471059c226d7adeb86
Instruction ID: 31f1beb3080bf3d722574ccc8f2c9684d7979eed337db10b787d1b599bc9ee0d
Opcode Fuzzy Hash: b7246a1d404e66029266c6615454d62c0c9ac66bcf03f9471059c226d7adeb86
Instruction Fuzzy Hash: 5D8149A2D045149AF7248B24DC58BFB7739EFC5310F1481BBD84D9B680EA395EC2CB66

Function 02669182 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eafdc3d0c1037afdbe2557e6979a63caa958ea4c4f597ccd10abb72028856147
Instruction ID: a31fb50709316702896fbe0eb2ddafd00de0c314b53f323fe3dfddec174432ba
Opcode Fuzzy Hash: eafdc3d0c1037afdbe2557e6979a63caa958ea4c4f597ccd10abb72028856147
Instruction Fuzzy Hash: 9F9124B2E046649BE728CA14CC94BFB77BAFF81304F0841F9D80957681D6386EC2CE51

Function 02602E78 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09234d393006b1d09469bccea57a69f3151c80b7a8c5a9a903070e182b64fce
Instruction ID: e74e35057518fb74f180b6b33933383c1c572a33229bd517b7eccfb3cd2fb5d2
Opcode Fuzzy Hash: a09234d393006b1d09469bccea57a69f3151c80b7a8c5a9a903070e182b64fce
Instruction Fuzzy Hash: 408111B2D041649BF72C8A15CCD4EEBBB79EB81315F1441F9D80EA6380C6386BD2CE91

Function 0266B7AB Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f66fbdd50418afce6a7894e5834d053b0120113502038820f6ed489a22edf2
Instruction ID: 23623c02a3b259e0b68c8f916ec9743b95ec94727719845f5279b007157b1554
Opcode Fuzzy Hash: d1f66fbdd50418afce6a7894e5834d053b0120113502038820f6ed489a22edf2
Instruction Fuzzy Hash: 9381C2B2D04224DFE7289B24DC986FABB75FF41314F0441BAD949A7241EA395AC2CF51

Function 0266C412 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c785207dbfd6d284ab69db40cdd4a5b3d2c0f3e2d6bb50f33bbae08ec56c63
Instruction ID: b4c30e4966fbc86cb89007b7cd32ec7b6b72fc6594726ddce231ea7bb688438d
Opcode Fuzzy Hash: e7c785207dbfd6d284ab69db40cdd4a5b3d2c0f3e2d6bb50f33bbae08ec56c63
Instruction Fuzzy Hash: 297135A2D145249AF7248B25DC18BFB7739EFC5710F1081BBD84D9B280E6395EC2CB66

Function 025E5745 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ce2cbe5ef3519eb2ba7a36699fcf2af22e058ad6eb6714585e46ed32a4a626
Instruction ID: 4eeb8791a5ae1dc83d04e713d3bd3e1ee4ccf157e9657bfdc1344e221829690d
Opcode Fuzzy Hash: 55ce2cbe5ef3519eb2ba7a36699fcf2af22e058ad6eb6714585e46ed32a4a626
Instruction Fuzzy Hash: 146157A2D082555AF7108A64DC94AF77B39FF81314F0441BADA4D87681E23E4EC3CB66

Function 0266B7EC Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c034a050d03e35f8f5a45c4282cfb00d45845de0673cc62d4177922b16ef066e
Instruction ID: d30f9f91f1307e466acb565ab94b2ccf45220b1d870c9db8ef7695baf40a3e5d
Opcode Fuzzy Hash: c034a050d03e35f8f5a45c4282cfb00d45845de0673cc62d4177922b16ef066e
Instruction Fuzzy Hash: 1E71E1B2D04268DBD7289F24DC886FABB75FF42314F0441BAD94DA7241EA395AC2CB51

Function 0266B54F Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a6ee27ad006e39c14ae60f1092e0e18143e25f1cd0897977e32d6183db2cebf
Instruction ID: 589c2a772660e607d9a90032f267e5fdf74c91be5bbf895ef400bc3788d17e07
Opcode Fuzzy Hash: 6a6ee27ad006e39c14ae60f1092e0e18143e25f1cd0897977e32d6183db2cebf
Instruction Fuzzy Hash: A361F6B3D04624DFF7148A15ED88AFB7779EB81314F0440BAE80DA6640E67D5FC6CA62

Function 025FC3EE Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceeb025372b7be7e730cd278c151f2a8012b6699722c6483c231a9270987f322
Instruction ID: 3b75f5709e709478e7759738657d4274905c7c0e3ecad5fb79877231c25727ff
Opcode Fuzzy Hash: ceeb025372b7be7e730cd278c151f2a8012b6699722c6483c231a9270987f322
Instruction Fuzzy Hash: E37124A2D141298AFB288B20DC51BFA7675FF94311F1040BFE60E97680E67D5EC2CB16

Function 0266C429 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bbacd8796875ce1b9c7562de7bc1f15ceae9d7c800ead50439ef262d8dbc109
Instruction ID: 3c24c88c0f8017a928fb853b069e3bfa4b52d911b52803506c63bc935de36f25
Opcode Fuzzy Hash: 9bbacd8796875ce1b9c7562de7bc1f15ceae9d7c800ead50439ef262d8dbc109
Instruction Fuzzy Hash: AE6117A2D105249AF7248B25DC18BFB7779EFC4710F1081BBD84D97280E6395EC2CB66

Function 0266B94A Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5874255093db914e1c3f9a2d880605ba7dbbdb8cc23e60c43ed4774db5e3a1
Instruction ID: 278de900cbbf0793c959810d5df3cbd1240ea92142a415f27a5eb4022eee1dbc
Opcode Fuzzy Hash: 2b5874255093db914e1c3f9a2d880605ba7dbbdb8cc23e60c43ed4774db5e3a1
Instruction Fuzzy Hash: E271E3B2C04264DBD7289F24DC886FBBB75FB42314F0441BED949A6241EA395EC2CF51

Function 0266C449 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832d98851e0777dd2c62b64c93ea7a4164bec38ea830c896cbdafa3668d789cd
Instruction ID: 39e35c5aab468c5930e6f6c32235ee324734b2cbde7b3a88a33350f8a9280068
Opcode Fuzzy Hash: 832d98851e0777dd2c62b64c93ea7a4164bec38ea830c896cbdafa3668d789cd
Instruction Fuzzy Hash: 71612792D105249AF7248B29DC18BFB773AEFC4710F1081BBD84D97280E6395EC2CB66

Function 0266C5A7 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b9cb821d65bbde9f3eb1e7800ac856a15f8ab2747194cc6fe64a82ee2deb985
Instruction ID: e42033d23b7e6d72e90aea881a91aea72508b733083d52daa6c6ad1ba83f23d7
Opcode Fuzzy Hash: 1b9cb821d65bbde9f3eb1e7800ac856a15f8ab2747194cc6fe64a82ee2deb985
Instruction Fuzzy Hash: 2D614792E145649AF7248B25DC18BFB763AEFC4710F1081BBD44D97680E63D4EC2CB66

Function 025EF390 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25d6f13d96f0329ce9fb6529ccff2f4e0c937e5930e3c0a21d265d3ea7deaefb
Instruction ID: a85d4199dd39a8f8ee4072e7c303996e425305b78df24d80dc934c6412569853
Opcode Fuzzy Hash: 25d6f13d96f0329ce9fb6529ccff2f4e0c937e5930e3c0a21d265d3ea7deaefb
Instruction Fuzzy Hash: C96109A3D005245BFB248B28EC44AF77779FF84310F1482B6E80E97690EA7D5EC5CA95

Function 0266B82D Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f659bf2f27c9f901cb09c8f9d879e7767306be3c59a08a150f39c56f89879215
Instruction ID: 66ec7c992389e076165d09c8f5648305fca1862598402e242bd9e3ebf9542e0d
Opcode Fuzzy Hash: f659bf2f27c9f901cb09c8f9d879e7767306be3c59a08a150f39c56f89879215
Instruction Fuzzy Hash: 2461E3B2C04268DBDB289F24DC886FABB75FB41314F0441BAD94DA6241EA395AC2CF51

Function 0266C471 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e8bd2bd82c5572c0409a98e75a57955b75263376d4c9a4362373276991b4fa
Instruction ID: c42c200e22e048e4224589bd9ab52196be30ff2cedd6ffe1c30334d874b9cd5c
Opcode Fuzzy Hash: 91e8bd2bd82c5572c0409a98e75a57955b75263376d4c9a4362373276991b4fa
Instruction Fuzzy Hash: 13514892E105649AF7248B29DC18BFB773AEFC5710F1081BBD44D97280E6395EC2CB66

Function 025EC35D Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0137ab2d450b1a22e458c0f053bb61cfa111a451ec261a45b788261a1d578b04
Instruction ID: f7dd055428a5550e142d94753d35ce83f477dc438a987a431adb67a15ec4db72
Opcode Fuzzy Hash: 0137ab2d450b1a22e458c0f053bb61cfa111a451ec261a45b788261a1d578b04
Instruction Fuzzy Hash: A75114E2C151149AFB288B24DC45BFB7739FB84311F0082BBE80F66680E6385EC1CE16

Function 025EE282 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be0fac538c12bcbe271e6dd786a1e62ab624e7b4cd7ce265b4bdcfc12f23cb41
Instruction ID: 31eecdf9cff17d353e716392d4899f699987a53f06a921cf0be47b66ea942e02
Opcode Fuzzy Hash: be0fac538c12bcbe271e6dd786a1e62ab624e7b4cd7ce265b4bdcfc12f23cb41
Instruction Fuzzy Hash: 295128A3D152285BFB288B64EC85BEB7765FF81320F0541F6D84D66240E63C5EC2CA96

Function 025F279E Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef77fe375ce3e86d625b1025a709553aaa9c9c7d5860eb1d35f4ce1907362c02
Instruction ID: 1834f93856758e9bfd930e8dce04b41aa8ddfdab50f98bfccf6a4e9b96ccd1e0
Opcode Fuzzy Hash: ef77fe375ce3e86d625b1025a709553aaa9c9c7d5860eb1d35f4ce1907362c02
Instruction Fuzzy Hash: 4D5113E2D042644BF7648B24DC91BF73779FB81310F0481FAD94E86281E7385EC6CA56

Function 0266C24D Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39694448570a9b7b7df6466aa16ed544fae18be8f7586eb1856326a5de89df35
Instruction ID: 7ae5b0b007790306b177e661912448d9e6c63d58ee66a1e3fb4310001e465d6f
Opcode Fuzzy Hash: 39694448570a9b7b7df6466aa16ed544fae18be8f7586eb1856326a5de89df35
Instruction Fuzzy Hash: D85147A2E045549AF3208B64DC4CBB73A3ADF81310F1481BBD84DCB681D57E9EC78B62

Function 025EC0BA Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0bcb3cc996609ea270a97a8d58a6f82270d96b31bc194f9983395b1fbd93eb6
Instruction ID: 3abb2121c273681f473a5cfb7299e601bb13e21909605e4e11b1b4dc691ab2ca
Opcode Fuzzy Hash: f0bcb3cc996609ea270a97a8d58a6f82270d96b31bc194f9983395b1fbd93eb6
Instruction Fuzzy Hash: 8C51F4A28151259AFB288B65DC44BFBB776FB84711F10C1FBD40E65680E6389EC1CE25

Function 0266A706 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45e4b58fb94d4d30b053a54e20d213344342fee7f6df475364ad046ee1cec3a
Instruction ID: 339af7443f6d3527b4237513f3011c07e953330bbfc265a316a4fd154324b6a2
Opcode Fuzzy Hash: d45e4b58fb94d4d30b053a54e20d213344342fee7f6df475364ad046ee1cec3a
Instruction Fuzzy Hash: 4D5125A2D092549FF7288B61DC59AFB7775EB44310F0480FED90E66280E63D6EC2CE52

Function 0266C4F5 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3d29b8a02d2230f063a557fdccbe5a0738f2fc64115db09a3911d2643a0b5d
Instruction ID: 6bd4c51555ebbb1fdfebff7886fc0f392656c768be5558750180b72f194fdd83
Opcode Fuzzy Hash: bf3d29b8a02d2230f063a557fdccbe5a0738f2fc64115db09a3911d2643a0b5d
Instruction Fuzzy Hash: 18512791E145159AF7248B24DD1CBFB7639EF84700F1081BBD44DD7280E63A5EC1CB66

Function 0266C282 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7153ce8a0d988c54a6124e676f1b62ef68f0e23671f24698c29c2eb49b126b95
Instruction ID: d1d013c3a5b628e8f2fcb7ae6cf4101a1e31a53badb9bb350a1151cd6193682e
Opcode Fuzzy Hash: 7153ce8a0d988c54a6124e676f1b62ef68f0e23671f24698c29c2eb49b126b95
Instruction Fuzzy Hash: 5F5149A2E145555AF7208B25DC08BB7373AEF81310F1081BBD80DC7685D63E9EC28B62

Function 02606565 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c99d1672ed1c770a0994a562f9736a1b6421944077d8dd958796ef2ee7928ff
Instruction ID: 294acfe2d38ec1f0d3170a5449f4e99dea76b389ce19acd1abf0c52db4c1d600
Opcode Fuzzy Hash: 2c99d1672ed1c770a0994a562f9736a1b6421944077d8dd958796ef2ee7928ff
Instruction Fuzzy Hash: 7B518FB1911615CFEB18CF59D9C17AABBF4FB48305F248429C511EB390D3B8AA10DF54

Function 02667418 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726075395.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2660000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe1196be9691b295e79d5c6987db17e17c954d86ec434230c486cf5f600f44aa
Instruction ID: 06237c5d40318ff9588214b81713e9f6a5b91543d3e4c6f5fd57f4998a927617
Opcode Fuzzy Hash: fe1196be9691b295e79d5c6987db17e17c954d86ec434230c486cf5f600f44aa
Instruction Fuzzy Hash: 674127A2E041649AE7258B26DC44AFFB7B5EFC5714F1081FAD44D96280E63C4AC2CF56

Function 025EC0C1 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50b83d284abb6a08a95ceb79507c8ba4ec19232c9a96bd1d2d1d03073eaf3fab
Instruction ID: 32e8f6e40d5387b29ab39e26e518eb8a1038334c91c7fcd66075b0fd352f3bbf
Opcode Fuzzy Hash: 50b83d284abb6a08a95ceb79507c8ba4ec19232c9a96bd1d2d1d03073eaf3fab
Instruction Fuzzy Hash: DE41D3A28151259AFB288B29DC44BFBB775FB84711F00C6FBD40EA6684E6385EC1CF15

Function 025F5E87 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9786eeda9ff16d8fc223fd39e3999591cda13721f48248c8b5b21c460bfea866
Instruction ID: 500500db01a649bc6556eb5e100357a4fb1e49bfa4098554f29e5e2f1a4ff85e
Opcode Fuzzy Hash: 9786eeda9ff16d8fc223fd39e3999591cda13721f48248c8b5b21c460bfea866
Instruction Fuzzy Hash: DA41B1B2D011385AE7248B14DC90BFBB67AFF84314F0440FAE90D63280E6785EC1CAA6

Function 025FF061 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f5c3a184a8814c7ea1d5ed56103c383d90568fa819f7f39f058a410a2ff9a9
Instruction ID: 799037c059331d0c3f4b070e94da80f7be8c1b1f0b3df3e6f5664cdc8f6ea608
Opcode Fuzzy Hash: 81f5c3a184a8814c7ea1d5ed56103c383d90568fa819f7f39f058a410a2ff9a9
Instruction Fuzzy Hash: BA41D372D080349BEB648A14DC94BEB7BB9FF41314F1841FADA4D26A80D7396EC0CA95

Function 025E3C95 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452c5824668edf7bbe0322207991df14b56860d3730b3ba7ea94afae636e8716
Instruction ID: a8dd72ea60d577856b8f27c62543b5014853ada3a2f9b5cf49e87f66b8eae77f
Opcode Fuzzy Hash: 452c5824668edf7bbe0322207991df14b56860d3730b3ba7ea94afae636e8716
Instruction Fuzzy Hash: B04129F2C04155AFFB188E20DD84BBB7769EB85320F0481FBD8065A680E579AEC1CE56

Function 025ED30E Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8016b5b95b5a54ff1c093efdf719769a78a3d575d7dd3fa75ed35e1191afe7cc
Instruction ID: 6072aaada2ea4f122293a94adddfa34ef08a78608104664bab256b71a47895a8
Opcode Fuzzy Hash: 8016b5b95b5a54ff1c093efdf719769a78a3d575d7dd3fa75ed35e1191afe7cc
Instruction Fuzzy Hash: 394135A2D051149BF7288A25DC84FEB7B79FFC5320F1581BAD84D4B681C13D5AC3CA12

Function 025EC104 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7049b93cf88e84cff4947081ba4ffdcc86ef9cf3618d7bb1a50d0d9e124730a
Instruction ID: 5b4ee0d80802b40d7b88280aa8d863bbd394e024feaa26949143f4b7234ced8f
Opcode Fuzzy Hash: e7049b93cf88e84cff4947081ba4ffdcc86ef9cf3618d7bb1a50d0d9e124730a
Instruction Fuzzy Hash: 494102E28151159AFB288B29DC44BFBA676FB84711F00C5FAD40EA5684E6389EC1CB25

Function 025EC111 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be83ebf1ae0e5c55cbd1350b25ea90fdb32308c23beaa246a83b3a1421bc53f
Instruction ID: 266ab801ba8038a7b932ba78169d4f09b39153c38f35682a3664f3bbae85d103
Opcode Fuzzy Hash: 0be83ebf1ae0e5c55cbd1350b25ea90fdb32308c23beaa246a83b3a1421bc53f
Instruction Fuzzy Hash: D34102E28111159AFB248B25DC40BFBB376FF84701F10C1BAD44EA6684E6389EC1CF26

Function 025EE00A Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1726014711.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_25e0000_AdobeReaderPDFonline.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ea49b75e61007fe92157f368dcae0a7d1e605d9751c44a0b1432f1fe6bd8a3
Instruction ID: 1e289ea841ad98feff1c4512da15a9634537433e83fbd01e6806633e2a1f34ca
Opcode Fuzzy Hash: 34ea49b75e61007fe92157f368dcae0a7d1e605d9751c44a0b1432f1fe6bd8a3
Instruction Fuzzy Hash: 404126A2D251688AEB248F64DC81BE7B771FF85310F0441FAD84DA7240E6385EC2CB92

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AdobeReaderPDFonline.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
AdobeReaderPDFonline.exe

Function 025E1939 Relevance: 38.9, APIs: 1, Strings: 21, Instructions: 447
COMMON

Function 025F0B6E Relevance: 33.7, APIs: 1, Strings: 18, Instructions: 415
COMMON

Function 025F0E2E Relevance: 33.6, APIs: 1, Strings: 18, Instructions: 393
COMMON

Function 025F0BB0 Relevance: 33.6, APIs: 1, Strings: 18, Instructions: 376
threadCOMMON

Function 025F0A21 Relevance: 33.6, APIs: 1, Strings: 18, Instructions: 341
threadCOMMON

Function 025F1199 Relevance: 33.6, APIs: 1, Strings: 18, Instructions: 329
COMMON

Function 025F11A6 Relevance: 33.6, APIs: 1, Strings: 18, Instructions: 321
COMMON

Function 025F1221 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 292
COMMON

Function 025F12C3 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 284
COMMON

Function 025F1559 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 284
COMMON

Function 025F12CE Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 283
COMMON

Function 025F0C1F Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 280
COMMON

Function 025F1568 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 279
COMMON

Function 025F1011 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 272
COMMON